x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}}, 0x0, 0x6, 0xffffffffffffffff, 0xb)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
r1 = gettid()
rt_sigqueueinfo(0x0, 0x0, 0x0)
r2 = pidfd_getfd(0xffffffffffffffff, r0, 0x0)
perf_event_open(&(0x7f0000000040)={0x5, 0x80, 0x40, 0x71, 0x2, 0x0, 0x0, 0x8000, 0x20, 0x9, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, @perf_config_ext={0xff}, 0x0, 0x9b5, 0xfa, 0xd, 0x0, 0x8000, 0x55, 0x0, 0x0, 0x0, 0x3ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000400)={0x2, 0x80, 0x2a, 0x81, 0xe0, 0x40, 0x0, 0x63c5ef1c, 0x80, 0x3, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x7, 0x2, @perf_config_ext={0xf2, 0x6}, 0x0, 0x5, 0xfffffff8, 0x0, 0x1, 0x0, 0x1b6, 0x0, 0x6}, 0x0, 0xd, 0xffffffffffffffff, 0x0)
rt_sigqueueinfo(0x0, 0x0, &(0x7f0000000000))
setsockopt$sock_timeval(r0, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10)
bind$packet(r2, &(0x7f00000000c0)={0x11, 0xfe, 0x0, 0x1, 0xfb, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}}, 0x14)
perf_event_open(&(0x7f0000000100)={0x0, 0x80, 0xff, 0x8, 0x4, 0x1, 0x0, 0x4, 0x684, 0x4, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0xdbc, 0x0, @perf_config_ext={0xd03, 0x80000000}, 0x800, 0x3, 0x3, 0x5, 0x300000000000000, 0x7, 0x7ff, 0x0, 0x0, 0x0, 0x5}, r1, 0x10, 0xffffffffffffffff, 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r3, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
openat(r3, &(0x7f0000000180)='\x00', 0x400040, 0x80)
rt_sigqueueinfo(0x0, 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f0000000240)={'ip6_vti0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x4, 0x0, 0x7f, 0x40, 0xb, @local, @mcast1, 0x88, 0x20, 0x8, 0x2}})

00:05:25 executing program 3:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684f"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x100d}], 0x1, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:05:25 executing program 1:
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}}, 0x0, 0x6, 0xffffffffffffffff, 0xb)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
r1 = gettid()
rt_sigqueueinfo(0x0, 0x0, 0x0)
r2 = pidfd_getfd(0xffffffffffffffff, r0, 0x0)
perf_event_open(&(0x7f0000000040)={0x5, 0x80, 0x40, 0x71, 0x2, 0x0, 0x0, 0x8000, 0x20, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, @perf_config_ext={0xff}, 0x0, 0x9b5, 0xfa, 0xd, 0x0, 0x8000, 0x55, 0x0, 0x0, 0x0, 0x3ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000400)={0x2, 0x80, 0x2a, 0x81, 0xe0, 0x40, 0x0, 0x63c5ef1c, 0x80, 0x3, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x7, 0x2, @perf_config_ext={0xf2, 0x6}, 0x0, 0x5, 0xfffffff8, 0x0, 0x1, 0x0, 0x1b6, 0x0, 0x6}, 0x0, 0xd, 0xffffffffffffffff, 0x0)
rt_sigqueueinfo(0x0, 0x0, &(0x7f0000000000))
setsockopt$sock_timeval(r0, 0x1, 0x49, 0x0, 0x0)
bind$packet(r2, &(0x7f00000000c0)={0x11, 0xfe, 0x0, 0x1, 0xfb, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}}, 0x14)
perf_event_open(&(0x7f0000000100)={0x0, 0x80, 0xff, 0x8, 0x4, 0x1, 0x0, 0x4, 0x684, 0x4, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0xdbc, 0x0, @perf_config_ext={0xd03, 0x80000000}, 0x800, 0x3, 0x3, 0x5, 0x300000000000000, 0x7, 0x7ff, 0x0, 0x0, 0x0, 0x5}, r1, 0x10, 0xffffffffffffffff, 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r3, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
openat(r3, &(0x7f0000000180)='\x00', 0x400040, 0x80)
rt_sigqueueinfo(0x0, 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f0000000240)={'ip6_vti0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x4, 0x0, 0x7f, 0x40, 0xb, @local, @mcast1, 0x88, 0x20, 0x8, 0x2}})

00:05:25 executing program 6:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, 0x0, 0x0, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684fd2981c8409820000080000000000000000"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x100d}], 0x1, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:05:25 executing program 7:
r0 = perf_event_open(&(0x7f0000000080)={0x0, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684fd2981c8409820000080000000000000000"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x100d}], 0x1, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:05:25 executing program 5:
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684fd2981c8409820000080000000000000000"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r1, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x100d}], 0x1, 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r0, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r2, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r1, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:05:25 executing program 3:
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684fd2981c8409820000080000000000000000"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r1, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x100d}], 0x1, 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r0, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r2, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r1, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:05:41 executing program 1:
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}}, 0x0, 0x6, 0xffffffffffffffff, 0xb)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
r1 = gettid()
rt_sigqueueinfo(0x0, 0x0, 0x0)
r2 = pidfd_getfd(0xffffffffffffffff, r0, 0x0)
perf_event_open(&(0x7f0000000040)={0x5, 0x80, 0x40, 0x71, 0x2, 0x0, 0x0, 0x8000, 0x20, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, @perf_config_ext={0xff}, 0x0, 0x9b5, 0xfa, 0xd, 0x0, 0x8000, 0x55, 0x0, 0x0, 0x0, 0x3ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000400)={0x2, 0x80, 0x2a, 0x81, 0xe0, 0x40, 0x0, 0x63c5ef1c, 0x80, 0x3, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x7, 0x2, @perf_config_ext={0xf2, 0x6}, 0x0, 0x5, 0xfffffff8, 0x0, 0x1, 0x0, 0x1b6, 0x0, 0x6}, 0x0, 0xd, 0xffffffffffffffff, 0x0)
rt_sigqueueinfo(0x0, 0x0, &(0x7f0000000000))
setsockopt$sock_timeval(r0, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10)
bind$packet(0xffffffffffffffff, &(0x7f00000000c0)={0x11, 0xfe, 0x0, 0x1, 0xfb, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}}, 0x14)
perf_event_open(&(0x7f0000000100)={0x0, 0x80, 0xff, 0x8, 0x4, 0x1, 0x0, 0x4, 0x684, 0x4, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0xdbc, 0x0, @perf_config_ext={0xd03, 0x80000000}, 0x800, 0x3, 0x3, 0x5, 0x300000000000000, 0x7, 0x7ff, 0x0, 0x0, 0x0, 0x5}, r1, 0x10, 0xffffffffffffffff, 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r3, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
openat(r3, &(0x7f0000000180)='\x00', 0x400040, 0x80)
rt_sigqueueinfo(0x0, 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f0000000240)={'ip6_vti0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x4, 0x0, 0x7f, 0x40, 0xb, @local, @mcast1, 0x88, 0x20, 0x8, 0x2}})

00:05:41 executing program 3:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684fd2981c8409820000080000000000000000"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x100d}], 0x1, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:05:41 executing program 4:
r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000340)='/proc/vmstat\x00', 0x0, 0x0)
openat(r0, &(0x7f0000000380)='./file2\x00', 0x0, 0x10)
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r2, r1, 0x0, 0xfffffdef)

00:05:41 executing program 7:
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}}, 0x0, 0x6, 0xffffffffffffffff, 0xb)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
r1 = gettid()
rt_sigqueueinfo(0x0, 0x0, 0x0)
r2 = pidfd_getfd(0xffffffffffffffff, r0, 0x0)
perf_event_open(&(0x7f0000000040)={0x5, 0x80, 0x40, 0x71, 0x2, 0x0, 0x0, 0x8000, 0x0, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, @perf_config_ext={0xff}, 0x0, 0x9b5, 0xfa, 0xd, 0x0, 0x8000, 0x55, 0x0, 0x0, 0x0, 0x3ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000400)={0x2, 0x80, 0x2a, 0x81, 0xe0, 0x40, 0x0, 0x63c5ef1c, 0x80, 0x3, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x7, 0x2, @perf_config_ext={0xf2, 0x6}, 0x0, 0x5, 0xfffffff8, 0x0, 0x1, 0x0, 0x1b6, 0x0, 0x6}, 0x0, 0xd, 0xffffffffffffffff, 0x0)
rt_sigqueueinfo(0x0, 0x0, &(0x7f0000000000))
setsockopt$sock_timeval(r0, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10)
bind$packet(r2, &(0x7f00000000c0)={0x11, 0xfe, 0x0, 0x1, 0xfb, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}}, 0x14)
perf_event_open(&(0x7f0000000100)={0x0, 0x80, 0xff, 0x8, 0x4, 0x1, 0x0, 0x4, 0x684, 0x4, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0xdbc, 0x0, @perf_config_ext={0xd03, 0x80000000}, 0x800, 0x3, 0x3, 0x5, 0x300000000000000, 0x7, 0x7ff, 0x0, 0x0, 0x0, 0x5}, r1, 0x10, 0xffffffffffffffff, 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r3, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
openat(r3, &(0x7f0000000180)='\x00', 0x400040, 0x80)
rt_sigqueueinfo(0x0, 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f0000000240)={'ip6_vti0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x4, 0x0, 0x7f, 0x40, 0xb, @local, @mcast1, 0x88, 0x20, 0x8, 0x2}})

00:05:41 executing program 0:
r0 = perf_event_open(&(0x7f0000000080)={0x0, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684fd2981c8409820000080000000000000000"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x100d}], 0x1, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:05:41 executing program 6:
r0 = perf_event_open(&(0x7f0000000080)={0x0, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684fd2981c8409820000080000000000000000"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x100d}], 0x1, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:05:41 executing program 5:
perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684fd2981c8409820000080000000000000000"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r1, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x100d}], 0x1, 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r0, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r2, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r1, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:05:41 executing program 2:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684f"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x100d}], 0x1, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:05:41 executing program 3:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684fd2981c8409820000080000000000000000"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x100d}], 0x1, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

[ 2030.678082] loop4: detected capacity change from 0 to 40
00:05:41 executing program 1:
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}}, 0x0, 0x6, 0xffffffffffffffff, 0xb)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
r1 = gettid()
rt_sigqueueinfo(0x0, 0x0, 0x0)
r2 = pidfd_getfd(0xffffffffffffffff, r0, 0x0)
perf_event_open(&(0x7f0000000040)={0x5, 0x80, 0x40, 0x71, 0x2, 0x0, 0x0, 0x8000, 0x20, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, @perf_config_ext={0xff}, 0x0, 0x9b5, 0xfa, 0xd, 0x0, 0x8000, 0x55, 0x0, 0x0, 0x0, 0x3ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000400)={0x2, 0x80, 0x2a, 0x81, 0xe0, 0x40, 0x0, 0x63c5ef1c, 0x80, 0x3, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x7, 0x2, @perf_config_ext={0xf2, 0x6}, 0x0, 0x5, 0xfffffff8, 0x0, 0x1, 0x0, 0x1b6, 0x0, 0x6}, 0x0, 0xd, 0xffffffffffffffff, 0x0)
rt_sigqueueinfo(0x0, 0x0, &(0x7f0000000000))
setsockopt$sock_timeval(r0, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10)
bind$packet(0xffffffffffffffff, &(0x7f00000000c0)={0x11, 0xfe, 0x0, 0x1, 0xfb, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}}, 0x14)
perf_event_open(&(0x7f0000000100)={0x0, 0x80, 0xff, 0x8, 0x4, 0x1, 0x0, 0x4, 0x684, 0x4, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0xdbc, 0x0, @perf_config_ext={0xd03, 0x80000000}, 0x800, 0x3, 0x3, 0x5, 0x300000000000000, 0x7, 0x7ff, 0x0, 0x0, 0x0, 0x5}, r1, 0x10, 0xffffffffffffffff, 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r3, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
openat(r3, &(0x7f0000000180)='\x00', 0x400040, 0x80)
rt_sigqueueinfo(0x0, 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f0000000240)={'ip6_vti0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x4, 0x0, 0x7f, 0x40, 0xb, @local, @mcast1, 0x88, 0x20, 0x8, 0x2}})

00:05:41 executing program 7:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684fd2981c8409820000080000000000000000"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x100d}], 0x1, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:05:41 executing program 0:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684fd2981c8409820000080000000000000000"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x100d}], 0x1, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:05:41 executing program 2:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684f"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x100d}], 0x1, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:05:42 executing program 1:
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}}, 0x0, 0x6, 0xffffffffffffffff, 0xb)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
r1 = gettid()
rt_sigqueueinfo(0x0, 0x0, 0x0)
r2 = pidfd_getfd(0xffffffffffffffff, r0, 0x0)
perf_event_open(&(0x7f0000000040)={0x5, 0x80, 0x40, 0x71, 0x2, 0x0, 0x0, 0x8000, 0x20, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, @perf_config_ext={0xff}, 0x0, 0x9b5, 0xfa, 0xd, 0x0, 0x8000, 0x55, 0x0, 0x0, 0x0, 0x3ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000400)={0x2, 0x80, 0x2a, 0x81, 0xe0, 0x40, 0x0, 0x63c5ef1c, 0x80, 0x3, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x7, 0x2, @perf_config_ext={0xf2, 0x6}, 0x0, 0x5, 0xfffffff8, 0x0, 0x1, 0x0, 0x1b6, 0x0, 0x6}, 0x0, 0xd, 0xffffffffffffffff, 0x0)
rt_sigqueueinfo(0x0, 0x0, &(0x7f0000000000))
setsockopt$sock_timeval(r0, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10)
bind$packet(0xffffffffffffffff, &(0x7f00000000c0)={0x11, 0xfe, 0x0, 0x1, 0xfb, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}}, 0x14)
perf_event_open(&(0x7f0000000100)={0x0, 0x80, 0xff, 0x8, 0x4, 0x1, 0x0, 0x4, 0x684, 0x4, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0xdbc, 0x0, @perf_config_ext={0xd03, 0x80000000}, 0x800, 0x3, 0x3, 0x5, 0x300000000000000, 0x7, 0x7ff, 0x0, 0x0, 0x0, 0x5}, r1, 0x10, 0xffffffffffffffff, 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r3, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
openat(r3, &(0x7f0000000180)='\x00', 0x400040, 0x80)
rt_sigqueueinfo(0x0, 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f0000000240)={'ip6_vti0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x4, 0x0, 0x7f, 0x40, 0xb, @local, @mcast1, 0x88, 0x20, 0x8, 0x2}})

00:05:42 executing program 6:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684fd2981c8409820000080000000000000000"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x100d}], 0x1, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:05:42 executing program 3:
r0 = perf_event_open(&(0x7f0000000080)={0x0, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684fd2981c8409820000080000000000000000"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x100d}], 0x1, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))

00:05:42 executing program 2:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684f"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x100d}], 0x1, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:05:42 executing program 5:
r0 = perf_event_open(&(0x7f0000000080)={0x0, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684fd2981c8409820000080000000000000000"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x100d}], 0x1, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))

00:05:42 executing program 4:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684fd2981c8409820000080000000000000000"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x100d}], 0x1, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:05:42 executing program 7:
r0 = perf_event_open(&(0x7f0000000080)={0x0, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684fd2981c8409820000080000000000000000"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x100d}], 0x1, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))

00:05:42 executing program 1:
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}}, 0x0, 0x6, 0xffffffffffffffff, 0xb)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
r1 = gettid()
rt_sigqueueinfo(0x0, 0x0, 0x0)
r2 = pidfd_getfd(0xffffffffffffffff, r0, 0x0)
perf_event_open(&(0x7f0000000040)={0x5, 0x80, 0x40, 0x71, 0x2, 0x0, 0x0, 0x8000, 0x20, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, @perf_config_ext={0xff}, 0x0, 0x9b5, 0xfa, 0xd, 0x0, 0x8000, 0x55, 0x0, 0x0, 0x0, 0x3ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000400)={0x2, 0x80, 0x2a, 0x81, 0xe0, 0x40, 0x0, 0x63c5ef1c, 0x80, 0x3, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x7, 0x2, @perf_config_ext={0xf2, 0x6}, 0x0, 0x5, 0xfffffff8, 0x0, 0x1, 0x0, 0x1b6, 0x0, 0x6}, 0x0, 0xd, 0xffffffffffffffff, 0x0)
rt_sigqueueinfo(0x0, 0x0, &(0x7f0000000000))
setsockopt$sock_timeval(r0, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10)
bind$packet(r2, 0x0, 0x0)
perf_event_open(&(0x7f0000000100)={0x0, 0x80, 0xff, 0x8, 0x4, 0x1, 0x0, 0x4, 0x684, 0x4, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0xdbc, 0x0, @perf_config_ext={0xd03, 0x80000000}, 0x800, 0x3, 0x3, 0x5, 0x300000000000000, 0x7, 0x7ff, 0x0, 0x0, 0x0, 0x5}, r1, 0x10, 0xffffffffffffffff, 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r3, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
openat(r3, &(0x7f0000000180)='\x00', 0x400040, 0x80)
rt_sigqueueinfo(0x0, 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f0000000240)={'ip6_vti0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x4, 0x0, 0x7f, 0x40, 0xb, @local, @mcast1, 0x88, 0x20, 0x8, 0x2}})

00:05:42 executing program 2:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684f"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x100d}], 0x1, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:05:58 executing program 0:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684fd2981c8409820000080000000000000000"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x100d}], 0x1, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:05:58 executing program 4:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684fd2981c8409820000080000000000000000"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x100d}], 0x1, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:05:58 executing program 2:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684f"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x100d}], 0x1, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:05:58 executing program 1:
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}}, 0x0, 0x6, 0xffffffffffffffff, 0xb)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
r1 = gettid()
rt_sigqueueinfo(0x0, 0x0, 0x0)
r2 = pidfd_getfd(0xffffffffffffffff, r0, 0x0)
perf_event_open(&(0x7f0000000040)={0x5, 0x80, 0x40, 0x71, 0x2, 0x0, 0x0, 0x8000, 0x20, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, @perf_config_ext={0xff}, 0x0, 0x9b5, 0xfa, 0xd, 0x0, 0x8000, 0x55, 0x0, 0x0, 0x0, 0x3ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000400)={0x2, 0x80, 0x2a, 0x81, 0xe0, 0x40, 0x0, 0x63c5ef1c, 0x80, 0x3, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x7, 0x2, @perf_config_ext={0xf2, 0x6}, 0x0, 0x5, 0xfffffff8, 0x0, 0x1, 0x0, 0x1b6, 0x0, 0x6}, 0x0, 0xd, 0xffffffffffffffff, 0x0)
rt_sigqueueinfo(0x0, 0x0, &(0x7f0000000000))
setsockopt$sock_timeval(r0, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10)
bind$packet(r2, 0x0, 0x0)
perf_event_open(&(0x7f0000000100)={0x0, 0x80, 0xff, 0x8, 0x4, 0x1, 0x0, 0x4, 0x684, 0x4, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0xdbc, 0x0, @perf_config_ext={0xd03, 0x80000000}, 0x800, 0x3, 0x3, 0x5, 0x300000000000000, 0x7, 0x7ff, 0x0, 0x0, 0x0, 0x5}, r1, 0x10, 0xffffffffffffffff, 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r3, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
openat(r3, &(0x7f0000000180)='\x00', 0x400040, 0x80)
rt_sigqueueinfo(0x0, 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f0000000240)={'ip6_vti0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x4, 0x0, 0x7f, 0x40, 0xb, @local, @mcast1, 0x88, 0x20, 0x8, 0x2}})

00:05:58 executing program 3:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684fd2981c8409820000080000000000000000"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x100d}], 0x1, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:05:58 executing program 6:
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}}, 0x0, 0x6, 0xffffffffffffffff, 0xb)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
r1 = gettid()
rt_sigqueueinfo(0x0, 0x0, 0x0)
r2 = pidfd_getfd(0xffffffffffffffff, r0, 0x0)
perf_event_open(&(0x7f0000000040)={0x5, 0x80, 0x40, 0x71, 0x0, 0x0, 0x0, 0x8000, 0x20, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, @perf_config_ext={0xff}, 0x0, 0x9b5, 0xfa, 0xd, 0x0, 0x8000, 0x55, 0x0, 0x0, 0x0, 0x3ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000400)={0x2, 0x80, 0x2a, 0x81, 0xe0, 0x40, 0x0, 0x63c5ef1c, 0x80, 0x3, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x7, 0x2, @perf_config_ext={0xf2, 0x6}, 0x0, 0x5, 0xfffffff8, 0x0, 0x1, 0x0, 0x1b6, 0x0, 0x6}, 0x0, 0xd, 0xffffffffffffffff, 0x0)
rt_sigqueueinfo(0x0, 0x0, &(0x7f0000000000))
setsockopt$sock_timeval(r0, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10)
bind$packet(r2, &(0x7f00000000c0)={0x11, 0xfe, 0x0, 0x1, 0xfb, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}}, 0x14)
perf_event_open(&(0x7f0000000100)={0x0, 0x80, 0xff, 0x8, 0x4, 0x1, 0x0, 0x4, 0x684, 0x4, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0xdbc, 0x0, @perf_config_ext={0xd03, 0x80000000}, 0x800, 0x3, 0x3, 0x5, 0x300000000000000, 0x7, 0x7ff, 0x0, 0x0, 0x0, 0x5}, r1, 0x10, 0xffffffffffffffff, 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r3, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
openat(r3, &(0x7f0000000180)='\x00', 0x400040, 0x80)
rt_sigqueueinfo(0x0, 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f0000000240)={'ip6_vti0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x4, 0x0, 0x7f, 0x40, 0xb, @local, @mcast1, 0x88, 0x20, 0x8, 0x2}})

00:05:58 executing program 5:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684fd2981c8409820000080000000000000000"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x100d}], 0x1, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:05:58 executing program 7:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684fd2981c8409820000080000000000000000"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x100d}], 0x1, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:05:58 executing program 2:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684f"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x100d}], 0x1, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:05:58 executing program 0:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684fd2981c8409820000080000000000000000"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x100d}], 0x1, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:05:58 executing program 3:
r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000340)='/proc/vmstat\x00', 0x0, 0x0)
openat(r0, &(0x7f0000000380)='./file2\x00', 0x0, 0x10)
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r2, r1, 0x0, 0xfffffdef)

00:05:58 executing program 1:
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}}, 0x0, 0x6, 0xffffffffffffffff, 0xb)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
r1 = gettid()
rt_sigqueueinfo(0x0, 0x0, 0x0)
r2 = pidfd_getfd(0xffffffffffffffff, r0, 0x0)
perf_event_open(&(0x7f0000000040)={0x5, 0x80, 0x40, 0x71, 0x2, 0x0, 0x0, 0x8000, 0x20, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, @perf_config_ext={0xff}, 0x0, 0x9b5, 0xfa, 0xd, 0x0, 0x8000, 0x55, 0x0, 0x0, 0x0, 0x3ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000400)={0x2, 0x80, 0x2a, 0x81, 0xe0, 0x40, 0x0, 0x63c5ef1c, 0x80, 0x3, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x7, 0x2, @perf_config_ext={0xf2, 0x6}, 0x0, 0x5, 0xfffffff8, 0x0, 0x1, 0x0, 0x1b6, 0x0, 0x6}, 0x0, 0xd, 0xffffffffffffffff, 0x0)
rt_sigqueueinfo(0x0, 0x0, &(0x7f0000000000))
setsockopt$sock_timeval(r0, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10)
bind$packet(r2, 0x0, 0x0)
perf_event_open(&(0x7f0000000100)={0x0, 0x80, 0xff, 0x8, 0x4, 0x1, 0x0, 0x4, 0x684, 0x4, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0xdbc, 0x0, @perf_config_ext={0xd03, 0x80000000}, 0x800, 0x3, 0x3, 0x5, 0x300000000000000, 0x7, 0x7ff, 0x0, 0x0, 0x0, 0x5}, r1, 0x10, 0xffffffffffffffff, 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r3, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
openat(r3, &(0x7f0000000180)='\x00', 0x400040, 0x80)
rt_sigqueueinfo(0x0, 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f0000000240)={'ip6_vti0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x4, 0x0, 0x7f, 0x40, 0xb, @local, @mcast1, 0x88, 0x20, 0x8, 0x2}})

[ 2048.045668] loop3: detected capacity change from 0 to 40
[ 2048.120477] syz-executor.3: attempt to access beyond end of device
[ 2048.120477] loop3: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2048.121537] Buffer I/O error on dev loop3, logical block 10, lost async page write
00:06:12 executing program 0:
r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000340)='/proc/vmstat\x00', 0x0, 0x0)
openat(r0, &(0x7f0000000380)='./file2\x00', 0x0, 0x10)
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r2, r1, 0x0, 0xfffffdef)

00:06:12 executing program 4:
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}}, 0x0, 0x6, 0xffffffffffffffff, 0xb)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
r1 = gettid()
rt_sigqueueinfo(0x0, 0x0, 0x0)
r2 = pidfd_getfd(0xffffffffffffffff, r0, 0x0)
perf_event_open(&(0x7f0000000040)={0x5, 0x80, 0x40, 0x71, 0x2, 0x0, 0x0, 0x8000, 0x20, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, @perf_config_ext={0xff}, 0x0, 0x9b5, 0xfa, 0xd, 0x0, 0x8000, 0x55, 0x0, 0x0, 0x0, 0x3ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000400)={0x2, 0x80, 0x2a, 0x81, 0xe0, 0x40, 0x0, 0x63c5ef1c, 0x80, 0x3, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x7, 0x2, @perf_config_ext={0xf2, 0x6}, 0x0, 0x5, 0xfffffff8, 0x0, 0x1, 0x0, 0x1b6, 0x0, 0x6}, 0x0, 0xd, 0xffffffffffffffff, 0x0)
rt_sigqueueinfo(0x0, 0x0, &(0x7f0000000000))
setsockopt$sock_timeval(r0, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10)
bind$packet(r2, 0x0, 0x0)
perf_event_open(&(0x7f0000000100)={0x0, 0x80, 0xff, 0x8, 0x4, 0x1, 0x0, 0x4, 0x684, 0x4, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0xdbc, 0x0, @perf_config_ext={0xd03, 0x80000000}, 0x800, 0x3, 0x3, 0x5, 0x300000000000000, 0x7, 0x7ff, 0x0, 0x0, 0x0, 0x5}, r1, 0x10, 0xffffffffffffffff, 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r3, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
openat(r3, &(0x7f0000000180)='\x00', 0x400040, 0x80)
rt_sigqueueinfo(0x0, 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f0000000240)={'ip6_vti0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x4, 0x0, 0x7f, 0x40, 0xb, @local, @mcast1, 0x88, 0x20, 0x8, 0x2}})

00:06:12 executing program 2:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684f"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x100d}], 0x1, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:06:12 executing program 5:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684fd2981c8409820000080000000000000000"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x100d}], 0x1, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:06:12 executing program 7:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684fd2981c8409820000080000000000000000"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x100d}], 0x1, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:06:12 executing program 1:
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}}, 0x0, 0x6, 0xffffffffffffffff, 0xb)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
r1 = gettid()
rt_sigqueueinfo(0x0, 0x0, 0x0)
r2 = pidfd_getfd(0xffffffffffffffff, r0, 0x0)
perf_event_open(&(0x7f0000000040)={0x5, 0x80, 0x40, 0x71, 0x2, 0x0, 0x0, 0x8000, 0x20, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, @perf_config_ext={0xff}, 0x0, 0x9b5, 0xfa, 0xd, 0x0, 0x8000, 0x55, 0x0, 0x0, 0x0, 0x3ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000400)={0x2, 0x80, 0x2a, 0x81, 0xe0, 0x40, 0x0, 0x63c5ef1c, 0x80, 0x3, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x7, 0x2, @perf_config_ext={0xf2, 0x6}, 0x0, 0x5, 0xfffffff8, 0x0, 0x1, 0x0, 0x1b6, 0x0, 0x6}, 0x0, 0xd, 0xffffffffffffffff, 0x0)
rt_sigqueueinfo(0x0, 0x0, &(0x7f0000000000))
setsockopt$sock_timeval(r0, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10)
bind$packet(r2, &(0x7f00000000c0)={0x11, 0x0, 0x0, 0x1, 0xfb, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}}, 0x14)
perf_event_open(&(0x7f0000000100)={0x0, 0x80, 0xff, 0x8, 0x4, 0x1, 0x0, 0x4, 0x684, 0x4, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0xdbc, 0x0, @perf_config_ext={0xd03, 0x80000000}, 0x800, 0x3, 0x3, 0x5, 0x300000000000000, 0x7, 0x7ff, 0x0, 0x0, 0x0, 0x5}, r1, 0x10, 0xffffffffffffffff, 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r3, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
openat(r3, &(0x7f0000000180)='\x00', 0x400040, 0x80)
rt_sigqueueinfo(0x0, 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f0000000240)={'ip6_vti0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x4, 0x0, 0x7f, 0x40, 0xb, @local, @mcast1, 0x88, 0x20, 0x8, 0x2}})

00:06:12 executing program 3:
r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000340)='/proc/vmstat\x00', 0x0, 0x0)
openat(r0, &(0x7f0000000380)='./file2\x00', 0x0, 0x10)
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r2, r1, 0x0, 0xfffffdef)

00:06:12 executing program 6:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684fd2981c8409820000080000000000000000"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x100d}], 0x1, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

[ 2061.936686] loop3: detected capacity change from 0 to 40
[ 2061.953211] syz-executor.3: attempt to access beyond end of device
[ 2061.953211] loop3: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2061.954214] Buffer I/O error on dev loop3, logical block 10, lost async page write
00:06:12 executing program 3:
r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000340)='/proc/vmstat\x00', 0x0, 0x0)
openat(r0, &(0x7f0000000380)='./file2\x00', 0x0, 0x10)
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r2, r1, 0x0, 0xfffffdef)

[ 2062.114506] loop3: detected capacity change from 0 to 40
[ 2062.155213] syz-executor.3: attempt to access beyond end of device
[ 2062.155213] loop3: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2062.156225] Buffer I/O error on dev loop3, logical block 10, lost async page write
00:06:12 executing program 1:
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}}, 0x0, 0x6, 0xffffffffffffffff, 0xb)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
r1 = gettid()
rt_sigqueueinfo(0x0, 0x0, 0x0)
r2 = pidfd_getfd(0xffffffffffffffff, r0, 0x0)
perf_event_open(&(0x7f0000000040)={0x5, 0x80, 0x40, 0x71, 0x2, 0x0, 0x0, 0x8000, 0x20, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, @perf_config_ext={0xff}, 0x0, 0x9b5, 0xfa, 0xd, 0x0, 0x8000, 0x55, 0x0, 0x0, 0x0, 0x3ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000400)={0x2, 0x80, 0x2a, 0x81, 0xe0, 0x40, 0x0, 0x63c5ef1c, 0x80, 0x3, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x7, 0x2, @perf_config_ext={0xf2, 0x6}, 0x0, 0x5, 0xfffffff8, 0x0, 0x1, 0x0, 0x1b6, 0x0, 0x6}, 0x0, 0xd, 0xffffffffffffffff, 0x0)
rt_sigqueueinfo(0x0, 0x0, &(0x7f0000000000))
setsockopt$sock_timeval(r0, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10)
bind$packet(r2, &(0x7f00000000c0)={0x11, 0x0, 0x0, 0x1, 0xfb, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}}, 0x14)
perf_event_open(&(0x7f0000000100)={0x0, 0x80, 0xff, 0x8, 0x4, 0x1, 0x0, 0x4, 0x684, 0x4, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0xdbc, 0x0, @perf_config_ext={0xd03, 0x80000000}, 0x800, 0x3, 0x3, 0x5, 0x300000000000000, 0x7, 0x7ff, 0x0, 0x0, 0x0, 0x5}, r1, 0x10, 0xffffffffffffffff, 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r3, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
openat(r3, &(0x7f0000000180)='\x00', 0x400040, 0x80)
rt_sigqueueinfo(0x0, 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f0000000240)={'ip6_vti0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x4, 0x0, 0x7f, 0x40, 0xb, @local, @mcast1, 0x88, 0x20, 0x8, 0x2}})

00:06:12 executing program 3:
r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000340)='/proc/vmstat\x00', 0x0, 0x0)
openat(r0, &(0x7f0000000380)='./file2\x00', 0x0, 0x10)
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)

00:06:12 executing program 4:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684fd2981c8409820000080000000000000000"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x100d}], 0x1, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:06:13 executing program 5:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684fd2981c8409820000080000000000000000"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x100d}], 0x1, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:06:13 executing program 2:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684f"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, 0x0, 0x0, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

[ 2062.437795] loop3: detected capacity change from 0 to 40
00:06:13 executing program 7:
r0 = perf_event_open(&(0x7f0000000080)={0x0, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684fd2981c8409820000080000000000000000"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x100d}], 0x1, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:06:13 executing program 6:
r0 = perf_event_open(&(0x7f0000000080)={0x0, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684fd2981c8409820000080000000000000000"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x100d}], 0x1, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:06:28 executing program 6:
r0 = perf_event_open(&(0x7f0000000080)={0x0, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684fd2981c8409820000080000000000000000"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x100d}], 0x1, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:06:28 executing program 5:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{0x0}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])

00:06:28 executing program 0:
r0 = perf_event_open(&(0x7f0000000080)={0x0, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684fd2981c8409820000080000000000000000"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x100d}], 0x1, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:06:28 executing program 1:
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}}, 0x0, 0x6, 0xffffffffffffffff, 0xb)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
r1 = gettid()
rt_sigqueueinfo(0x0, 0x0, 0x0)
r2 = pidfd_getfd(0xffffffffffffffff, r0, 0x0)
perf_event_open(&(0x7f0000000040)={0x5, 0x80, 0x40, 0x71, 0x2, 0x0, 0x0, 0x8000, 0x20, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, @perf_config_ext={0xff}, 0x0, 0x9b5, 0xfa, 0xd, 0x0, 0x8000, 0x55, 0x0, 0x0, 0x0, 0x3ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000400)={0x2, 0x80, 0x2a, 0x81, 0xe0, 0x40, 0x0, 0x63c5ef1c, 0x80, 0x3, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x7, 0x2, @perf_config_ext={0xf2, 0x6}, 0x0, 0x5, 0xfffffff8, 0x0, 0x1, 0x0, 0x1b6, 0x0, 0x6}, 0x0, 0xd, 0xffffffffffffffff, 0x0)
rt_sigqueueinfo(0x0, 0x0, &(0x7f0000000000))
setsockopt$sock_timeval(r0, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10)
bind$packet(r2, &(0x7f00000000c0)={0x11, 0x0, 0x0, 0x1, 0xfb, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}}, 0x14)
perf_event_open(&(0x7f0000000100)={0x0, 0x80, 0xff, 0x8, 0x4, 0x1, 0x0, 0x4, 0x684, 0x4, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0xdbc, 0x0, @perf_config_ext={0xd03, 0x80000000}, 0x800, 0x3, 0x3, 0x5, 0x300000000000000, 0x7, 0x7ff, 0x0, 0x0, 0x0, 0x5}, r1, 0x10, 0xffffffffffffffff, 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r3, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
openat(r3, &(0x7f0000000180)='\x00', 0x400040, 0x80)
rt_sigqueueinfo(0x0, 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f0000000240)={'ip6_vti0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x4, 0x0, 0x7f, 0x40, 0xb, @local, @mcast1, 0x88, 0x20, 0x8, 0x2}})

00:06:28 executing program 3:
r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000340)='/proc/vmstat\x00', 0x0, 0x0)
openat(r0, &(0x7f0000000380)='./file2\x00', 0x0, 0x10)
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(0xffffffffffffffff, &(0x7f0000001180)=ANY=[], 0x220)

00:06:28 executing program 4:
r0 = perf_event_open(&(0x7f0000000080)={0x0, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684fd2981c8409820000080000000000000000"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x100d}], 0x1, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:06:28 executing program 7:
r0 = perf_event_open(&(0x7f0000000080)={0x0, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684fd2981c8409820000080000000000000000"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x100d}], 0x1, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:06:28 executing program 2:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684f"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, 0x0, 0x0, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

[ 2077.656685] loop3: detected capacity change from 0 to 40
[ 2077.682384] loop5: detected capacity change from 0 to 40
[ 2077.700913] FAT-fs (loop5): bogus number of reserved sectors
[ 2077.701678] FAT-fs (loop5): Can't find a valid FAT filesystem
00:06:28 executing program 3:
r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000340)='/proc/vmstat\x00', 0x0, 0x0)
openat(r0, &(0x7f0000000380)='./file2\x00', 0x0, 0x10)
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(0xffffffffffffffff, &(0x7f0000001180)=ANY=[], 0x220)

00:06:28 executing program 1:
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}}, 0x0, 0x6, 0xffffffffffffffff, 0xb)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
r1 = gettid()
rt_sigqueueinfo(0x0, 0x0, 0x0)
r2 = pidfd_getfd(0xffffffffffffffff, r0, 0x0)
perf_event_open(&(0x7f0000000040)={0x5, 0x80, 0x40, 0x71, 0x2, 0x0, 0x0, 0x8000, 0x20, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, @perf_config_ext={0xff}, 0x0, 0x9b5, 0xfa, 0xd, 0x0, 0x8000, 0x55, 0x0, 0x0, 0x0, 0x3ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000400)={0x2, 0x80, 0x2a, 0x81, 0xe0, 0x40, 0x0, 0x63c5ef1c, 0x80, 0x3, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x7, 0x2, @perf_config_ext={0xf2, 0x6}, 0x0, 0x5, 0xfffffff8, 0x0, 0x1, 0x0, 0x1b6, 0x0, 0x6}, 0x0, 0xd, 0xffffffffffffffff, 0x0)
rt_sigqueueinfo(0x0, 0x0, &(0x7f0000000000))
setsockopt$sock_timeval(r0, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10)
bind$packet(r2, &(0x7f00000000c0)={0x11, 0xfe, 0x0, 0x1, 0x0, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}}, 0x14)
perf_event_open(&(0x7f0000000100)={0x0, 0x80, 0xff, 0x8, 0x4, 0x1, 0x0, 0x4, 0x684, 0x4, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0xdbc, 0x0, @perf_config_ext={0xd03, 0x80000000}, 0x800, 0x3, 0x3, 0x5, 0x300000000000000, 0x7, 0x7ff, 0x0, 0x0, 0x0, 0x5}, r1, 0x10, 0xffffffffffffffff, 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r3, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
openat(r3, &(0x7f0000000180)='\x00', 0x400040, 0x80)
rt_sigqueueinfo(0x0, 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f0000000240)={'ip6_vti0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x4, 0x0, 0x7f, 0x40, 0xb, @local, @mcast1, 0x88, 0x20, 0x8, 0x2}})

00:06:28 executing program 5:
r0 = perf_event_open(&(0x7f0000000080)={0x0, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684fd2981c8409820000080000000000000000"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x100d}], 0x1, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

[ 2077.840691] loop3: detected capacity change from 0 to 40
00:06:28 executing program 0:
r0 = perf_event_open(&(0x7f0000000080)={0x0, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684fd2981c8409820000080000000000000000"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x100d}], 0x1, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:06:28 executing program 3:
r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000340)='/proc/vmstat\x00', 0x0, 0x0)
openat(r0, &(0x7f0000000380)='./file2\x00', 0x0, 0x10)
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(0xffffffffffffffff, &(0x7f0000001180)=ANY=[], 0x220)

00:06:28 executing program 2:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684f"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, 0x0, 0x0, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

[ 2078.012577] loop3: detected capacity change from 0 to 40
00:06:45 executing program 4:
r0 = perf_event_open(&(0x7f0000000080)={0x0, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684fd2981c8409820000080000000000000000"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x100d}], 0x1, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:06:45 executing program 1:
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}}, 0x0, 0x6, 0xffffffffffffffff, 0xb)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
r1 = gettid()
rt_sigqueueinfo(0x0, 0x0, 0x0)
r2 = pidfd_getfd(0xffffffffffffffff, r0, 0x0)
perf_event_open(&(0x7f0000000040)={0x5, 0x80, 0x40, 0x71, 0x2, 0x0, 0x0, 0x8000, 0x20, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, @perf_config_ext={0xff}, 0x0, 0x9b5, 0xfa, 0xd, 0x0, 0x8000, 0x55, 0x0, 0x0, 0x0, 0x3ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000400)={0x2, 0x80, 0x2a, 0x81, 0xe0, 0x40, 0x0, 0x63c5ef1c, 0x80, 0x3, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x7, 0x2, @perf_config_ext={0xf2, 0x6}, 0x0, 0x5, 0xfffffff8, 0x0, 0x1, 0x0, 0x1b6, 0x0, 0x6}, 0x0, 0xd, 0xffffffffffffffff, 0x0)
rt_sigqueueinfo(0x0, 0x0, &(0x7f0000000000))
setsockopt$sock_timeval(r0, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10)
bind$packet(r2, &(0x7f00000000c0)={0x11, 0xfe, 0x0, 0x1, 0x0, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}}, 0x14)
perf_event_open(&(0x7f0000000100)={0x0, 0x80, 0xff, 0x8, 0x4, 0x1, 0x0, 0x4, 0x684, 0x4, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0xdbc, 0x0, @perf_config_ext={0xd03, 0x80000000}, 0x800, 0x3, 0x3, 0x5, 0x300000000000000, 0x7, 0x7ff, 0x0, 0x0, 0x0, 0x5}, r1, 0x10, 0xffffffffffffffff, 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r3, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
openat(r3, &(0x7f0000000180)='\x00', 0x400040, 0x80)
rt_sigqueueinfo(0x0, 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f0000000240)={'ip6_vti0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x4, 0x0, 0x7f, 0x40, 0xb, @local, @mcast1, 0x88, 0x20, 0x8, 0x2}})

00:06:45 executing program 5:
r0 = perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684fd2981c8409820000080000000000000000"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x100d}], 0x1, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:06:45 executing program 6:
r0 = perf_event_open(&(0x7f0000000080)={0x0, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684fd2981c8409820000080000000000000000"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x100d}], 0x1, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:06:45 executing program 7:
r0 = perf_event_open(&(0x7f0000000080)={0x0, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684fd2981c8409820000080000000000000000"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x100d}], 0x1, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:06:45 executing program 0:
r0 = perf_event_open(&(0x7f0000000080)={0x0, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684fd2981c8409820000080000000000000000"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x100d}], 0x1, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:06:45 executing program 2:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684f"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100), 0x0, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:06:45 executing program 3:
r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000340)='/proc/vmstat\x00', 0x0, 0x0)
openat(r0, &(0x7f0000000380)='./file2\x00', 0x0, 0x10)
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)

[ 2095.337920] loop3: detected capacity change from 0 to 40
00:06:46 executing program 3:
r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000340)='/proc/vmstat\x00', 0x0, 0x0)
openat(r0, &(0x7f0000000380)='./file2\x00', 0x0, 0x10)
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)

00:06:46 executing program 5:
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}}, 0x0, 0x6, 0xffffffffffffffff, 0xb)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
r1 = gettid()
rt_sigqueueinfo(0x0, 0x0, 0x0)
r2 = pidfd_getfd(0xffffffffffffffff, r0, 0x0)
perf_event_open(&(0x7f0000000040)={0x5, 0x80, 0x40, 0x71, 0x2, 0x0, 0x0, 0x8000, 0x20, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, @perf_config_ext={0xff}, 0x0, 0x9b5, 0xfa, 0xd, 0x0, 0x8000, 0x55, 0x0, 0x0, 0x0, 0x3ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000400)={0x2, 0x80, 0x2a, 0x81, 0xe0, 0x40, 0x0, 0x63c5ef1c, 0x80, 0x3, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x7, 0x2, @perf_config_ext={0xf2, 0x6}, 0x0, 0x5, 0xfffffff8, 0x0, 0x1, 0x0, 0x1b6, 0x0, 0x6}, 0x0, 0xd, 0xffffffffffffffff, 0x0)
rt_sigqueueinfo(0x0, 0x0, &(0x7f0000000000))
setsockopt$sock_timeval(r0, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10)
bind$packet(r2, &(0x7f00000000c0)={0x11, 0xfe, 0x0, 0x1, 0x0, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}}, 0x14)
perf_event_open(&(0x7f0000000100)={0x0, 0x80, 0xff, 0x8, 0x4, 0x1, 0x0, 0x4, 0x684, 0x4, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0xdbc, 0x0, @perf_config_ext={0xd03, 0x80000000}, 0x800, 0x3, 0x3, 0x5, 0x300000000000000, 0x7, 0x7ff, 0x0, 0x0, 0x0, 0x5}, r1, 0x10, 0xffffffffffffffff, 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r3, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
openat(r3, &(0x7f0000000180)='\x00', 0x400040, 0x80)
rt_sigqueueinfo(0x0, 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f0000000240)={'ip6_vti0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x4, 0x0, 0x7f, 0x40, 0xb, @local, @mcast1, 0x88, 0x20, 0x8, 0x2}})

00:06:46 executing program 4:
r0 = perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684fd2981c8409820000080000000000000000"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x100d}], 0x1, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

[ 2095.530515] loop3: detected capacity change from 0 to 40
00:06:46 executing program 0:
r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684fd2981c8409820000080000000000000000"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r1, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x100d}], 0x1, 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r0, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r2, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r1, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:06:46 executing program 3:
r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000340)='/proc/vmstat\x00', 0x0, 0x0)
openat(r0, &(0x7f0000000380)='./file2\x00', 0x0, 0x10)
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)

00:06:46 executing program 2:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684f"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100), 0x0, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:06:46 executing program 1:
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}}, 0x0, 0x6, 0xffffffffffffffff, 0xb)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
r1 = gettid()
rt_sigqueueinfo(0x0, 0x0, 0x0)
r2 = pidfd_getfd(0xffffffffffffffff, r0, 0x0)
perf_event_open(&(0x7f0000000040)={0x5, 0x80, 0x40, 0x71, 0x2, 0x0, 0x0, 0x8000, 0x20, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, @perf_config_ext={0xff}, 0x0, 0x9b5, 0xfa, 0xd, 0x0, 0x8000, 0x55, 0x0, 0x0, 0x0, 0x3ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000400)={0x2, 0x80, 0x2a, 0x81, 0xe0, 0x40, 0x0, 0x63c5ef1c, 0x80, 0x3, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x7, 0x2, @perf_config_ext={0xf2, 0x6}, 0x0, 0x5, 0xfffffff8, 0x0, 0x1, 0x0, 0x1b6, 0x0, 0x6}, 0x0, 0xd, 0xffffffffffffffff, 0x0)
rt_sigqueueinfo(0x0, 0x0, &(0x7f0000000000))
setsockopt$sock_timeval(r0, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10)
bind$packet(r2, &(0x7f00000000c0)={0x11, 0xfe, 0x0, 0x1, 0x0, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}}, 0x14)
perf_event_open(&(0x7f0000000100)={0x0, 0x80, 0xff, 0x8, 0x4, 0x1, 0x0, 0x4, 0x684, 0x4, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0xdbc, 0x0, @perf_config_ext={0xd03, 0x80000000}, 0x800, 0x3, 0x3, 0x5, 0x300000000000000, 0x7, 0x7ff, 0x0, 0x0, 0x0, 0x5}, r1, 0x10, 0xffffffffffffffff, 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r3, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
openat(r3, &(0x7f0000000180)='\x00', 0x400040, 0x80)
rt_sigqueueinfo(0x0, 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f0000000240)={'ip6_vti0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x4, 0x0, 0x7f, 0x40, 0xb, @local, @mcast1, 0x88, 0x20, 0x8, 0x2}})

00:06:46 executing program 6:
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}}, 0x0, 0x6, 0xffffffffffffffff, 0xb)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
r1 = gettid()
rt_sigqueueinfo(0x0, 0x0, 0x0)
r2 = pidfd_getfd(0xffffffffffffffff, r0, 0x0)
perf_event_open(&(0x7f0000000040)={0x5, 0x80, 0x40, 0x71, 0x2, 0x0, 0x0, 0x8000, 0x20, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, @perf_config_ext={0xff}, 0x0, 0x9b5, 0xfa, 0xd, 0x0, 0x8000, 0x55, 0x0, 0x0, 0x0, 0x3ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000400)={0x2, 0x80, 0x2a, 0x81, 0xe0, 0x40, 0x0, 0x63c5ef1c, 0x80, 0x3, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x7, 0x2, @perf_config_ext={0xf2, 0x6}, 0x0, 0x5, 0xfffffff8, 0x0, 0x1, 0x0, 0x1b6, 0x0, 0x6}, 0x0, 0xd, 0xffffffffffffffff, 0x0)
rt_sigqueueinfo(0x0, 0x0, &(0x7f0000000000))
setsockopt$sock_timeval(r0, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10)
bind$packet(r2, &(0x7f00000000c0)={0x11, 0xfe, 0x0, 0x1, 0x0, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}}, 0x14)
perf_event_open(&(0x7f0000000100)={0x0, 0x80, 0xff, 0x8, 0x4, 0x1, 0x0, 0x4, 0x684, 0x4, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0xdbc, 0x0, @perf_config_ext={0xd03, 0x80000000}, 0x800, 0x3, 0x3, 0x5, 0x300000000000000, 0x7, 0x7ff, 0x0, 0x0, 0x0, 0x5}, r1, 0x10, 0xffffffffffffffff, 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r3, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
openat(r3, &(0x7f0000000180)='\x00', 0x400040, 0x80)
rt_sigqueueinfo(0x0, 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f0000000240)={'ip6_vti0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x4, 0x0, 0x7f, 0x40, 0xb, @local, @mcast1, 0x88, 0x20, 0x8, 0x2}})

00:06:46 executing program 7:
r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684fd2981c8409820000080000000000000000"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r1, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x100d}], 0x1, 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r0, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r2, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r1, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

[ 2095.788766] loop3: detected capacity change from 0 to 40
00:06:46 executing program 5:
r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684fd2981c8409820000080000000000000000"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r1, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x100d}], 0x1, 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r0, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r2, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r1, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:06:46 executing program 4:
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}}, 0x0, 0x6, 0xffffffffffffffff, 0xb)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
r1 = gettid()
rt_sigqueueinfo(0x0, 0x0, 0x0)
r2 = pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000040)={0x5, 0x80, 0x40, 0x71, 0x2, 0x0, 0x0, 0x8000, 0x20, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, @perf_config_ext={0xff}, 0x0, 0x9b5, 0xfa, 0xd, 0x0, 0x8000, 0x55, 0x0, 0x0, 0x0, 0x3ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000400)={0x2, 0x80, 0x2a, 0x81, 0xe0, 0x40, 0x0, 0x63c5ef1c, 0x80, 0x3, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x7, 0x2, @perf_config_ext={0xf2, 0x6}, 0x0, 0x5, 0xfffffff8, 0x0, 0x1, 0x0, 0x1b6, 0x0, 0x6}, 0x0, 0xd, 0xffffffffffffffff, 0x0)
rt_sigqueueinfo(0x0, 0x0, &(0x7f0000000000))
setsockopt$sock_timeval(r0, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10)
bind$packet(r2, &(0x7f00000000c0)={0x11, 0xfe, 0x0, 0x1, 0xfb, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}}, 0x14)
perf_event_open(&(0x7f0000000100)={0x0, 0x80, 0xff, 0x8, 0x4, 0x1, 0x0, 0x4, 0x684, 0x4, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0xdbc, 0x0, @perf_config_ext={0xd03, 0x80000000}, 0x800, 0x3, 0x3, 0x5, 0x300000000000000, 0x7, 0x7ff, 0x0, 0x0, 0x0, 0x5}, r1, 0x10, 0xffffffffffffffff, 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r3, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
openat(r3, &(0x7f0000000180)='\x00', 0x400040, 0x80)
rt_sigqueueinfo(0x0, 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f0000000240)={'ip6_vti0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x4, 0x0, 0x7f, 0x40, 0xb, @local, @mcast1, 0x88, 0x20, 0x8, 0x2}})

00:06:46 executing program 1:
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}}, 0x0, 0x6, 0xffffffffffffffff, 0xb)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
r1 = gettid()
rt_sigqueueinfo(0x0, 0x0, 0x0)
r2 = pidfd_getfd(0xffffffffffffffff, r0, 0x0)
perf_event_open(&(0x7f0000000040)={0x5, 0x80, 0x40, 0x71, 0x2, 0x0, 0x0, 0x8000, 0x20, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, @perf_config_ext={0xff}, 0x0, 0x9b5, 0xfa, 0xd, 0x0, 0x8000, 0x55, 0x0, 0x0, 0x0, 0x3ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000400)={0x2, 0x80, 0x2a, 0x81, 0xe0, 0x40, 0x0, 0x63c5ef1c, 0x80, 0x3, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x7, 0x2, @perf_config_ext={0xf2, 0x6}, 0x0, 0x5, 0xfffffff8, 0x0, 0x1, 0x0, 0x1b6, 0x0, 0x6}, 0x0, 0xd, 0xffffffffffffffff, 0x0)
rt_sigqueueinfo(0x0, 0x0, &(0x7f0000000000))
setsockopt$sock_timeval(r0, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10)
bind$packet(r2, &(0x7f00000000c0)={0x11, 0xfe, 0x0, 0x1, 0xfb, 0x6, @dev}, 0x14)
perf_event_open(&(0x7f0000000100)={0x0, 0x80, 0xff, 0x8, 0x4, 0x1, 0x0, 0x4, 0x684, 0x4, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0xdbc, 0x0, @perf_config_ext={0xd03, 0x80000000}, 0x800, 0x3, 0x3, 0x5, 0x300000000000000, 0x7, 0x7ff, 0x0, 0x0, 0x0, 0x5}, r1, 0x10, 0xffffffffffffffff, 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r3, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
openat(r3, &(0x7f0000000180)='\x00', 0x400040, 0x80)
rt_sigqueueinfo(0x0, 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f0000000240)={'ip6_vti0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x4, 0x0, 0x7f, 0x40, 0xb, @local, @mcast1, 0x88, 0x20, 0x8, 0x2}})

00:06:46 executing program 3:
r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000340)='/proc/vmstat\x00', 0x0, 0x0)
openat(r0, &(0x7f0000000380)='./file2\x00', 0x0, 0x10)
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)

00:06:46 executing program 6:
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}}, 0x0, 0x6, 0xffffffffffffffff, 0xb)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
r1 = gettid()
rt_sigqueueinfo(0x0, 0x0, 0x0)
r2 = pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000040)={0x5, 0x80, 0x40, 0x71, 0x2, 0x0, 0x0, 0x8000, 0x20, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, @perf_config_ext={0xff}, 0x0, 0x9b5, 0xfa, 0xd, 0x0, 0x8000, 0x55, 0x0, 0x0, 0x0, 0x3ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000400)={0x2, 0x80, 0x2a, 0x81, 0xe0, 0x40, 0x0, 0x63c5ef1c, 0x80, 0x3, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x7, 0x2, @perf_config_ext={0xf2, 0x6}, 0x0, 0x5, 0xfffffff8, 0x0, 0x1, 0x0, 0x1b6, 0x0, 0x6}, 0x0, 0xd, 0xffffffffffffffff, 0x0)
rt_sigqueueinfo(0x0, 0x0, &(0x7f0000000000))
setsockopt$sock_timeval(r0, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10)
bind$packet(r2, &(0x7f00000000c0)={0x11, 0xfe, 0x0, 0x1, 0xfb, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}}, 0x14)
perf_event_open(&(0x7f0000000100)={0x0, 0x80, 0xff, 0x8, 0x4, 0x1, 0x0, 0x4, 0x684, 0x4, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0xdbc, 0x0, @perf_config_ext={0xd03, 0x80000000}, 0x800, 0x3, 0x3, 0x5, 0x300000000000000, 0x7, 0x7ff, 0x0, 0x0, 0x0, 0x5}, r1, 0x10, 0xffffffffffffffff, 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r3, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
openat(r3, &(0x7f0000000180)='\x00', 0x400040, 0x80)
rt_sigqueueinfo(0x0, 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f0000000240)={'ip6_vti0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x4, 0x0, 0x7f, 0x40, 0xb, @local, @mcast1, 0x88, 0x20, 0x8, 0x2}})

[ 2096.002144] loop3: detected capacity change from 0 to 40
00:06:46 executing program 2:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684f"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100), 0x0, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:07:06 executing program 0:
r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684fd2981c8409820000080000000000000000"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r1, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x100d}], 0x1, 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r0, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r2, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r1, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:07:06 executing program 7:
r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684fd2981c8409820000080000000000000000"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r1, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x100d}], 0x1, 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r0, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r2, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r1, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:07:06 executing program 4:
r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684fd2981c8409820000080000000000000000"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r1, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x100d}], 0x1, 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r0, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r2, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r1, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:07:06 executing program 2:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684f"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{0x0}], 0x1, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:07:06 executing program 1:
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}}, 0x0, 0x6, 0xffffffffffffffff, 0xb)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
r1 = gettid()
rt_sigqueueinfo(0x0, 0x0, 0x0)
r2 = pidfd_getfd(0xffffffffffffffff, r0, 0x0)
perf_event_open(&(0x7f0000000040)={0x5, 0x80, 0x40, 0x71, 0x2, 0x0, 0x0, 0x8000, 0x20, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, @perf_config_ext={0xff}, 0x0, 0x9b5, 0xfa, 0xd, 0x0, 0x8000, 0x55, 0x0, 0x0, 0x0, 0x3ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000400)={0x2, 0x80, 0x2a, 0x81, 0xe0, 0x40, 0x0, 0x63c5ef1c, 0x80, 0x3, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x7, 0x2, @perf_config_ext={0xf2, 0x6}, 0x0, 0x5, 0xfffffff8, 0x0, 0x1, 0x0, 0x1b6, 0x0, 0x6}, 0x0, 0xd, 0xffffffffffffffff, 0x0)
rt_sigqueueinfo(0x0, 0x0, &(0x7f0000000000))
setsockopt$sock_timeval(r0, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10)
bind$packet(r2, &(0x7f00000000c0)={0x11, 0xfe, 0x0, 0x1, 0xfb, 0x6, @dev}, 0x14)
perf_event_open(&(0x7f0000000100)={0x0, 0x80, 0xff, 0x8, 0x4, 0x1, 0x0, 0x4, 0x684, 0x4, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0xdbc, 0x0, @perf_config_ext={0xd03, 0x80000000}, 0x800, 0x3, 0x3, 0x5, 0x300000000000000, 0x7, 0x7ff, 0x0, 0x0, 0x0, 0x5}, r1, 0x10, 0xffffffffffffffff, 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r3, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
openat(r3, &(0x7f0000000180)='\x00', 0x400040, 0x80)
rt_sigqueueinfo(0x0, 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f0000000240)={'ip6_vti0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x4, 0x0, 0x7f, 0x40, 0xb, @local, @mcast1, 0x88, 0x20, 0x8, 0x2}})

00:07:06 executing program 3:
r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000340)='/proc/vmstat\x00', 0x0, 0x0)
openat(r0, &(0x7f0000000380)='./file2\x00', 0x0, 0x10)
chdir(&(0x7f0000000140)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)

00:07:06 executing program 6:
r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684fd2981c8409820000080000000000000000"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r1, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x100d}], 0x1, 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r0, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r2, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r1, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:07:06 executing program 5:
r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684fd2981c8409820000080000000000000000"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r1, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x100d}], 0x1, 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r0, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r2, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r1, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:07:06 executing program 3:
r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000340)='/proc/vmstat\x00', 0x0, 0x0)
openat(r0, &(0x7f0000000380)='./file2\x00', 0x0, 0x10)
chdir(&(0x7f0000000140)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)

00:07:20 executing program 1:
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}}, 0x0, 0x6, 0xffffffffffffffff, 0xb)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
r1 = gettid()
rt_sigqueueinfo(0x0, 0x0, 0x0)
r2 = pidfd_getfd(0xffffffffffffffff, r0, 0x0)
perf_event_open(&(0x7f0000000040)={0x5, 0x80, 0x40, 0x71, 0x2, 0x0, 0x0, 0x8000, 0x20, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, @perf_config_ext={0xff}, 0x0, 0x9b5, 0xfa, 0xd, 0x0, 0x8000, 0x55, 0x0, 0x0, 0x0, 0x3ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000400)={0x2, 0x80, 0x2a, 0x81, 0xe0, 0x40, 0x0, 0x63c5ef1c, 0x80, 0x3, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x7, 0x2, @perf_config_ext={0xf2, 0x6}, 0x0, 0x5, 0xfffffff8, 0x0, 0x1, 0x0, 0x1b6, 0x0, 0x6}, 0x0, 0xd, 0xffffffffffffffff, 0x0)
rt_sigqueueinfo(0x0, 0x0, &(0x7f0000000000))
setsockopt$sock_timeval(r0, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10)
bind$packet(r2, &(0x7f00000000c0)={0x11, 0xfe, 0x0, 0x1, 0xfb, 0x6, @dev}, 0x14)
perf_event_open(&(0x7f0000000100)={0x0, 0x80, 0xff, 0x8, 0x4, 0x1, 0x0, 0x4, 0x684, 0x4, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0xdbc, 0x0, @perf_config_ext={0xd03, 0x80000000}, 0x800, 0x3, 0x3, 0x5, 0x300000000000000, 0x7, 0x7ff, 0x0, 0x0, 0x0, 0x5}, r1, 0x10, 0xffffffffffffffff, 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r3, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
openat(r3, &(0x7f0000000180)='\x00', 0x400040, 0x80)
rt_sigqueueinfo(0x0, 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f0000000240)={'ip6_vti0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x4, 0x0, 0x7f, 0x40, 0xb, @local, @mcast1, 0x88, 0x20, 0x8, 0x2}})

00:07:20 executing program 5:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x100d}], 0x1, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:07:20 executing program 4:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x100d}], 0x1, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:07:20 executing program 6:
syz_mount_image$vfat(0x0, &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])

00:07:20 executing program 0:
r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684fd2981c8409820000080000000000000000"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r1, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x100d}], 0x1, 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r0, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r2, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r1, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:07:20 executing program 2:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684f"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{0x0}], 0x1, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:07:20 executing program 7:
r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000340)='/proc/vmstat\x00', 0x0, 0x0)
openat(r0, &(0x7f0000000380)='./file2\x00', 0x0, 0x10)
r1 = openat$nvram(0xffffffffffffff9c, &(0x7f00000000c0), 0x4400c0, 0x0)
ioctl$BLKRRPART(r1, 0x125f, 0x0)
ioctl$TCGETS2(r0, 0x802c542a, &(0x7f00000003c0))
io_uring_enter(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0)
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_io_uring_setup(0x2c27, &(0x7f0000000480)={0x0, 0xe28a, 0x21, 0x1, 0x3e0, 0x0, r2}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000000400), &(0x7f0000000440))
ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, &(0x7f000005e2c0)={0x0, 0x0, "d1f14792bb10750ea9e86f2109c85af76eac969c225abcf9542493077458dc50dd5546ef22c70a8bd6b5a45e86c81b77924f226ab6e09915cbe829241e71703056bc95c7386df10315c79284a94c638e15bb1a293b37fce9ccef990b6b10fb9c04f3786fecc4e7d36ad34a037174328cfbd507df8590cdb8df705efb63f6d543b899d97ca79e8c4414fd5da623d28f9252c13428af0998f63ad30f909619b043f0a7aa899a6d9282a5e61460066587029f38eff5aeafc3e8b67b97ebf6c447e628d6041c0c873b2d58b8881c4a4c74e260693309049d39b69a09df12caf88245f7f4dc8ad878b9295afbe717134ff663413f7d075e5e00", "950b8bbc34bf9b44a5f783e82416e13437591aaea9e99d56d9fa2b62c996fb937ef8e5bb361a4eb72e3b338b3d456d93c2993fc14a84c9df4fca9a60ad24fe51c5a3fc272feb82e0053d62793dcbb53a9aac338c90f5cdae9589decd38f50a09d93770fe9fffa2570bae21a6c16607cb009087b6f6850ff959c7cde98a4e32896d4e19a961e665ed3624ef5c69dc0964b4e762a597e962c8f0c77006ae2c2e61c9d589d8075d51ad024b5e6af6d9ad992d0bf7c9b663e91485d32a9e7ee3febf65c5d7f7d8cf1d6ee7a1d12df1d9a056d2c44371e7d7bcf3dc0e9c94a294388d4636547a098e57bad5c0bf1ee2d21aabc22fc193ed1e85886abdeb6944ead2082984e3b7724633f58c76185a0e7814cf6745bb5ca89b88abdf102a0bcf9fb0c1b2eed6553ee3a0eab3b9bcebf70187adf95f5a2564a6d081679f6988f7e0fffda8c75027eec9fd9177d245704a2f1348f6aa2141357964efb85de30e3be48ba72b34f46a53c393aacb648b728316adf6edc89a128dac296e8022e3457cda709d3f4ee82e744910890ba79420b32572d19d21d965bb5f7be6713d2aff1c6a47589d00d173a4f7f75c191247fb6eea511c85f1f2ca3389aeec86fa05b79a53eadd44f6928fd6492e18d1de7614e68ab21dfd71508786e535de92de39236ea42fbaa81ae85784b5c24c89f6bee084493fc227b3c9f620efa3b7c13b48c1bd1bc20f5972f2a94a68b6717e2f0524741ee7d55a39eee078436f0af9a982a0953bd1cd57849007d08bfbf1dfe814c8448539baa1c5b8ced883da94c7b946cb9e205c83941172aa1bc8e710fe6efec7ef16639408348485e6890ea289fabb6a872c634aa21059ca2bd3cf3deae4bfada536780a9f11ef2a84a17bc2e5ffefc8b7f1aa708f2d89e496578b78381a82916a7a2b36413b76171af62915c76d20d2ec695f0d7dd0ae6a5a890e1070500a62f4267321900efe7073474e030a3ab8086275b552ac0ca8e94f438307b354e39005cddc582c5da0f3753b37643cc13bdff1efef66055f16e871e8ad26a502e5e7509d05f98f32f3f0b5d563c498e860b5b931e36ccd1e7d7f5a0904288aecd9c6a5bbda28d43169cb7967d69d124f5cf6fd1574ba9a9eabd5b8b0b27bb48ac5659c2734e21eb8cd71ba8c7fd8ff7b7cb65d7d127ff0f53fc25d2f3eb05586d7299eb8cb1eb255a460c9a05151ceead842b1c21e8c19ebecf6cb1a7f9a19a254c9e39bfbcb905d6d0265b37fae4d15ef8e4c56f82bf976662e0d258c2e7ba2ebe6ca3e9ea3d0ea52ee8b67d8f318a2a27a716977d4fe916264e11788a1e80dde6a0100b156b89f11e4e3bf78c66d535e46477fcd9f568578523406f21a6796ac3c1e0f6ba31a471f359579b103299799606a766a1ca7148c153d85c5420bd1e1ee0564c08c88dec5d248eccf1f63cf01015197f6a3fa61a598e8ad327cd6dfe3cf9f0b4e685dc0e9b10908f68b2290a3741a90991e1f67c04015a780a87c89644280b032722ceb2531bbed8e4459edad3409cbe1ddfd071052277cd908cebe5c00009c3f3a33b9ec60b200e700eb9d48954461c82591a5ffeec87f12d081d30e4c61999879c607cc653a3b2478439b42ea05b469534f20653d8d61a55e9761dd331386109af0b2453eb2e8ba54e7c16e890727c133b442956db67278d661166a9290d4fe8008821649eeefba119ba3776597654a546611693db7b3fc63aa2d01047dbf8a6db146b0fcf3afc8d819575f642dc87ffbd0a42bb68c20f1ea1dac2804db95adab571d2ca60c679a8db02ba3cd5765713e5c3748205b56fd3f6f6e32f628c5b986b1f9d218df36b03db78ee74544555dfa7506a939f48c10a9df0620a841f7e9c67cbf5b367c4c0bbd69b76956326f1737d143d49619691433473fd5fed20fc5710ff0f7c6288a4071f02f741532e3080d59b039466ab62972ecc563ee511e8a9d56fa7179569f1d2420ddc90c62d654331771dd8515ecb6d9030901de113996870c1d921fca0d39a5da13183ab12506008f3074a26ef1990fdabfea0d42d346748959a35e0e07c447c03a591c54ae61186cf579e2636e89d3b3f06c5a019330dbb2d313cff036624a789abb4d5a76ea83e31774be2280de447a053e29a2cb6c4fe62292b61e6513098cc0269a6d526aab3dba820ebe9408839a8f96a5cd09bb29dd6e1b2bdfd31d6b93ceb47976f6650f0c294b061fd25118d364cb0654b0f87741953c3fb2a590394179678b1fab1390db08d599bc418f168f4aa56ebbf3fc9f1597151c83e989770349402695c8b2bfd2b488e0735a071650d4fe1420804c66ce4261424f60424c0390397e7eea3ca904173b8620d74799ae84204abc9548801f3ca29973a33110c6b13d0aaaf316948e1d6fb99ca3150864361418d7f05f39ba7b9026a356f185ad23542e6f0af8d71989486bde21d7451acf86bab6ed27271f395ab31e88e6cd6ff6da710e6ae680fc1711a1319694f9ac56cdcfd46a10db35295627a7dcd4c605e98e455164ff21927b904929973b7520f752b76e6cd3732e540371fd78a5a42611f42d0b185d213a47abd2dfdc37c79894d3323900631655bc263fb5e8aa6b6f32c9f8ced4acc81c6d4bc95fa48faee5697d4221cc576bae07afe10057cf40423318fcd32c3158d65eb770728028f8e5354069ec4f4f63b9a4cd68172397bfa5371a43697e7bc26d777c55ce5f0a225324397a7567b0b969604db7d32c95b05017db53bad3cc1ac3f3d3bc0287d7794f9baf0f1a7064258586e39743dc150637d84c47fce0feb9e9f3c1fbddcdc9de4a1011a54cf9a74fd28b029f0bfb45f723e4dbe9910a203e98fdbe6fa0d562ead671d5ecaba5f2f29d8e37dcae6b3b6e0cc4917ef4da6b9f0baacbc51840ebaf85f0f7d11897d8887a35d99f50eedefcb07913a665d0843f68a73767df874c5995936bf5c03bf40ff54e179c094127af6254e22da82484472eca7a48bf932c2470ad5c6bc43b2392ebae24692e73ae1c6e0c03eb958b7831156d7509da69cfd9d8e5068e560fc7f28a974490ecbbc79aafb65f525e5b8d04aaed3b683c6b23703d6ff361f5bd57a9b62ffa5e994b9bbaaf582688f78bc13ef909f9634324fbf6859646b673e2b1d80f56a58bffdac390c245d8cc3036da0e6656f24af365da36ec6cc74847ccfb4a36115c1f19cc6e848f909089a2ac660d1223765295f37c442f987ed98b3f7b3b963213d2e6289b147c80dfc239800f0d48d37fc4739fa521dd686f5413261a9cd06f1c09c598d3d91e66db106ef212c3a1b8c02834f9cc3634ca938df7a478c25b55f0c654bc4f70057a60a7bbf02706f048329d3ad3052f23b698b8ffb97085f121249359320efff2add0c35db60e7cf74e0169e9cf13c0c3725768fea6e928a213e61bae007bc307e4fe63b0905772c469747b5884509acce8b7c368b417b44460d6e5d3ab9dec690c43a029122ba37216d48a0d7eb519fcd0257df3a693711ffa60c8a3855713f359c3780f4a40694982d7ce84e40f03faaf942730e9daa8777d7a8909999df47955ea430bb443789f047066426df0a7fe04f741420b0db3c5e54f0b03e60b5897e96c4bf34f324ef899b9ea4b36c44b2496f043e7be07f3a58bb094caab78f168d9486d0dfd1adc97ae3ce5e710a9e47e6b5f8360417d1462acb4062057dda820c5d4b4cc90a13732fc2b52b12b2d255cb01f529a597e5ee29eb36e0c479896ae189103580a633c4a09621043df2205d00b45a84cd8ebe81c483cdf66994827672942dba7674e2090829a33744394e7b9c81ff273a5df6e0eceaa9b2abad932c8740d3b0b977e91fc03f4020a4459fa582d48673215c14f0da08a82a67b8bb804915c9d1218d7a9de94033a32725f30f9f9e81987d63cca018d12c3894b7fbeb95901f382bdee8595b2e6b7f42d0ada636db6e000625dfaa79a6309b2dd279fff258cefcc044a06bdbe489230ffdd90efdda0df2da52742a59e24b8c50ec68790fc62207ac2cd6d4997d6a4faa5e2645e30228f39094750eef3ce56b1569438750ff50130c64e8f37d8ff49fa9d9c0d409e9f60f347cb386946ce117b4c40a9a53c7359d3a966c7326263270eb16876ff1e6da42a73a634ac661327a916b8416bac1bb49a5e9b8da0dc7170d833d07df1fab73a7f202aaa768049efefc4b3996118d27c949aaccfb6416be56f30e9fce9602d0cf57c1c70b321974e3518434ca828f1a51d4191b99e0e0a7451ba3b4f2b5cf95b44fc417abcc5b0b13bae366614f75c98aade49013475086a48d9e64ba7701d6aa7997132e56b97b962921a73e7a70de0f32c06d0117b24708867f7247024a28096607669001e87ec188812d0eab256b0296e0f70c47c6ca89dd511c1362523930a546a44ebc421e03e979a5bba49732d437d82e7555e5a10c4a1fd933c6c50380d3d7a147586e4033005f533f7ade992af2696c4d122311a473f97644095805a18da9d0b52e2f72dd386a3d14f478c7ba144503ee2e94bfb3853fb37adca2f7bf51872fd3a54e392c8b6dbf142c6ae83ca21575ca6a1d3fa1b1de90f4a816d093561f88f6e6aaf782d08c798147a64851759b8667a1531da2d571e1457edd13d7d0929ae02daed710e9ae1a2796e38a1c2921dd2f457f825f4cf95f02e34e9cf3e894d57cfde113224210caec0b4ab2901262b6e36d96ea1febc8c73a12f0e40f6b47b13709cfecbec1420fcb5cdc2b5986d0a54fe0459ba5f77b90bc9d2cbdd86663910fed740f6f41d94cb1b3818a550f8da00f6d17b150e4872fec8712a7490a1782a82b9680ceeeb41fdb8c95c1d3d574437d3bd1915020d96e411978c1738d7683b62f5dbf6280dc72860a2b6fa1de548e6a22987f1d3b5eb010172d7c684e9943e32b140fc51cd8c7046a2cc604244a7aad63a9edd2f64c31c8fe127a2cb96fc5ca374b24e475bc78f4cbdda40b39b282af1d192bd2a967fc6b7811f8ef8be8d65cd8d3ddbf1e69989c073a16c9c1896ca8a734bc6a4df17d39d30a8b8c1ec3d93534747e8e9a769f60a9e10cc69ea5903993bc481630e1df50eedc1a1a51d96de8fcd27a3ba4108349c92d52b81886d19217b10508527634c58af2806b2dae8c71aaeb6946896decd03266a75bccf676d86064188d0da683b0138a3c03fc22bbf6c8d8bdea829bc5aa5d5521da096718aa6a629f174e510b1215b49f27db3c145555baa329d15de80976748b68648482cb8cf9e79cc3acefe4d8436c04e882934abc30ac5886d10a54b759f1b4407d1ea9d8cc1049e4f60c9dc96dbda9dbc98bac97974d6c8625a2be3d48ef98edfbf0725cc18f21b50a67b0de8ff6544cd67ce0d43fcc1d24800"})
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r3, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r3, r2, 0x0, 0xfffffdef)

00:07:20 executing program 3:
r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000340)='/proc/vmstat\x00', 0x0, 0x0)
openat(r0, &(0x7f0000000380)='./file2\x00', 0x0, 0x10)
chdir(&(0x7f0000000140)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)

[ 2129.848985] loop6: detected capacity change from 0 to 40
[ 2129.858890] loop7: detected capacity change from 0 to 40
[ 2129.939255] syz-executor.7: attempt to access beyond end of device
[ 2129.939255] loop7: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2129.940230] Buffer I/O error on dev loop7, logical block 10, lost async page write
00:07:20 executing program 1:
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}}, 0x0, 0x6, 0xffffffffffffffff, 0xb)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
r1 = gettid()
rt_sigqueueinfo(0x0, 0x0, 0x0)
r2 = pidfd_getfd(0xffffffffffffffff, r0, 0x0)
perf_event_open(&(0x7f0000000040)={0x5, 0x80, 0x40, 0x71, 0x2, 0x0, 0x0, 0x8000, 0x20, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, @perf_config_ext={0xff}, 0x0, 0x9b5, 0xfa, 0xd, 0x0, 0x8000, 0x55, 0x0, 0x0, 0x0, 0x3ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000400)={0x2, 0x80, 0x2a, 0x81, 0xe0, 0x40, 0x0, 0x63c5ef1c, 0x80, 0x3, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x7, 0x2, @perf_config_ext={0xf2, 0x6}, 0x0, 0x5, 0xfffffff8, 0x0, 0x1, 0x0, 0x1b6, 0x0, 0x6}, 0x0, 0xd, 0xffffffffffffffff, 0x0)
rt_sigqueueinfo(0x0, 0x0, &(0x7f0000000000))
setsockopt$sock_timeval(r0, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10)
bind$packet(r2, &(0x7f00000000c0)={0x11, 0xfe, 0x0, 0x1, 0xfb, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}}, 0x14)
perf_event_open(0x0, r1, 0x10, 0xffffffffffffffff, 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r3, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
openat(r3, &(0x7f0000000180)='\x00', 0x400040, 0x80)
rt_sigqueueinfo(0x0, 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f0000000240)={'ip6_vti0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x4, 0x0, 0x7f, 0x40, 0xb, @local, @mcast1, 0x88, 0x20, 0x8, 0x2}})

00:07:20 executing program 6:
r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000340)='/proc/vmstat\x00', 0x0, 0x0)
openat(r0, &(0x7f0000000380)='./file2\x00', 0x0, 0x10)
r1 = openat$nvram(0xffffffffffffff9c, &(0x7f00000000c0), 0x4400c0, 0x0)
ioctl$BLKRRPART(r1, 0x125f, 0x0)
ioctl$TCGETS2(r0, 0x802c542a, &(0x7f00000003c0))
io_uring_enter(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0)
r2 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_io_uring_setup(0x2c27, &(0x7f0000000480)={0x0, 0xe28a, 0x21, 0x1, 0x3e0, 0x0, r3}, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000000400), &(0x7f0000000440))
ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, &(0x7f000005e2c0)={0x0, 0x0, "d1f14792bb10750ea9e86f2109c85af76eac969c225abcf9542493077458dc50dd5546ef22c70a8bd6b5a45e86c81b77924f226ab6e09915cbe829241e71703056bc95c7386df10315c79284a94c638e15bb1a293b37fce9ccef990b6b10fb9c04f3786fecc4e7d36ad34a037174328cfbd507df8590cdb8df705efb63f6d543b899d97ca79e8c4414fd5da623d28f9252c13428af0998f63ad30f909619b043f0a7aa899a6d9282a5e61460066587029f38eff5aeafc3e8b67b97ebf6c447e628d6041c0c873b2d58b8881c4a4c74e260693309049d39b69a09df12caf88245f7f4dc8ad878b9295afbe717134ff663413f7d075e5e00", "950b8bbc34bf9b44a5f783e82416e13437591aaea9e99d56d9fa2b62c996fb937ef8e5bb361a4eb72e3b338b3d456d93c2993fc14a84c9df4fca9a60ad24fe51c5a3fc272feb82e0053d62793dcbb53a9aac338c90f5cdae9589decd38f50a09d93770fe9fffa2570bae21a6c16607cb009087b6f6850ff959c7cde98a4e32896d4e19a961e665ed3624ef5c69dc0964b4e762a597e962c8f0c77006ae2c2e61c9d589d8075d51ad024b5e6af6d9ad992d0bf7c9b663e91485d32a9e7ee3febf65c5d7f7d8cf1d6ee7a1d12df1d9a056d2c44371e7d7bcf3dc0e9c94a294388d4636547a098e57bad5c0bf1ee2d21aabc22fc193ed1e85886abdeb6944ead2082984e3b7724633f58c76185a0e7814cf6745bb5ca89b88abdf102a0bcf9fb0c1b2eed6553ee3a0eab3b9bcebf70187adf95f5a2564a6d081679f6988f7e0fffda8c75027eec9fd9177d245704a2f1348f6aa2141357964efb85de30e3be48ba72b34f46a53c393aacb648b728316adf6edc89a128dac296e8022e3457cda709d3f4ee82e744910890ba79420b32572d19d21d965bb5f7be6713d2aff1c6a47589d00d173a4f7f75c191247fb6eea511c85f1f2ca3389aeec86fa05b79a53eadd44f6928fd6492e18d1de7614e68ab21dfd71508786e535de92de39236ea42fbaa81ae85784b5c24c89f6bee084493fc227b3c9f620efa3b7c13b48c1bd1bc20f5972f2a94a68b6717e2f0524741ee7d55a39eee078436f0af9a982a0953bd1cd57849007d08bfbf1dfe814c8448539baa1c5b8ced883da94c7b946cb9e205c83941172aa1bc8e710fe6efec7ef16639408348485e6890ea289fabb6a872c634aa21059ca2bd3cf3deae4bfada536780a9f11ef2a84a17bc2e5ffefc8b7f1aa708f2d89e496578b78381a82916a7a2b36413b76171af62915c76d20d2ec695f0d7dd0ae6a5a890e1070500a62f4267321900efe7073474e030a3ab8086275b552ac0ca8e94f438307b354e39005cddc582c5da0f3753b37643cc13bdff1efef66055f16e871e8ad26a502e5e7509d05f98f32f3f0b5d563c498e860b5b931e36ccd1e7d7f5a0904288aecd9c6a5bbda28d43169cb7967d69d124f5cf6fd1574ba9a9eabd5b8b0b27bb48ac5659c2734e21eb8cd71ba8c7fd8ff7b7cb65d7d127ff0f53fc25d2f3eb05586d7299eb8cb1eb255a460c9a05151ceead842b1c21e8c19ebecf6cb1a7f9a19a254c9e39bfbcb905d6d0265b37fae4d15ef8e4c56f82bf976662e0d258c2e7ba2ebe6ca3e9ea3d0ea52ee8b67d8f318a2a27a716977d4fe916264e11788a1e80dde6a0100b156b89f11e4e3bf78c66d535e46477fcd9f568578523406f21a6796ac3c1e0f6ba31a471f359579b103299799606a766a1ca7148c153d85c5420bd1e1ee0564c08c88dec5d248eccf1f63cf01015197f6a3fa61a598e8ad327cd6dfe3cf9f0b4e685dc0e9b10908f68b2290a3741a90991e1f67c04015a780a87c89644280b032722ceb2531bbed8e4459edad3409cbe1ddfd071052277cd908cebe5c00009c3f3a33b9ec60b200e700eb9d48954461c82591a5ffeec87f12d081d30e4c61999879c607cc653a3b2478439b42ea05b469534f20653d8d61a55e9761dd331386109af0b2453eb2e8ba54e7c16e890727c133b442956db67278d661166a9290d4fe8008821649eeefba119ba3776597654a546611693db7b3fc63aa2d01047dbf8a6db146b0fcf3afc8d819575f642dc87ffbd0a42bb68c20f1ea1dac2804db95adab571d2ca60c679a8db02ba3cd5765713e5c3748205b56fd3f6f6e32f628c5b986b1f9d218df36b03db78ee74544555dfa7506a939f48c10a9df0620a841f7e9c67cbf5b367c4c0bbd69b76956326f1737d143d49619691433473fd5fed20fc5710ff0f7c6288a4071f02f741532e3080d59b039466ab62972ecc563ee511e8a9d56fa7179569f1d2420ddc90c62d654331771dd8515ecb6d9030901de113996870c1d921fca0d39a5da13183ab12506008f3074a26ef1990fdabfea0d42d346748959a35e0e07c447c03a591c54ae61186cf579e2636e89d3b3f06c5a019330dbb2d313cff036624a789abb4d5a76ea83e31774be2280de447a053e29a2cb6c4fe62292b61e6513098cc0269a6d526aab3dba820ebe9408839a8f96a5cd09bb29dd6e1b2bdfd31d6b93ceb47976f6650f0c294b061fd25118d364cb0654b0f87741953c3fb2a590394179678b1fab1390db08d599bc418f168f4aa56ebbf3fc9f1597151c83e989770349402695c8b2bfd2b488e0735a071650d4fe1420804c66ce4261424f60424c0390397e7eea3ca904173b8620d74799ae84204abc9548801f3ca29973a33110c6b13d0aaaf316948e1d6fb99ca3150864361418d7f05f39ba7b9026a356f185ad23542e6f0af8d71989486bde21d7451acf86bab6ed27271f395ab31e88e6cd6ff6da710e6ae680fc1711a1319694f9ac56cdcfd46a10db35295627a7dcd4c605e98e455164ff21927b904929973b7520f752b76e6cd3732e540371fd78a5a42611f42d0b185d213a47abd2dfdc37c79894d3323900631655bc263fb5e8aa6b6f32c9f8ced4acc81c6d4bc95fa48faee5697d4221cc576bae07afe10057cf40423318fcd32c3158d65eb770728028f8e5354069ec4f4f63b9a4cd68172397bfa5371a43697e7bc26d777c55ce5f0a225324397a7567b0b969604db7d32c95b05017db53bad3cc1ac3f3d3bc0287d7794f9baf0f1a7064258586e39743dc150637d84c47fce0feb9e9f3c1fbddcdc9de4a1011a54cf9a74fd28b029f0bfb45f723e4dbe9910a203e98fdbe6fa0d562ead671d5ecaba5f2f29d8e37dcae6b3b6e0cc4917ef4da6b9f0baacbc51840ebaf85f0f7d11897d8887a35d99f50eedefcb07913a665d0843f68a73767df874c5995936bf5c03bf40ff54e179c094127af6254e22da82484472eca7a48bf932c2470ad5c6bc43b2392ebae24692e73ae1c6e0c03eb958b7831156d7509da69cfd9d8e5068e560fc7f28a974490ecbbc79aafb65f525e5b8d04aaed3b683c6b23703d6ff361f5bd57a9b62ffa5e994b9bbaaf582688f78bc13ef909f9634324fbf6859646b673e2b1d80f56a58bffdac390c245d8cc3036da0e6656f24af365da36ec6cc74847ccfb4a36115c1f19cc6e848f909089a2ac660d1223765295f37c442f987ed98b3f7b3b963213d2e6289b147c80dfc239800f0d48d37fc4739fa521dd686f5413261a9cd06f1c09c598d3d91e66db106ef212c3a1b8c02834f9cc3634ca938df7a478c25b55f0c654bc4f70057a60a7bbf02706f048329d3ad3052f23b698b8ffb97085f121249359320efff2add0c35db60e7cf74e0169e9cf13c0c3725768fea6e928a213e61bae007bc307e4fe63b0905772c469747b5884509acce8b7c368b417b44460d6e5d3ab9dec690c43a029122ba37216d48a0d7eb519fcd0257df3a693711ffa60c8a3855713f359c3780f4a40694982d7ce84e40f03faaf942730e9daa8777d7a8909999df47955ea430bb443789f047066426df0a7fe04f741420b0db3c5e54f0b03e60b5897e96c4bf34f324ef899b9ea4b36c44b2496f043e7be07f3a58bb094caab78f168d9486d0dfd1adc97ae3ce5e710a9e47e6b5f8360417d1462acb4062057dda820c5d4b4cc90a13732fc2b52b12b2d255cb01f529a597e5ee29eb36e0c479896ae189103580a633c4a09621043df2205d00b45a84cd8ebe81c483cdf66994827672942dba7674e2090829a33744394e7b9c81ff273a5df6e0eceaa9b2abad932c8740d3b0b977e91fc03f4020a4459fa582d48673215c14f0da08a82a67b8bb804915c9d1218d7a9de94033a32725f30f9f9e81987d63cca018d12c3894b7fbeb95901f382bdee8595b2e6b7f42d0ada636db6e000625dfaa79a6309b2dd279fff258cefcc044a06bdbe489230ffdd90efdda0df2da52742a59e24b8c50ec68790fc62207ac2cd6d4997d6a4faa5e2645e30228f39094750eef3ce56b1569438750ff50130c64e8f37d8ff49fa9d9c0d409e9f60f347cb386946ce117b4c40a9a53c7359d3a966c7326263270eb16876ff1e6da42a73a634ac661327a916b8416bac1bb49a5e9b8da0dc7170d833d07df1fab73a7f202aaa768049efefc4b3996118d27c949aaccfb6416be56f30e9fce9602d0cf57c1c70b321974e3518434ca828f1a51d4191b99e0e0a7451ba3b4f2b5cf95b44fc417abcc5b0b13bae366614f75c98aade49013475086a48d9e64ba7701d6aa7997132e56b97b962921a73e7a70de0f32c06d0117b24708867f7247024a28096607669001e87ec188812d0eab256b0296e0f70c47c6ca89dd511c1362523930a546a44ebc421e03e979a5bba49732d437d82e7555e5a10c4a1fd933c6c50380d3d7a147586e4033005f533f7ade992af2696c4d122311a473f97644095805a18da9d0b52e2f72dd386a3d14f478c7ba144503ee2e94bfb3853fb37adca2f7bf51872fd3a54e392c8b6dbf142c6ae83ca21575ca6a1d3fa1b1de90f4a816d093561f88f6e6aaf782d08c798147a64851759b8667a1531da2d571e1457edd13d7d0929ae02daed710e9ae1a2796e38a1c2921dd2f457f825f4cf95f02e34e9cf3e894d57cfde113224210caec0b4ab2901262b6e36d96ea1febc8c73a12f0e40f6b47b13709cfecbec1420fcb5cdc2b5986d0a54fe0459ba5f77b90bc9d2cbdd86663910fed740f6f41d94cb1b3818a550f8da00f6d17b150e4872fec8712a7490a1782a82b9680ceeeb41fdb8c95c1d3d574437d3bd1915020d96e411978c1738d7683b62f5dbf6280dc72860a2b6fa1de548e6a22987f1d3b5eb010172d7c684e9943e32b140fc51cd8c7046a2cc604244a7aad63a9edd2f64c31c8fe127a2cb96fc5ca374b24e475bc78f4cbdda40b39b282af1d192bd2a967fc6b7811f8ef8be8d65cd8d3ddbf1e69989c073a16c9c1896ca8a734bc6a4df17d39d30a8b8c1ec3d93534747e8e9a769f60a9e10cc69ea5903993bc481630e1df50eedc1a1a51d96de8fcd27a3ba4108349c92d52b81886d19217b10508527634c58af2806b2dae8c71aaeb6946896decd03266a75bccf676d86064188d0da683b0138a3c03fc22bbf6c8d8bdea829bc5aa5d5521da096718aa6a629f174e510b1215b49f27db3c145555baa329d15de80976748b68648482cb8cf9e79cc3acefe4d8436c04e882934abc30ac5886d10a54b759f1b4407d1ea9d8cc1049e4f60c9dc96dbda9dbc98bac97974d6c8625a2be3d48ef98edfbf0725cc18f21b50a67b0de8ff6544cd67ce0d43fcc1d24800"})
openat$snapshot(0xffffffffffffff9c, &(0x7f00000001c0), 0x301c03, 0x0)
openat(r2, &(0x7f0000000180)='./file2\x00', 0x8080, 0x25)
fsconfig$FSCONFIG_SET_PATH_EMPTY(r3, 0x4, &(0x7f0000000240)='\x00', &(0x7f0000000300)='./file2\x00', 0xffffffffffffffff)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)

00:07:20 executing program 7:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684fd2981c8409820000080000000000000000"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x100d}], 0x1, 0x0, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(0xffffffffffffffff, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:07:20 executing program 0:
r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684fd2981c8409820000080000000000000000"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r1, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x100d}], 0x1, 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r0, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r2, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r1, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:07:20 executing program 3:
openat$procfs(0xffffffffffffff9c, &(0x7f0000000340)='/proc/vmstat\x00', 0x0, 0x0)
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r0, &(0x7f0000001180)=ANY=[], 0x220)

00:07:20 executing program 2:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684f"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{0x0}], 0x1, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:07:20 executing program 1:
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}}, 0x0, 0x6, 0xffffffffffffffff, 0xb)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
r1 = gettid()
rt_sigqueueinfo(0x0, 0x0, 0x0)
r2 = pidfd_getfd(0xffffffffffffffff, r0, 0x0)
perf_event_open(&(0x7f0000000040)={0x5, 0x80, 0x40, 0x71, 0x2, 0x0, 0x0, 0x8000, 0x20, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, @perf_config_ext={0xff}, 0x0, 0x9b5, 0xfa, 0xd, 0x0, 0x8000, 0x55, 0x0, 0x0, 0x0, 0x3ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000400)={0x2, 0x80, 0x2a, 0x81, 0xe0, 0x40, 0x0, 0x63c5ef1c, 0x80, 0x3, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x7, 0x2, @perf_config_ext={0xf2, 0x6}, 0x0, 0x5, 0xfffffff8, 0x0, 0x1, 0x0, 0x1b6, 0x0, 0x6}, 0x0, 0xd, 0xffffffffffffffff, 0x0)
rt_sigqueueinfo(0x0, 0x0, &(0x7f0000000000))
setsockopt$sock_timeval(r0, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10)
bind$packet(r2, &(0x7f00000000c0)={0x11, 0xfe, 0x0, 0x1, 0xfb, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}}, 0x14)
perf_event_open(0x0, r1, 0x10, 0xffffffffffffffff, 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r3, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
openat(r3, &(0x7f0000000180)='\x00', 0x400040, 0x80)
rt_sigqueueinfo(0x0, 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f0000000240)={'ip6_vti0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x4, 0x0, 0x7f, 0x40, 0xb, @local, @mcast1, 0x88, 0x20, 0x8, 0x2}})

00:07:20 executing program 4:
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}}, 0x0, 0x6, 0xffffffffffffffff, 0xb)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
r1 = gettid()
rt_sigqueueinfo(0x0, 0x0, 0x0)
r2 = pidfd_getfd(0xffffffffffffffff, r0, 0x0)
perf_event_open(&(0x7f0000000040)={0x5, 0x80, 0x40, 0x71, 0x2, 0x0, 0x0, 0x8000, 0x20, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, @perf_config_ext={0xff}, 0x0, 0x9b5, 0xfa, 0xd, 0x0, 0x8000, 0x55, 0x0, 0x0, 0x0, 0x3ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000400)={0x2, 0x80, 0x2a, 0x81, 0xe0, 0x40, 0x0, 0x63c5ef1c, 0x80, 0x3, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x7, 0x2, @perf_config_ext={0xf2, 0x6}, 0x0, 0x5, 0xfffffff8, 0x0, 0x1, 0x0, 0x1b6, 0x0, 0x6}, 0x0, 0xd, 0xffffffffffffffff, 0x0)
rt_sigqueueinfo(0x0, 0x0, &(0x7f0000000000))
setsockopt$sock_timeval(r0, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10)
bind$packet(r2, &(0x7f00000000c0)={0x11, 0xfe, 0x0, 0x1, 0xfb, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}}, 0x14)
perf_event_open(0x0, r1, 0x10, 0xffffffffffffffff, 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r3, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
openat(r3, &(0x7f0000000180)='\x00', 0x400040, 0x80)
rt_sigqueueinfo(0x0, 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f0000000240)={'ip6_vti0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x4, 0x0, 0x7f, 0x40, 0xb, @local, @mcast1, 0x88, 0x20, 0x8, 0x2}})

[ 2130.213298] loop6: detected capacity change from 0 to 40
[ 2130.261096] loop3: detected capacity change from 0 to 40
00:07:20 executing program 7:
r0 = socket$inet_udp(0x2, 0x2, 0x0)
r1 = gettid()
rt_sigqueueinfo(0x0, 0x0, 0x0)
r2 = pidfd_getfd(0xffffffffffffffff, r0, 0x0)
perf_event_open(&(0x7f0000000040)={0x5, 0x80, 0x40, 0x71, 0x2, 0x0, 0x0, 0x8000, 0x20, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, @perf_config_ext={0xff}, 0x0, 0x9b5, 0xfa, 0xd, 0x0, 0x8000, 0x55, 0x0, 0x0, 0x0, 0x3ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000400)={0x2, 0x80, 0x2a, 0x81, 0xe0, 0x40, 0x0, 0x63c5ef1c, 0x80, 0x3, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x7, 0x2, @perf_config_ext={0xf2, 0x6}, 0x0, 0x5, 0xfffffff8, 0x0, 0x1, 0x0, 0x1b6, 0x0, 0x6}, 0x0, 0xd, 0xffffffffffffffff, 0x0)
rt_sigqueueinfo(0x0, 0x0, &(0x7f0000000000))
setsockopt$sock_timeval(r0, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10)
bind$packet(r2, &(0x7f00000000c0)={0x11, 0xfe, 0x0, 0x1, 0xfb, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}}, 0x14)
perf_event_open(&(0x7f0000000100)={0x0, 0x80, 0xff, 0x8, 0x4, 0x1, 0x0, 0x4, 0x684, 0x4, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0xdbc, 0x0, @perf_config_ext={0xd03, 0x80000000}, 0x800, 0x3, 0x3, 0x5, 0x300000000000000, 0x7, 0x7ff, 0x0, 0x0, 0x0, 0x5}, r1, 0x10, 0xffffffffffffffff, 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r3, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
openat(r3, &(0x7f0000000180)='\x00', 0x400040, 0x80)
rt_sigqueueinfo(0x0, 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f0000000240)={'ip6_vti0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x4, 0x0, 0x7f, 0x40, 0xb, @local, @mcast1, 0x88, 0x20, 0x8, 0x2}})

00:07:40 executing program 0:
perf_event_open(&(0x7f0000000080)={0x0, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r1, &(0x7f0000000100), 0x0, 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r0, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r2, 0x0, 0x0, 0x87ffffc) (fail_nth: 1)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0x0, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r1, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:07:40 executing program 2:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684f"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x100d}], 0x1, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, 0x0, 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:07:40 executing program 7:
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}}, 0x0, 0x6, 0xffffffffffffffff, 0xb)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
rt_sigqueueinfo(0x0, 0x0, 0x0)
r1 = pidfd_getfd(0xffffffffffffffff, r0, 0x0)
perf_event_open(&(0x7f0000000040)={0x5, 0x80, 0x40, 0x71, 0x2, 0x0, 0x0, 0x8000, 0x20, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, @perf_config_ext={0xff}, 0x0, 0x9b5, 0xfa, 0xd, 0x0, 0x8000, 0x55, 0x0, 0x0, 0x0, 0x3ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000400)={0x2, 0x80, 0x2a, 0x81, 0xe0, 0x40, 0x0, 0x63c5ef1c, 0x80, 0x3, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x7, 0x2, @perf_config_ext={0xf2, 0x6}, 0x0, 0x5, 0xfffffff8, 0x0, 0x1, 0x0, 0x1b6, 0x0, 0x6}, 0x0, 0xd, 0xffffffffffffffff, 0x0)
rt_sigqueueinfo(0x0, 0x0, &(0x7f0000000000))
setsockopt$sock_timeval(r0, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10)
bind$packet(r1, &(0x7f00000000c0)={0x11, 0xfe, 0x0, 0x1, 0xfb, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}}, 0x14)
perf_event_open(&(0x7f0000000100)={0x0, 0x80, 0xff, 0x8, 0x4, 0x1, 0x0, 0x4, 0x684, 0x4, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0xdbc, 0x0, @perf_config_ext={0xd03, 0x80000000}, 0x800, 0x3, 0x3, 0x5, 0x300000000000000, 0x7, 0x7ff, 0x0, 0x0, 0x0, 0x5}, 0x0, 0x10, 0xffffffffffffffff, 0x2)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r2, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
openat(r2, &(0x7f0000000180)='\x00', 0x400040, 0x80)
rt_sigqueueinfo(0x0, 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f0000000240)={'ip6_vti0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x4, 0x0, 0x7f, 0x40, 0xb, @local, @mcast1, 0x88, 0x20, 0x8, 0x2}})

00:07:40 executing program 6:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684fd2981c8409820000080000000000000000"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r1, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x100d}], 0x1, 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fallocate(r2, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r1, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:07:40 executing program 1:
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}}, 0x0, 0x6, 0xffffffffffffffff, 0xb)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
r1 = gettid()
rt_sigqueueinfo(0x0, 0x0, 0x0)
r2 = pidfd_getfd(0xffffffffffffffff, r0, 0x0)
perf_event_open(&(0x7f0000000040)={0x5, 0x80, 0x40, 0x71, 0x2, 0x0, 0x0, 0x8000, 0x20, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, @perf_config_ext={0xff}, 0x0, 0x9b5, 0xfa, 0xd, 0x0, 0x8000, 0x55, 0x0, 0x0, 0x0, 0x3ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000400)={0x2, 0x80, 0x2a, 0x81, 0xe0, 0x40, 0x0, 0x63c5ef1c, 0x80, 0x3, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x7, 0x2, @perf_config_ext={0xf2, 0x6}, 0x0, 0x5, 0xfffffff8, 0x0, 0x1, 0x0, 0x1b6, 0x0, 0x6}, 0x0, 0xd, 0xffffffffffffffff, 0x0)
rt_sigqueueinfo(0x0, 0x0, &(0x7f0000000000))
setsockopt$sock_timeval(r0, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10)
bind$packet(r2, &(0x7f00000000c0)={0x11, 0xfe, 0x0, 0x1, 0xfb, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}}, 0x14)
perf_event_open(0x0, r1, 0x10, 0xffffffffffffffff, 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r3, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
openat(r3, &(0x7f0000000180)='\x00', 0x400040, 0x80)
rt_sigqueueinfo(0x0, 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f0000000240)={'ip6_vti0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x4, 0x0, 0x7f, 0x40, 0xb, @local, @mcast1, 0x88, 0x20, 0x8, 0x2}})

00:07:40 executing program 3:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r0, &(0x7f0000001180)=ANY=[], 0x220)

00:07:40 executing program 5:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684fd2981c8409820000080000000000000000"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r1, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x100d}], 0x1, 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fallocate(r2, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r1, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:07:40 executing program 4:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
setxattr$trusted_overlay_opaque(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040), &(0x7f00000000c0), 0x2, 0x4)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
stat(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, <r1=>0x0})
setresuid(0x0, r1, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r2, r0, 0x0, 0xfffffdef)

[ 2150.311974] loop4: detected capacity change from 0 to 40
[ 2150.316568] loop3: detected capacity change from 0 to 40
00:07:41 executing program 2:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684f"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x100d}], 0x1, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, 0x0, 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

[ 2150.454439] syz-executor.4: attempt to access beyond end of device
[ 2150.454439] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2150.455748] Buffer I/O error on dev loop4, logical block 10, lost async page write
00:07:41 executing program 1:
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}}, 0x0, 0x6, 0xffffffffffffffff, 0xb)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
r1 = gettid()
rt_sigqueueinfo(0x0, 0x0, 0x0)
r2 = pidfd_getfd(0xffffffffffffffff, r0, 0x0)
perf_event_open(&(0x7f0000000040)={0x5, 0x80, 0x40, 0x71, 0x2, 0x0, 0x0, 0x8000, 0x20, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, @perf_config_ext={0xff}, 0x0, 0x9b5, 0xfa, 0xd, 0x0, 0x8000, 0x55, 0x0, 0x0, 0x0, 0x3ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000400)={0x2, 0x80, 0x2a, 0x81, 0xe0, 0x40, 0x0, 0x63c5ef1c, 0x80, 0x3, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x7, 0x2, @perf_config_ext={0xf2, 0x6}, 0x0, 0x5, 0xfffffff8, 0x0, 0x1, 0x0, 0x1b6, 0x0, 0x6}, 0x0, 0xd, 0xffffffffffffffff, 0x0)
rt_sigqueueinfo(0x0, 0x0, &(0x7f0000000000))
setsockopt$sock_timeval(r0, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10)
bind$packet(r2, &(0x7f00000000c0)={0x11, 0xfe, 0x0, 0x1, 0xfb, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}}, 0x14)
perf_event_open(&(0x7f0000000100)={0x0, 0x80, 0x0, 0x8, 0x4, 0x1, 0x0, 0x4, 0x684, 0x4, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0xdbc, 0x0, @perf_config_ext={0xd03, 0x80000000}, 0x800, 0x3, 0x3, 0x5, 0x300000000000000, 0x7, 0x7ff, 0x0, 0x0, 0x0, 0x5}, r1, 0x10, 0xffffffffffffffff, 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r3, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
openat(r3, &(0x7f0000000180)='\x00', 0x400040, 0x80)
rt_sigqueueinfo(0x0, 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f0000000240)={'ip6_vti0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x4, 0x0, 0x7f, 0x40, 0xb, @local, @mcast1, 0x88, 0x20, 0x8, 0x2}})

00:07:41 executing program 7:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684fd2981c8409820000080000000000000000"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x100d}], 0x1, 0x0, 0x0) (fail_nth: 1)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:07:41 executing program 3:
syz_mount_image$vfat(0x0, &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r0, &(0x7f0000001180)=ANY=[], 0x220)

00:07:41 executing program 5:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 1)

00:07:41 executing program 4:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_mount_image$tmpfs(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 1)

00:07:41 executing program 2:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684f"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x100d}], 0x1, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, 0x0, 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

[ 2150.677368] FAULT_INJECTION: forcing a failure.
[ 2150.677368] name fail_usercopy, interval 1, probability 0, space 0, times 1
[ 2150.678901] CPU: 1 PID: 11877 Comm: syz-executor.7 Not tainted 6.1.0-rc8-next-20221208 #1
[ 2150.679629] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
[ 2150.680456] Call Trace:
[ 2150.680670]  <TASK>
[ 2150.680860]  dump_stack_lvl+0x8f/0xb7
[ 2150.681179]  should_fail_ex.cold+0x5/0xa
[ 2150.681522]  _copy_from_user+0x30/0x1f0
[ 2150.681858]  iovec_from_user+0x2b3/0x450
[ 2150.682193]  __import_iovec+0x6b/0x690
[ 2150.682508]  ? lock_is_held_type+0xdb/0x130
[ 2150.682871]  ? lock_is_held_type+0xdb/0x130
[ 2150.683233]  import_iovec+0x87/0xb0
[ 2150.683534]  vfs_readv+0xbb/0x160
[ 2150.683837]  ? __pfx_vfs_readv+0x10/0x10
[ 2150.684164]  ? lock_release+0x3b6/0x750
[ 2150.684506]  ? __fget_files+0x24e/0x450
[ 2150.684835]  ? __pfx_lock_release+0x10/0x10
[ 2150.685205]  ? perf_trace_run_bpf_submit+0xf3/0x1c0
[ 2150.685613]  ? syscall_enter_from_user_mode+0x1c/0x50
[ 2150.686032]  ? __fget_files+0x270/0x450
[ 2150.686380]  __x64_sys_preadv+0x233/0x310
[ 2150.686715]  ? __pfx___x64_sys_preadv+0x10/0x10
[ 2150.687087]  ? syscall_enter_from_user_mode+0x21/0x50
[ 2150.687492]  ? syscall_enter_from_user_mode+0x21/0x50
[ 2150.687883]  do_syscall_64+0x3f/0x90
[ 2150.688196]  entry_SYSCALL_64_after_hwframe+0x72/0xdc
[ 2150.688607] RIP: 0033:0x7fee82b12b19
[ 2150.688903] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
[ 2150.690290] RSP: 002b:00007fee80088188 EFLAGS: 00000246 ORIG_RAX: 0000000000000127
[ 2150.690891] RAX: ffffffffffffffda RBX: 00007fee82c25f60 RCX: 00007fee82b12b19
[ 2150.691456] RDX: 0000000000000001 RSI: 0000000020000100 RDI: 0000000000000005
[ 2150.692022] RBP: 00007fee800881d0 R08: 0000000000000000 R09: 0000000000000000
[ 2150.692601] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
[ 2150.693147] R13: 00007ffeca18172f R14: 00007fee80088300 R15: 0000000000022000
[ 2150.693711]  </TASK>
[ 2150.707395] loop3: detected capacity change from 0 to 40
[ 2150.728796] loop5: detected capacity change from 0 to 40
[ 2150.742556] loop4: detected capacity change from 0 to 40
[ 2150.765780] FAULT_INJECTION: forcing a failure.
[ 2150.765780] name failslab, interval 1, probability 0, space 0, times 1
[ 2150.766615] CPU: 1 PID: 11884 Comm: syz-executor.5 Not tainted 6.1.0-rc8-next-20221208 #1
[ 2150.767223] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
[ 2150.767826] Call Trace:
[ 2150.768027]  <TASK>
[ 2150.768207]  dump_stack_lvl+0x8f/0xb7
[ 2150.768520]  should_fail_ex.cold+0x5/0xa
[ 2150.768847]  should_failslab+0x9/0x20
[ 2150.769149]  __kmem_cache_alloc_node+0x5b/0x400
[ 2150.769513]  ? alloc_pipe_info+0x109/0x590
[ 2150.769860]  kmalloc_trace+0x26/0x60
[ 2150.770156]  alloc_pipe_info+0x109/0x590
[ 2150.770488]  splice_direct_to_actor+0x6e6/0x8c0
[ 2150.770850]  ? __pfx_direct_splice_actor+0x10/0x10
[ 2150.771229]  ? inode_security+0x105/0x140
[ 2150.771540]  ? avc_policy_seqno+0xd/0x70
[ 2150.771858]  ? selinux_file_permission+0x3a/0x510
[ 2150.772238]  ? __pfx_splice_direct_to_actor+0x10/0x10
[ 2150.772611]  ? security_file_permission+0xb5/0xe0
[ 2150.772992]  do_splice_direct+0x1bc/0x290
[ 2150.773314]  ? __pfx_do_splice_direct+0x10/0x10
[ 2150.773679]  ? lock_is_held_type+0xdb/0x130
[ 2150.774022]  do_sendfile+0xb1d/0x1280
[ 2150.774321]  ? __pfx_do_sendfile+0x10/0x10
[ 2150.774656]  ? lock_is_held_type+0xdb/0x130
[ 2150.774977]  __x64_sys_sendfile64+0x248/0x2a0
[ 2150.775332]  ? trace_rcu_dyntick+0x1a7/0x250
[ 2150.775663]  ? __pfx___x64_sys_sendfile64+0x10/0x10
[ 2150.776046]  ? syscall_enter_from_user_mode+0x21/0x50
[ 2150.776423]  ? syscall_enter_from_user_mode+0x21/0x50
[ 2150.776844]  do_syscall_64+0x3f/0x90
[ 2150.777126]  entry_SYSCALL_64_after_hwframe+0x72/0xdc
[ 2150.777528] RIP: 0033:0x7f5e74c67b19
[ 2150.777796] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
[ 2150.779006] RSP: 002b:00007f5e721dd188 EFLAGS: 00000246 ORIG_RAX: 0000000000000028
[ 2150.779524] RAX: ffffffffffffffda RBX: 00007f5e74d7af60 RCX: 00007f5e74c67b19
[ 2150.780011] RDX: 0000000000000000 RSI: 0000000000000003 RDI: 0000000000000004
[ 2150.780504] RBP: 00007f5e721dd1d0 R08: 0000000000000000 R09: 0000000000000000
[ 2150.780991] R10: 00000000fffffdef R11: 0000000000000246 R12: 0000000000000001
[ 2150.781472] R13: 00007ffd3dbd647f R14: 00007f5e721dd300 R15: 0000000000022000
[ 2150.781978]  </TASK>
00:07:41 executing program 1:
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}}, 0x0, 0x6, 0xffffffffffffffff, 0xb)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
r1 = gettid()
rt_sigqueueinfo(0x0, 0x0, 0x0)
r2 = pidfd_getfd(0xffffffffffffffff, r0, 0x0)
perf_event_open(&(0x7f0000000040)={0x5, 0x80, 0x40, 0x71, 0x2, 0x0, 0x0, 0x8000, 0x20, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, @perf_config_ext={0xff}, 0x0, 0x9b5, 0xfa, 0xd, 0x0, 0x8000, 0x55, 0x0, 0x0, 0x0, 0x3ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000400)={0x2, 0x80, 0x2a, 0x81, 0xe0, 0x40, 0x0, 0x63c5ef1c, 0x80, 0x3, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x7, 0x2, @perf_config_ext={0xf2, 0x6}, 0x0, 0x5, 0xfffffff8, 0x0, 0x1, 0x0, 0x1b6, 0x0, 0x6}, 0x0, 0xd, 0xffffffffffffffff, 0x0)
rt_sigqueueinfo(0x0, 0x0, &(0x7f0000000000))
setsockopt$sock_timeval(r0, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10)
bind$packet(r2, &(0x7f00000000c0)={0x11, 0xfe, 0x0, 0x1, 0xfb, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}}, 0x14)
perf_event_open(&(0x7f0000000100)={0x0, 0x80, 0x0, 0x8, 0x4, 0x1, 0x0, 0x4, 0x684, 0x4, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0xdbc, 0x0, @perf_config_ext={0xd03, 0x80000000}, 0x800, 0x3, 0x3, 0x5, 0x300000000000000, 0x7, 0x7ff, 0x0, 0x0, 0x0, 0x5}, r1, 0x10, 0xffffffffffffffff, 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r3, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
openat(r3, &(0x7f0000000180)='\x00', 0x400040, 0x80)
rt_sigqueueinfo(0x0, 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f0000000240)={'ip6_vti0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x4, 0x0, 0x7f, 0x40, 0xb, @local, @mcast1, 0x88, 0x20, 0x8, 0x2}})

[ 2150.804531] FAULT_INJECTION: forcing a failure.
[ 2150.804531] name failslab, interval 1, probability 0, space 0, times 0
[ 2150.805377] CPU: 1 PID: 11886 Comm: syz-executor.4 Not tainted 6.1.0-rc8-next-20221208 #1
[ 2150.805965] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
[ 2150.806547] Call Trace:
[ 2150.806739]  <TASK>
[ 2150.806914]  dump_stack_lvl+0x8f/0xb7
[ 2150.807201]  should_fail_ex.cold+0x5/0xa
[ 2150.807517]  should_failslab+0x9/0x20
[ 2150.807809]  __kmem_cache_alloc_node+0x5b/0x400
[ 2150.808155]  ? alloc_pipe_info+0x109/0x590
[ 2150.808469]  kmalloc_trace+0x26/0x60
[ 2150.808758]  alloc_pipe_info+0x109/0x590
[ 2150.809080]  splice_direct_to_actor+0x6e6/0x8c0
[ 2150.809443]  ? __pfx_direct_splice_actor+0x10/0x10
[ 2150.809803]  ? inode_security+0x105/0x140
[ 2150.810129]  ? avc_policy_seqno+0xd/0x70
[ 2150.810441]  ? selinux_file_permission+0x3a/0x510
[ 2150.810817]  ? __pfx_splice_direct_to_actor+0x10/0x10
[ 2150.811199]  ? security_file_permission+0xb5/0xe0
[ 2150.811563]  do_splice_direct+0x1bc/0x290
[ 2150.811855]  ? __pfx_do_splice_direct+0x10/0x10
[ 2150.812214]  ? lock_is_held_type+0xdb/0x130
[ 2150.812532]  do_sendfile+0xb1d/0x1280
[ 2150.812831]  ? __pfx_do_sendfile+0x10/0x10
[ 2150.813142]  ? lock_is_held_type+0xdb/0x130
[ 2150.813455]  __x64_sys_sendfile64+0x248/0x2a0
[ 2150.813769]  ? trace_rcu_dyntick+0x1a7/0x250
[ 2150.814087]  ? __pfx___x64_sys_sendfile64+0x10/0x10
[ 2150.814434]  ? syscall_enter_from_user_mode+0x21/0x50
[ 2150.814788]  ? syscall_enter_from_user_mode+0x21/0x50
[ 2150.815145]  do_syscall_64+0x3f/0x90
[ 2150.815412]  entry_SYSCALL_64_after_hwframe+0x72/0xdc
[ 2150.815765] RIP: 0033:0x7f5dbe2acb19
[ 2150.816024] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
[ 2150.817312] RSP: 002b:00007f5dbb822188 EFLAGS: 00000246 ORIG_RAX: 0000000000000028
[ 2150.817811] RAX: ffffffffffffffda RBX: 00007f5dbe3bff60 RCX: 00007f5dbe2acb19
[ 2150.818288] RDX: 0000000000000000 RSI: 0000000000000003 RDI: 0000000000000004
[ 2150.818763] RBP: 00007f5dbb8221d0 R08: 0000000000000000 R09: 0000000000000000
[ 2150.819239] R10: 00000000fffffdef R11: 0000000000000246 R12: 0000000000000001
[ 2150.819714] R13: 00007ffc7a53101f R14: 00007f5dbb822300 R15: 0000000000022000
[ 2150.820203]  </TASK>
[ 2169.006502] loop4: detected capacity change from 0 to 40
00:07:59 executing program 7:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684fd2981c8409820000080000000000000000"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x100d}], 0x1, 0x0, 0x0) (fail_nth: 2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:07:59 executing program 4:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_mount_image$tmpfs(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 2)

00:07:59 executing program 3:
syz_mount_image$vfat(0x0, &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r0, &(0x7f0000001180)=ANY=[], 0x220)

00:07:59 executing program 1:
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}}, 0x0, 0x6, 0xffffffffffffffff, 0xb)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
r1 = gettid()
rt_sigqueueinfo(0x0, 0x0, 0x0)
r2 = pidfd_getfd(0xffffffffffffffff, r0, 0x0)
perf_event_open(&(0x7f0000000040)={0x5, 0x80, 0x40, 0x71, 0x2, 0x0, 0x0, 0x8000, 0x20, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, @perf_config_ext={0xff}, 0x0, 0x9b5, 0xfa, 0xd, 0x0, 0x8000, 0x55, 0x0, 0x0, 0x0, 0x3ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000400)={0x2, 0x80, 0x2a, 0x81, 0xe0, 0x40, 0x0, 0x63c5ef1c, 0x80, 0x3, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x7, 0x2, @perf_config_ext={0xf2, 0x6}, 0x0, 0x5, 0xfffffff8, 0x0, 0x1, 0x0, 0x1b6, 0x0, 0x6}, 0x0, 0xd, 0xffffffffffffffff, 0x0)
rt_sigqueueinfo(0x0, 0x0, &(0x7f0000000000))
setsockopt$sock_timeval(r0, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10)
bind$packet(r2, &(0x7f00000000c0)={0x11, 0xfe, 0x0, 0x1, 0xfb, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}}, 0x14)
perf_event_open(&(0x7f0000000100)={0x0, 0x80, 0x0, 0x8, 0x4, 0x1, 0x0, 0x4, 0x684, 0x4, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0xdbc, 0x0, @perf_config_ext={0xd03, 0x80000000}, 0x800, 0x3, 0x3, 0x5, 0x300000000000000, 0x7, 0x7ff, 0x0, 0x0, 0x0, 0x5}, r1, 0x10, 0xffffffffffffffff, 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r3, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
openat(r3, &(0x7f0000000180)='\x00', 0x400040, 0x80)
rt_sigqueueinfo(0x0, 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f0000000240)={'ip6_vti0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x4, 0x0, 0x7f, 0x40, 0xb, @local, @mcast1, 0x88, 0x20, 0x8, 0x2}})

00:07:59 executing program 2:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684f"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x100d}], 0x1, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x0, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:07:59 executing program 0:
perf_event_open(&(0x7f0000000080)={0x0, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r1, &(0x7f0000000100), 0x0, 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r0, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r2, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0x0, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r1, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:07:59 executing program 5:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 2)

00:07:59 executing program 6:
syz_mount_image$vfat(0x0, &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r0, &(0x7f0000001180)=ANY=[], 0x220)

[ 2169.025260] loop5: detected capacity change from 0 to 40
[ 2169.049769] FAULT_INJECTION: forcing a failure.
[ 2169.049769] name failslab, interval 1, probability 0, space 0, times 0
[ 2169.052672] loop6: detected capacity change from 0 to 40
[ 2169.054165] CPU: 0 PID: 11902 Comm: syz-executor.7 Not tainted 6.1.0-rc8-next-20221208 #1
[ 2169.055571] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
[ 2169.057030] Call Trace:
[ 2169.057492]  <TASK>
[ 2169.057928]  dump_stack_lvl+0x8f/0xb7
[ 2169.058629]  should_fail_ex.cold+0x5/0xa
[ 2169.059398]  ? kvmalloc_node+0xaa/0x200
[ 2169.060125]  should_failslab+0x9/0x20
[ 2169.060843]  __kmem_cache_alloc_node+0x5b/0x400
[ 2169.061709]  ? kvmalloc_node+0xaa/0x200
[ 2169.062460]  ? kvmalloc_node+0xaa/0x200
[ 2169.063182]  __kmalloc_node+0x45/0xb0
[ 2169.063882]  kvmalloc_node+0xaa/0x200
[ 2169.064456]  seq_read_iter+0x820/0x12b0
[ 2169.065047]  ? lockdep_hardirqs_on+0x7d/0x100
[ 2169.065705]  ? asm_sysvec_apic_timer_interrupt+0x1a/0x20
[ 2169.066479]  proc_reg_read_iter+0x20e/0x2e0
[ 2169.067109]  do_iter_readv_writev+0x2f0/0x3c0
[ 2169.067752]  ? __pfx_do_iter_readv_writev+0x10/0x10
[ 2169.068480]  ? security_file_permission+0xb5/0xe0
[ 2169.069221]  do_iter_read+0x2fb/0x750
[ 2169.069808]  ? import_iovec+0x87/0xb0
[ 2169.070376]  vfs_readv+0xe5/0x160
[ 2169.070911]  ? __pfx_vfs_readv+0x10/0x10
[ 2169.071560]  ? lock_release+0x3b6/0x750
[ 2169.072147]  ? __fget_files+0x24e/0x450
[ 2169.072762]  ? syscall_enter_from_user_mode+0x1c/0x50
[ 2169.073516]  ? __fget_files+0x270/0x450
[ 2169.074127]  __x64_sys_preadv+0x233/0x310
[ 2169.074736]  ? __pfx___x64_sys_preadv+0x10/0x10
[ 2169.075408]  ? syscall_enter_from_user_mode+0x21/0x50
[ 2169.076145]  ? syscall_enter_from_user_mode+0x21/0x50
[ 2169.076908]  do_syscall_64+0x3f/0x90
[ 2169.077465]  entry_SYSCALL_64_after_hwframe+0x72/0xdc
[ 2169.078208] RIP: 0033:0x7fee82b12b19
[ 2169.078745] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
[ 2169.081217] RSP: 002b:00007fee80088188 EFLAGS: 00000246 ORIG_RAX: 0000000000000127
[ 2169.082267] RAX: ffffffffffffffda RBX: 00007fee82c25f60 RCX: 00007fee82b12b19
[ 2169.083263] RDX: 0000000000000001 RSI: 0000000020000100 RDI: 0000000000000005
[ 2169.084251] RBP: 00007fee800881d0 R08: 0000000000000000 R09: 0000000000000000
[ 2169.085251] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
[ 2169.086248] R13: 00007ffeca18172f R14: 00007fee80088300 R15: 0000000000022000
[ 2169.087270]  </TASK>
00:07:59 executing program 1:
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}}, 0x0, 0x6, 0xffffffffffffffff, 0xb)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
r1 = gettid()
rt_sigqueueinfo(0x0, 0x0, 0x0)
r2 = pidfd_getfd(0xffffffffffffffff, r0, 0x0)
perf_event_open(&(0x7f0000000040)={0x5, 0x80, 0x40, 0x71, 0x2, 0x0, 0x0, 0x8000, 0x20, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, @perf_config_ext={0xff}, 0x0, 0x9b5, 0xfa, 0xd, 0x0, 0x8000, 0x55, 0x0, 0x0, 0x0, 0x3ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000400)={0x2, 0x80, 0x2a, 0x81, 0xe0, 0x40, 0x0, 0x63c5ef1c, 0x80, 0x3, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x7, 0x2, @perf_config_ext={0xf2, 0x6}, 0x0, 0x5, 0xfffffff8, 0x0, 0x1, 0x0, 0x1b6, 0x0, 0x6}, 0x0, 0xd, 0xffffffffffffffff, 0x0)
rt_sigqueueinfo(0x0, 0x0, &(0x7f0000000000))
setsockopt$sock_timeval(r0, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10)
bind$packet(r2, &(0x7f00000000c0)={0x11, 0xfe, 0x0, 0x1, 0xfb, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}}, 0x14)
perf_event_open(&(0x7f0000000100)={0x0, 0x80, 0xff, 0x0, 0x4, 0x1, 0x0, 0x4, 0x684, 0x4, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0xdbc, 0x0, @perf_config_ext={0xd03, 0x80000000}, 0x800, 0x3, 0x3, 0x5, 0x300000000000000, 0x7, 0x7ff, 0x0, 0x0, 0x0, 0x5}, r1, 0x10, 0xffffffffffffffff, 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r3, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
openat(r3, &(0x7f0000000180)='\x00', 0x400040, 0x80)
rt_sigqueueinfo(0x0, 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f0000000240)={'ip6_vti0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x4, 0x0, 0x7f, 0x40, 0xb, @local, @mcast1, 0x88, 0x20, 0x8, 0x2}})

00:07:59 executing program 2:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684f"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x100d}], 0x1, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x0, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

[ 2169.113876] loop3: detected capacity change from 0 to 40
[ 2169.157722] syz-executor.5: attempt to access beyond end of device
[ 2169.157722] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2169.158647] Buffer I/O error on dev loop5, logical block 10, lost async page write
[ 2169.165956] syz-executor.4: attempt to access beyond end of device
[ 2169.165956] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2169.166877] Buffer I/O error on dev loop4, logical block 10, lost async page write
00:07:59 executing program 6:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 1)

00:07:59 executing program 5:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 3)

00:07:59 executing program 4:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_mount_image$tmpfs(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 3)

00:07:59 executing program 3:
syz_mount_image$vfat(0x0, &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r0, &(0x7f0000001180)=ANY=[], 0x220)

00:07:59 executing program 0:
perf_event_open(&(0x7f0000000080)={0x0, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r1, &(0x7f0000000100), 0x0, 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r0, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r2, 0x2, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0x0, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r1, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:07:59 executing program 1:
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}}, 0x0, 0x6, 0xffffffffffffffff, 0xb)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
r1 = gettid()
rt_sigqueueinfo(0x0, 0x0, 0x0)
r2 = pidfd_getfd(0xffffffffffffffff, r0, 0x0)
perf_event_open(&(0x7f0000000040)={0x5, 0x80, 0x40, 0x71, 0x2, 0x0, 0x0, 0x8000, 0x20, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, @perf_config_ext={0xff}, 0x0, 0x9b5, 0xfa, 0xd, 0x0, 0x8000, 0x55, 0x0, 0x0, 0x0, 0x3ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000400)={0x2, 0x80, 0x2a, 0x81, 0xe0, 0x40, 0x0, 0x63c5ef1c, 0x80, 0x3, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x7, 0x2, @perf_config_ext={0xf2, 0x6}, 0x0, 0x5, 0xfffffff8, 0x0, 0x1, 0x0, 0x1b6, 0x0, 0x6}, 0x0, 0xd, 0xffffffffffffffff, 0x0)
rt_sigqueueinfo(0x0, 0x0, &(0x7f0000000000))
setsockopt$sock_timeval(r0, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10)
bind$packet(r2, &(0x7f00000000c0)={0x11, 0xfe, 0x0, 0x1, 0xfb, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}}, 0x14)
perf_event_open(&(0x7f0000000100)={0x0, 0x80, 0xff, 0x0, 0x4, 0x1, 0x0, 0x4, 0x684, 0x4, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0xdbc, 0x0, @perf_config_ext={0xd03, 0x80000000}, 0x800, 0x3, 0x3, 0x5, 0x300000000000000, 0x7, 0x7ff, 0x0, 0x0, 0x0, 0x5}, r1, 0x10, 0xffffffffffffffff, 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r3, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
openat(r3, &(0x7f0000000180)='\x00', 0x400040, 0x80)
rt_sigqueueinfo(0x0, 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f0000000240)={'ip6_vti0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x4, 0x0, 0x7f, 0x40, 0xb, @local, @mcast1, 0x88, 0x20, 0x8, 0x2}})

[ 2169.345474] loop5: detected capacity change from 0 to 40
[ 2169.347589] loop6: detected capacity change from 0 to 40
[ 2169.363381] loop3: detected capacity change from 0 to 40
[ 2169.367970] loop4: detected capacity change from 0 to 40
[ 2169.376389] FAULT_INJECTION: forcing a failure.
[ 2169.376389] name failslab, interval 1, probability 0, space 0, times 0
[ 2169.377202] CPU: 1 PID: 11927 Comm: syz-executor.5 Not tainted 6.1.0-rc8-next-20221208 #1
[ 2169.377761] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
[ 2169.378319] Call Trace:
[ 2169.378502]  <TASK>
[ 2169.378667]  dump_stack_lvl+0x8f/0xb7
[ 2169.378951]  should_fail_ex.cold+0x5/0xa
[ 2169.379257]  should_failslab+0x9/0x20
[ 2169.379536]  __kmem_cache_alloc_node+0x5b/0x400
[ 2169.379871]  ? alloc_pipe_info+0x1e4/0x590
[ 2169.380185]  ? alloc_pipe_info+0x1e4/0x590
[ 2169.380490]  __kmalloc+0x46/0xc0
[ 2169.380759]  alloc_pipe_info+0x1e4/0x590
[ 2169.381062]  splice_direct_to_actor+0x6e6/0x8c0
[ 2169.381409]  ? __pfx_direct_splice_actor+0x10/0x10
[ 2169.381759]  ? inode_security+0x105/0x140
[ 2169.382072]  ? avc_policy_seqno+0xd/0x70
[ 2169.382364]  ? selinux_file_permission+0x3a/0x510
[ 2169.382717]  ? __pfx_splice_direct_to_actor+0x10/0x10
[ 2169.383088]  ? security_file_permission+0xb5/0xe0
[ 2169.383441]  do_splice_direct+0x1bc/0x290
[ 2169.383742]  ? __pfx_do_splice_direct+0x10/0x10
[ 2169.384084]  ? lock_is_held_type+0xdb/0x130
[ 2169.384407]  do_sendfile+0xb1d/0x1280
[ 2169.384715]  ? __pfx_do_sendfile+0x10/0x10
[ 2169.385035]  ? lock_is_held_type+0xdb/0x130
[ 2169.385372]  __x64_sys_sendfile64+0x248/0x2a0
[ 2169.385717]  ? trace_rcu_dyntick+0x1a7/0x250
[ 2169.386067]  ? __pfx___x64_sys_sendfile64+0x10/0x10
[ 2169.386437]  ? syscall_enter_from_user_mode+0x21/0x50
[ 2169.386821]  ? syscall_enter_from_user_mode+0x21/0x50
[ 2169.387220]  do_syscall_64+0x3f/0x90
[ 2169.387507]  entry_SYSCALL_64_after_hwframe+0x72/0xdc
[ 2169.387892] RIP: 0033:0x7f5e74c67b19
[ 2169.388168] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
[ 2169.389477] RSP: 002b:00007f5e721dd188 EFLAGS: 00000246 ORIG_RAX: 0000000000000028
[ 2169.390027] RAX: ffffffffffffffda RBX: 00007f5e74d7af60 RCX: 00007f5e74c67b19
[ 2169.390555] RDX: 0000000000000000 RSI: 0000000000000003 RDI: 0000000000000004
[ 2169.391078] RBP: 00007f5e721dd1d0 R08: 0000000000000000 R09: 0000000000000000
[ 2169.391596] R10: 00000000fffffdef R11: 0000000000000246 R12: 0000000000000001
[ 2169.392123] R13: 00007ffd3dbd647f R14: 00007f5e721dd300 R15: 0000000000022000
[ 2169.392648]  </TASK>
[ 2169.412763] FAULT_INJECTION: forcing a failure.
[ 2169.412763] name failslab, interval 1, probability 0, space 0, times 0
[ 2169.413583] CPU: 1 PID: 11930 Comm: syz-executor.4 Not tainted 6.1.0-rc8-next-20221208 #1
[ 2169.414141] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
[ 2169.414689] Call Trace:
[ 2169.414887]  <TASK>
[ 2169.415051]  dump_stack_lvl+0x8f/0xb7
[ 2169.415336]  should_fail_ex.cold+0x5/0xa
[ 2169.415637]  should_failslab+0x9/0x20
[ 2169.415915]  __kmem_cache_alloc_node+0x5b/0x400
[ 2169.416245]  ? alloc_pipe_info+0x1e4/0x590
[ 2169.416563]  ? alloc_pipe_info+0x1e4/0x590
[ 2169.416880]  __kmalloc+0x46/0xc0
[ 2169.417141]  alloc_pipe_info+0x1e4/0x590
[ 2169.417441]  splice_direct_to_actor+0x6e6/0x8c0
[ 2169.417778]  ? __pfx_direct_splice_actor+0x10/0x10
[ 2169.418122]  ? inode_security+0x105/0x140
[ 2169.418423]  ? avc_policy_seqno+0xd/0x70
[ 2169.418847]  ? selinux_file_permission+0x3a/0x510
[ 2169.419229]  ? __pfx_splice_direct_to_actor+0x10/0x10
[ 2169.419592]  ? security_file_permission+0xb5/0xe0
[ 2169.419939]  do_splice_direct+0x1bc/0x290
[ 2169.420236]  ? __pfx_do_splice_direct+0x10/0x10
[ 2169.420574]  ? lock_is_held_type+0xdb/0x130
[ 2169.420909]  do_sendfile+0xb1d/0x1280
[ 2169.421200]  ? __pfx_do_sendfile+0x10/0x10
[ 2169.421347] FAULT_INJECTION: forcing a failure.
[ 2169.421347] name failslab, interval 1, probability 0, space 0, times 0
[ 2169.421507]  ? lock_is_held_type+0xdb/0x130
[ 2169.423282]  __x64_sys_sendfile64+0x248/0x2a0
[ 2169.423617]  ? trace_rcu_dyntick+0x1a7/0x250
[ 2169.423961]  ? __pfx___x64_sys_sendfile64+0x10/0x10
[ 2169.424328]  ? syscall_enter_from_user_mode+0x21/0x50
[ 2169.424717]  ? syscall_enter_from_user_mode+0x21/0x50
[ 2169.425098]  do_syscall_64+0x3f/0x90
[ 2169.425387]  entry_SYSCALL_64_after_hwframe+0x72/0xdc
[ 2169.425780] RIP: 0033:0x7f5dbe2acb19
[ 2169.426058] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
[ 2169.427349] RSP: 002b:00007f5dbb822188 EFLAGS: 00000246 ORIG_RAX: 0000000000000028
[ 2169.427901] RAX: ffffffffffffffda RBX: 00007f5dbe3bff60 RCX: 00007f5dbe2acb19
[ 2169.428417] RDX: 0000000000000000 RSI: 0000000000000003 RDI: 0000000000000004
[ 2169.428938] RBP: 00007f5dbb8221d0 R08: 0000000000000000 R09: 0000000000000000
[ 2169.429456] R10: 00000000fffffdef R11: 0000000000000246 R12: 0000000000000001
[ 2169.429964] R13: 00007ffc7a53101f R14: 00007f5dbb822300 R15: 0000000000022000
[ 2169.430499]  </TASK>
[ 2169.430679] CPU: 0 PID: 11925 Comm: syz-executor.6 Not tainted 6.1.0-rc8-next-20221208 #1
[ 2169.431808] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
[ 2169.432938] Call Trace:
[ 2169.433316]  <TASK>
[ 2169.433657]  dump_stack_lvl+0x8f/0xb7
[ 2169.434222]  should_fail_ex.cold+0x5/0xa
[ 2169.434841]  should_failslab+0x9/0x20
[ 2169.435415]  __kmem_cache_alloc_node+0x5b/0x400
[ 2169.436087]  ? alloc_pipe_info+0x109/0x590
[ 2169.436735]  kmalloc_trace+0x26/0x60
[ 2169.437289]  alloc_pipe_info+0x109/0x590
[ 2169.437909]  splice_direct_to_actor+0x6e6/0x8c0
00:08:00 executing program 7:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684fd2981c8409820000080000000000000000"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x100d}], 0x1, 0x0, 0x0) (fail_nth: 3)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

[ 2169.438593]  ? __pfx_direct_splice_actor+0x10/0x10
[ 2169.439429]  ? inode_security+0x105/0x140
[ 2169.440032]  ? avc_policy_seqno+0xd/0x70
[ 2169.440610]  ? selinux_file_permission+0x3a/0x510
[ 2169.441327]  ? __pfx_splice_direct_to_actor+0x10/0x10
[ 2169.442046]  ? security_file_permission+0xb5/0xe0
[ 2169.442739]  do_splice_direct+0x1bc/0x290
[ 2169.443331]  ? __pfx_do_splice_direct+0x10/0x10
[ 2169.444013]  ? lock_is_held_type+0xdb/0x130
[ 2169.444646]  do_sendfile+0xb1d/0x1280
[ 2169.445245]  ? __pfx_do_sendfile+0x10/0x10
[ 2169.445867]  ? lock_is_held_type+0xdb/0x130
[ 2169.446500]  __x64_sys_sendfile64+0x248/0x2a0
[ 2169.447132]  ? trace_rcu_dyntick+0x1a7/0x250
[ 2169.447786]  ? __pfx___x64_sys_sendfile64+0x10/0x10
[ 2169.448482]  ? syscall_enter_from_user_mode+0x21/0x50
[ 2169.449235]  ? syscall_enter_from_user_mode+0x21/0x50
[ 2169.449961]  do_syscall_64+0x3f/0x90
[ 2169.450502]  entry_SYSCALL_64_after_hwframe+0x72/0xdc
[ 2169.451210] RIP: 0033:0x7f3186383b19
[ 2169.451735] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
[ 2169.454134] RSP: 002b:00007f31838f9188 EFLAGS: 00000246 ORIG_RAX: 0000000000000028
[ 2169.455164] RAX: ffffffffffffffda RBX: 00007f3186496f60 RCX: 00007f3186383b19
[ 2169.456128] RDX: 0000000000000000 RSI: 0000000000000003 RDI: 0000000000000004
[ 2169.457091] RBP: 00007f31838f91d0 R08: 0000000000000000 R09: 0000000000000000
[ 2169.458050] R10: 00000000fffffdef R11: 0000000000000246 R12: 0000000000000001
[ 2169.459008] R13: 00007ffc1396bf2f R14: 00007f31838f9300 R15: 0000000000022000
[ 2169.459999]  </TASK>
00:08:00 executing program 2:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684f"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x100d}], 0x1, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x0, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:08:00 executing program 5:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 4)

00:08:00 executing program 4:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_mount_image$tmpfs(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 4)

00:08:00 executing program 3:
syz_mount_image$vfat(&(0x7f0000000000), 0x0, 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r0, &(0x7f0000001180)=ANY=[], 0x220)

00:08:00 executing program 2:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684f"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r1, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x100d}], 0x1, 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(0xffffffffffffffff, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r2, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r1, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

[ 2169.648858] loop5: detected capacity change from 0 to 40
00:08:00 executing program 0:
perf_event_open(&(0x7f0000000080)={0x0, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r1, &(0x7f0000000100), 0x0, 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r0, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r2, 0x3, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0x0, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r1, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

[ 2169.676486] loop4: detected capacity change from 0 to 40
[ 2169.717489] syz-executor.5: attempt to access beyond end of device
[ 2169.717489] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2169.718577] Buffer I/O error on dev loop5, logical block 10, lost async page write
[ 2169.727136] loop3: detected capacity change from 0 to 40
[ 2169.806763] syz-executor.4: attempt to access beyond end of device
[ 2169.806763] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2169.808737] Buffer I/O error on dev loop4, logical block 10, lost async page write
00:08:16 executing program 6:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 2)

00:08:16 executing program 2:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684f"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r1, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x100d}], 0x1, 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(0xffffffffffffffff, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r2, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r1, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:08:16 executing program 5:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 5)

00:08:16 executing program 0:
perf_event_open(&(0x7f0000000080)={0x0, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r1, &(0x7f0000000100), 0x0, 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r0, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r2, 0x4, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0x0, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r1, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:08:16 executing program 7:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684fd2981c8409820000080000000000000000"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x100d}], 0x1, 0x0, 0x0) (fail_nth: 4)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:08:16 executing program 1:
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}}, 0x0, 0x6, 0xffffffffffffffff, 0xb)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
r1 = gettid()
rt_sigqueueinfo(0x0, 0x0, 0x0)
r2 = pidfd_getfd(0xffffffffffffffff, r0, 0x0)
perf_event_open(&(0x7f0000000040)={0x5, 0x80, 0x40, 0x71, 0x2, 0x0, 0x0, 0x8000, 0x20, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, @perf_config_ext={0xff}, 0x0, 0x9b5, 0xfa, 0xd, 0x0, 0x8000, 0x55, 0x0, 0x0, 0x0, 0x3ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000400)={0x2, 0x80, 0x2a, 0x81, 0xe0, 0x40, 0x0, 0x63c5ef1c, 0x80, 0x3, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x7, 0x2, @perf_config_ext={0xf2, 0x6}, 0x0, 0x5, 0xfffffff8, 0x0, 0x1, 0x0, 0x1b6, 0x0, 0x6}, 0x0, 0xd, 0xffffffffffffffff, 0x0)
rt_sigqueueinfo(0x0, 0x0, &(0x7f0000000000))
setsockopt$sock_timeval(r0, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10)
bind$packet(r2, &(0x7f00000000c0)={0x11, 0xfe, 0x0, 0x1, 0xfb, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}}, 0x14)
perf_event_open(&(0x7f0000000100)={0x0, 0x80, 0xff, 0x0, 0x4, 0x1, 0x0, 0x4, 0x684, 0x4, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0xdbc, 0x0, @perf_config_ext={0xd03, 0x80000000}, 0x800, 0x3, 0x3, 0x5, 0x300000000000000, 0x7, 0x7ff, 0x0, 0x0, 0x0, 0x5}, r1, 0x10, 0xffffffffffffffff, 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r3, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
openat(r3, &(0x7f0000000180)='\x00', 0x400040, 0x80)
rt_sigqueueinfo(0x0, 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f0000000240)={'ip6_vti0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x4, 0x0, 0x7f, 0x40, 0xb, @local, @mcast1, 0x88, 0x20, 0x8, 0x2}})

[ 2186.053448] loop6: detected capacity change from 0 to 40
[ 2186.073757] loop5: detected capacity change from 0 to 40
[ 2186.080437] FAULT_INJECTION: forcing a failure.
[ 2186.080437] name fail_usercopy, interval 1, probability 0, space 0, times 0
[ 2186.081725] CPU: 1 PID: 11966 Comm: syz-executor.7 Not tainted 6.1.0-rc8-next-20221208 #1
[ 2186.082422] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
[ 2186.083008] Call Trace:
[ 2186.083202]  <TASK>
[ 2186.083373]  dump_stack_lvl+0x8f/0xb7
[ 2186.083679]  should_fail_ex.cold+0x5/0xa
[ 2186.084000]  _copy_to_iter+0x6cc/0x13e0
[ 2186.084302]  ? find_held_lock+0x2c/0x110
[ 2186.084605]  ? __pfx__copy_to_iter+0x10/0x10
[ 2186.084943]  ? lock_release+0x3b6/0x750
[ 2186.085234]  ? seq_read_iter+0xd51/0x12b0
[ 2186.085539]  ? __pfx_lock_release+0x10/0x10
[ 2186.085851]  ? __pfx_from_kuid+0x10/0x10
[ 2186.086157]  ? __virt_addr_valid+0x102/0x340
[ 2186.086465]  ? __check_object_size+0x384/0x700
[ 2186.086809]  seq_read_iter+0xdcf/0x12b0
[ 2186.087108]  proc_reg_read_iter+0x20e/0x2e0
[ 2186.087434]  do_iter_readv_writev+0x2f0/0x3c0
[ 2186.087766]  ? __pfx_do_iter_readv_writev+0x10/0x10
[ 2186.088138]  ? security_file_permission+0xb5/0xe0
[ 2186.088493]  do_iter_read+0x2fb/0x750
[ 2186.088770]  ? import_iovec+0x87/0xb0
[ 2186.089059]  vfs_readv+0xe5/0x160
[ 2186.089320]  ? __pfx_vfs_readv+0x10/0x10
[ 2186.089617]  ? lock_release+0x3b6/0x750
[ 2186.089917]  ? __fget_files+0x24e/0x450
[ 2186.090237]  ? __fget_files+0x270/0x450
[ 2186.090545]  __x64_sys_preadv+0x233/0x310
[ 2186.090850]  ? __pfx___x64_sys_preadv+0x10/0x10
[ 2186.091189]  ? __pfx___x64_sys_preadv+0x10/0x10
[ 2186.091540]  do_syscall_64+0x3f/0x90
[ 2186.091795]  entry_SYSCALL_64_after_hwframe+0x72/0xdc
[ 2186.092172] RIP: 0033:0x7fee82b12b19
[ 2186.092449] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
[ 2186.093716] RSP: 002b:00007fee80088188 EFLAGS: 00000246 ORIG_RAX: 0000000000000127
[ 2186.094260] RAX: ffffffffffffffda RBX: 00007fee82c25f60 RCX: 00007fee82b12b19
[ 2186.094777] RDX: 0000000000000001 RSI: 0000000020000100 RDI: 0000000000000005
[ 2186.095277] RBP: 00007fee800881d0 R08: 0000000000000000 R09: 0000000000000000
[ 2186.095793] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
[ 2186.096302] R13: 00007ffeca18172f R14: 00007fee80088300 R15: 0000000000022000
[ 2186.096821]  </TASK>
00:08:16 executing program 4:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_mount_image$tmpfs(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 5)

[ 2186.132822] syz-executor.6: attempt to access beyond end of device
[ 2186.132822] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2186.133764] Buffer I/O error on dev loop6, logical block 10, lost async page write
[ 2186.161359] loop4: detected capacity change from 0 to 40
00:08:16 executing program 3:
syz_mount_image$vfat(&(0x7f0000000000), 0x0, 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r0, &(0x7f0000001180)=ANY=[], 0x220)

00:08:16 executing program 6:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 3)

[ 2186.176516] FAULT_INJECTION: forcing a failure.
[ 2186.176516] name failslab, interval 1, probability 0, space 0, times 0
[ 2186.178131] CPU: 0 PID: 11967 Comm: syz-executor.5 Not tainted 6.1.0-rc8-next-20221208 #1
[ 2186.179250] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
[ 2186.180322] Call Trace:
[ 2186.180687]  <TASK>
[ 2186.181021]  dump_stack_lvl+0x8f/0xb7
[ 2186.181570]  should_fail_ex.cold+0x5/0xa
[ 2186.182157]  should_failslab+0x9/0x20
[ 2186.182702]  __kmem_cache_alloc_node+0x5b/0x400
[ 2186.183371]  ? iter_file_splice_write+0x169/0xcb0
[ 2186.184052]  ? iter_file_splice_write+0x169/0xcb0
[ 2186.184716]  __kmalloc+0x46/0xc0
[ 2186.185239]  iter_file_splice_write+0x169/0xcb0
[ 2186.185889]  ? generic_file_read_iter+0x330/0x550
[ 2186.186617]  ? generic_file_splice_read+0x1bc/0x4d0
[ 2186.187334]  ? __pfx_iter_file_splice_write+0x10/0x10
[ 2186.188053]  ? __pfx_generic_file_splice_read+0x10/0x10
[ 2186.188818]  ? inode_security+0x105/0x140
[ 2186.189465]  ? security_file_permission+0xb5/0xe0
[ 2186.190166]  ? __pfx_iter_file_splice_write+0x10/0x10
[ 2186.190910]  direct_splice_actor+0x113/0x180
[ 2186.191554]  splice_direct_to_actor+0x33a/0x8c0
[ 2186.192232]  ? __pfx_direct_splice_actor+0x10/0x10
[ 2186.192952]  ? __pfx_splice_direct_to_actor+0x10/0x10
[ 2186.193693]  ? security_file_permission+0xb5/0xe0
[ 2186.194399]  do_splice_direct+0x1bc/0x290
[ 2186.195002]  ? __pfx_do_splice_direct+0x10/0x10
[ 2186.195680]  ? lock_is_held_type+0xdb/0x130
[ 2186.196329]  do_sendfile+0xb1d/0x1280
[ 2186.196940]  ? __pfx_do_sendfile+0x10/0x10
[ 2186.197584]  ? lock_is_held_type+0xdb/0x130
[ 2186.198225]  __x64_sys_sendfile64+0x248/0x2a0
[ 2186.198880]  ? trace_rcu_dyntick+0x1a7/0x250
[ 2186.199535]  ? __pfx___x64_sys_sendfile64+0x10/0x10
[ 2186.200215]  ? syscall_enter_from_user_mode+0x21/0x50
[ 2186.200958]  ? syscall_enter_from_user_mode+0x21/0x50
[ 2186.201709]  do_syscall_64+0x3f/0x90
[ 2186.202256]  entry_SYSCALL_64_after_hwframe+0x72/0xdc
[ 2186.202987] RIP: 0033:0x7f5e74c67b19
[ 2186.203523] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
[ 2186.206001] RSP: 002b:00007f5e721dd188 EFLAGS: 00000246 ORIG_RAX: 0000000000000028
[ 2186.207063] RAX: ffffffffffffffda RBX: 00007f5e74d7af60 RCX: 00007f5e74c67b19
[ 2186.208048] RDX: 0000000000000000 RSI: 0000000000000003 RDI: 0000000000000004
[ 2186.209039] RBP: 00007f5e721dd1d0 R08: 0000000000000000 R09: 0000000000000000
[ 2186.210023] R10: 00000000fffffdef R11: 0000000000000246 R12: 0000000000000001
[ 2186.211012] R13: 00007ffd3dbd647f R14: 00007f5e721dd300 R15: 0000000000022000
[ 2186.212036]  </TASK>
[ 2186.225944] FAULT_INJECTION: forcing a failure.
[ 2186.225944] name failslab, interval 1, probability 0, space 0, times 0
[ 2186.226802] CPU: 1 PID: 11975 Comm: syz-executor.4 Not tainted 6.1.0-rc8-next-20221208 #1
[ 2186.227328] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
[ 2186.227848] Call Trace:
[ 2186.228044]  <TASK>
[ 2186.228201]  dump_stack_lvl+0x8f/0xb7
[ 2186.228470]  should_fail_ex.cold+0x5/0xa
[ 2186.228754]  should_failslab+0x9/0x20
[ 2186.229034]  __kmem_cache_alloc_node+0x5b/0x400
[ 2186.229347]  ? iter_file_splice_write+0x169/0xcb0
[ 2186.229681]  ? iter_file_splice_write+0x169/0xcb0
[ 2186.230001]  __kmalloc+0x46/0xc0
[ 2186.230240]  iter_file_splice_write+0x169/0xcb0
[ 2186.230555]  ? generic_file_read_iter+0x330/0x550
[ 2186.230894]  ? generic_file_splice_read+0x1bc/0x4d0
[ 2186.231226]  ? __pfx_iter_file_splice_write+0x10/0x10
[ 2186.231588]  ? __pfx_generic_file_splice_read+0x10/0x10
[ 2186.231954]  ? inode_security+0x105/0x140
[ 2186.232250]  ? security_file_permission+0xb5/0xe0
[ 2186.232577]  ? __pfx_iter_file_splice_write+0x10/0x10
[ 2186.232947]  direct_splice_actor+0x113/0x180
[ 2186.233253]  splice_direct_to_actor+0x33a/0x8c0
[ 2186.233567]  ? __pfx_direct_splice_actor+0x10/0x10
[ 2186.233900]  ? __pfx_splice_direct_to_actor+0x10/0x10
[ 2186.234259]  ? security_file_permission+0xb5/0xe0
[ 2186.234589]  do_splice_direct+0x1bc/0x290
[ 2186.234887]  ? __pfx_do_splice_direct+0x10/0x10
[ 2186.235226]  ? lock_is_held_type+0xdb/0x130
[ 2186.235528]  do_sendfile+0xb1d/0x1280
[ 2186.235823]  ? __pfx_do_sendfile+0x10/0x10
[ 2186.236127]  ? lock_is_held_type+0xdb/0x130
[ 2186.236443]  __x64_sys_sendfile64+0x248/0x2a0
[ 2186.236746]  ? trace_rcu_dyntick+0x1a7/0x250
[ 2186.237079]  ? __pfx___x64_sys_sendfile64+0x10/0x10
[ 2186.237409]  ? syscall_enter_from_user_mode+0x21/0x50
[ 2186.237769]  ? syscall_enter_from_user_mode+0x21/0x50
[ 2186.238118]  do_syscall_64+0x3f/0x90
[ 2186.238389]  entry_SYSCALL_64_after_hwframe+0x72/0xdc
[ 2186.238737] RIP: 0033:0x7f5dbe2acb19
[ 2186.239000] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
[ 2186.240124] RSP: 002b:00007f5dbb822188 EFLAGS: 00000246 ORIG_RAX: 0000000000000028
[ 2186.240638] RAX: ffffffffffffffda RBX: 00007f5dbe3bff60 RCX: 00007f5dbe2acb19
[ 2186.241110] RDX: 0000000000000000 RSI: 0000000000000003 RDI: 0000000000000004
[ 2186.241559] RBP: 00007f5dbb8221d0 R08: 0000000000000000 R09: 0000000000000000
[ 2186.242008] R10: 00000000fffffdef R11: 0000000000000246 R12: 0000000000000001
[ 2186.242461] R13: 00007ffc7a53101f R14: 00007f5dbb822300 R15: 0000000000022000
[ 2186.242930]  </TASK>
[ 2186.251433] loop3: detected capacity change from 0 to 40
[ 2186.260702] loop6: detected capacity change from 0 to 40
00:08:16 executing program 0:
perf_event_open(&(0x7f0000000080)={0x0, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r1, &(0x7f0000000100), 0x0, 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r0, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r2, 0x5, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0x0, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r1, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

[ 2186.291632] FAULT_INJECTION: forcing a failure.
[ 2186.291632] name failslab, interval 1, probability 0, space 0, times 0
[ 2186.292423] CPU: 1 PID: 11981 Comm: syz-executor.6 Not tainted 6.1.0-rc8-next-20221208 #1
[ 2186.292959] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
[ 2186.293474] Call Trace:
[ 2186.293646]  <TASK>
[ 2186.293802]  dump_stack_lvl+0x8f/0xb7
[ 2186.294070]  should_fail_ex.cold+0x5/0xa
[ 2186.294358]  should_failslab+0x9/0x20
[ 2186.294621]  __kmem_cache_alloc_node+0x5b/0x400
[ 2186.294937]  ? alloc_pipe_info+0x1e4/0x590
[ 2186.295242]  ? alloc_pipe_info+0x1e4/0x590
[ 2186.295532]  __kmalloc+0x46/0xc0
[ 2186.295774]  alloc_pipe_info+0x1e4/0x590
[ 2186.296059]  splice_direct_to_actor+0x6e6/0x8c0
[ 2186.296372]  ? __pfx_direct_splice_actor+0x10/0x10
[ 2186.296697]  ? inode_security+0x105/0x140
[ 2186.296992]  ? avc_policy_seqno+0xd/0x70
[ 2186.297270]  ? selinux_file_permission+0x3a/0x510
[ 2186.297597]  ? __pfx_splice_direct_to_actor+0x10/0x10
[ 2186.297938]  ? security_file_permission+0xb5/0xe0
[ 2186.298267]  do_splice_direct+0x1bc/0x290
[ 2186.298545]  ? __pfx_do_splice_direct+0x10/0x10
[ 2186.298865]  ? lock_is_held_type+0xdb/0x130
[ 2186.299169]  do_sendfile+0xb1d/0x1280
[ 2186.299444]  ? __pfx_do_sendfile+0x10/0x10
[ 2186.299744]  ? lock_is_held_type+0xdb/0x130
[ 2186.300041]  __x64_sys_sendfile64+0x248/0x2a0
[ 2186.300343]  ? trace_rcu_dyntick+0x1a7/0x250
[ 2186.300651]  ? __pfx___x64_sys_sendfile64+0x10/0x10
[ 2186.300998]  ? syscall_enter_from_user_mode+0x21/0x50
[ 2186.301338]  ? syscall_enter_from_user_mode+0x21/0x50
[ 2186.301680]  do_syscall_64+0x3f/0x90
[ 2186.301933]  entry_SYSCALL_64_after_hwframe+0x72/0xdc
[ 2186.302277] RIP: 0033:0x7f3186383b19
[ 2186.302522] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
[ 2186.303645] RSP: 002b:00007f31838f9188 EFLAGS: 00000246 ORIG_RAX: 0000000000000028
[ 2186.304130] RAX: ffffffffffffffda RBX: 00007f3186496f60 RCX: 00007f3186383b19
[ 2186.304586] RDX: 0000000000000000 RSI: 0000000000000003 RDI: 0000000000000004
[ 2186.305043] RBP: 00007f31838f91d0 R08: 0000000000000000 R09: 0000000000000000
[ 2186.305494] R10: 00000000fffffdef R11: 0000000000000246 R12: 0000000000000001
[ 2186.305944] R13: 00007ffc1396bf2f R14: 00007f31838f9300 R15: 0000000000022000
[ 2186.306410]  </TASK>
00:08:16 executing program 2:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684f"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r1, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x100d}], 0x1, 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(0xffffffffffffffff, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r2, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r1, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:08:16 executing program 7:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684fd2981c8409820000080000000000000000"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x100d}], 0x1, 0x0, 0x0) (fail_nth: 5)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:08:17 executing program 0:
perf_event_open(&(0x7f0000000080)={0x0, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r1, &(0x7f0000000100), 0x0, 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r0, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r2, 0x6, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0x0, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r1, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:08:17 executing program 6:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 4)

00:08:17 executing program 4:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_mount_image$tmpfs(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 6)

00:08:17 executing program 1:
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}}, 0x0, 0x6, 0xffffffffffffffff, 0xb)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
r1 = gettid()
rt_sigqueueinfo(0x0, 0x0, 0x0)
r2 = pidfd_getfd(0xffffffffffffffff, r0, 0x0)
perf_event_open(&(0x7f0000000040)={0x5, 0x80, 0x40, 0x71, 0x2, 0x0, 0x0, 0x8000, 0x20, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, @perf_config_ext={0xff}, 0x0, 0x9b5, 0xfa, 0xd, 0x0, 0x8000, 0x55, 0x0, 0x0, 0x0, 0x3ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000400)={0x2, 0x80, 0x2a, 0x81, 0xe0, 0x40, 0x0, 0x63c5ef1c, 0x80, 0x3, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x7, 0x2, @perf_config_ext={0xf2, 0x6}, 0x0, 0x5, 0xfffffff8, 0x0, 0x1, 0x0, 0x1b6, 0x0, 0x6}, 0x0, 0xd, 0xffffffffffffffff, 0x0)
rt_sigqueueinfo(0x0, 0x0, &(0x7f0000000000))
setsockopt$sock_timeval(r0, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10)
bind$packet(r2, &(0x7f00000000c0)={0x11, 0xfe, 0x0, 0x1, 0xfb, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}}, 0x14)
perf_event_open(&(0x7f0000000100)={0x0, 0x80, 0xff, 0x8, 0x0, 0x1, 0x0, 0x4, 0x684, 0x4, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0xdbc, 0x0, @perf_config_ext={0xd03, 0x80000000}, 0x800, 0x3, 0x3, 0x5, 0x300000000000000, 0x7, 0x7ff, 0x0, 0x0, 0x0, 0x5}, r1, 0x10, 0xffffffffffffffff, 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r3, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
openat(r3, &(0x7f0000000180)='\x00', 0x400040, 0x80)
rt_sigqueueinfo(0x0, 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f0000000240)={'ip6_vti0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x4, 0x0, 0x7f, 0x40, 0xb, @local, @mcast1, 0x88, 0x20, 0x8, 0x2}})

00:08:17 executing program 3:
syz_mount_image$vfat(&(0x7f0000000000), 0x0, 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r0, &(0x7f0000001180)=ANY=[], 0x220)

[ 2186.465290] loop6: detected capacity change from 0 to 40
[ 2186.517819] syz-executor.6: attempt to access beyond end of device
[ 2186.517819] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2186.518683] Buffer I/O error on dev loop6, logical block 10, lost async page write
[ 2186.530769] FAULT_INJECTION: forcing a failure.
[ 2186.530769] name fail_page_alloc, interval 1, probability 0, space 0, times 1
[ 2186.532034] CPU: 1 PID: 11991 Comm: syz-executor.7 Not tainted 6.1.0-rc8-next-20221208 #1
[ 2186.532615] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
[ 2186.533194] Call Trace:
[ 2186.533386]  <TASK>
[ 2186.533567]  dump_stack_lvl+0x8f/0xb7
[ 2186.533871]  should_fail_ex.cold+0x5/0xa
[ 2186.534181]  prepare_alloc_pages+0x178/0x500
[ 2186.534513]  ? __pfx___lock_acquire+0x10/0x10
[ 2186.534870]  __alloc_pages+0x149/0x500
[ 2186.535169]  ? __pfx___alloc_pages+0x10/0x10
[ 2186.535505]  ? __lock_acquire+0xbad/0x5e70
[ 2186.535835]  ? mark_lock.part.0+0xef/0x2f70
[ 2186.536160]  vma_alloc_folio+0xe2/0x480
[ 2186.536466]  __handle_mm_fault+0x1025/0x3640
[ 2186.536785]  ? lock_is_held_type+0xdb/0x130
[ 2186.537120]  ? __pfx___handle_mm_fault+0x10/0x10
[ 2186.537480]  ? handle_mm_fault+0x43d/0xae0
[ 2186.537814]  handle_mm_fault+0x2ce/0xae0
[ 2186.538124]  do_user_addr_fault+0x53a/0x1300
[ 2186.538475]  exc_page_fault+0x9c/0x1a0
[ 2186.538780]  asm_exc_page_fault+0x26/0x30
[ 2186.539091] RIP: 0010:copy_user_generic_string+0x30/0x50
[ 2186.539489] Code: cb 83 fa 08 72 27 89 f9 83 e1 07 74 15 83 e9 08 f7 d9 29 ca 8a 06 88 07 48 ff c6 48 ff c7 ff c9 75 f2 89 d1 c1 e9 03 83 e2 07 <f3> 48 a5 89 d1 f3 a4 31 c0 0f 01 ca e9 a3 b4 13 00 8d 0c ca 89 ca
[ 2186.540786] RSP: 0018:ffff8880403ef920 EFLAGS: 00050246
[ 2186.541194] RAX: 0000000000000001 RBX: 0000000000000a68 RCX: 000000000000014d
[ 2186.541713] RDX: 0000000000000000 RSI: ffff888046498000 RDI: 0000000020002240
[ 2186.542227] RBP: 0000000020002240 R08: 0000000000000000 R09: ffff888046498a67
[ 2186.542745] R10: ffffed1008c9314c R11: 0000000000000001 R12: ffff888046498000
[ 2186.543252] R13: 0000000020002240 R14: 00007fffffffe598 R15: ffff8880403efdb0
[ 2186.543782]  copyout.part.0+0x141/0x190
[ 2186.544095]  _copy_to_iter+0x5e9/0x13e0
[ 2186.544399]  ? find_held_lock+0x2c/0x110
[ 2186.544714]  ? __pfx__copy_to_iter+0x10/0x10
[ 2186.545062]  ? lock_release+0x3b6/0x750
[ 2186.545360]  ? seq_read_iter+0xd51/0x12b0
[ 2186.545684]  ? __pfx_lock_release+0x10/0x10
[ 2186.546001]  ? __pfx_from_kuid+0x10/0x10
[ 2186.546316]  ? __virt_addr_valid+0x102/0x340
[ 2186.546654]  ? __check_object_size+0x384/0x700
[ 2186.547008]  seq_read_iter+0xdcf/0x12b0
[ 2186.547323]  proc_reg_read_iter+0x20e/0x2e0
[ 2186.547669]  do_iter_readv_writev+0x2f0/0x3c0
[ 2186.548015]  ? __pfx_do_iter_readv_writev+0x10/0x10
[ 2186.548396]  ? security_file_permission+0xb5/0xe0
[ 2186.548755]  do_iter_read+0x2fb/0x750
[ 2186.549068]  ? import_iovec+0x87/0xb0
[ 2186.549366]  vfs_readv+0xe5/0x160
[ 2186.549653]  ? __pfx_vfs_readv+0x10/0x10
[ 2186.549962]  ? lock_release+0x3b6/0x750
[ 2186.550263]  ? __fget_files+0x24e/0x450
[ 2186.550579]  ? syscall_enter_from_user_mode+0x1c/0x50
[ 2186.550965]  ? __fget_files+0x270/0x450
[ 2186.551277]  __x64_sys_preadv+0x233/0x310
[ 2186.551593]  ? __pfx___x64_sys_preadv+0x10/0x10
[ 2186.551944]  ? syscall_enter_from_user_mode+0x21/0x50
[ 2186.552284]  ? syscall_enter_from_user_mode+0x21/0x50
[ 2186.552669]  do_syscall_64+0x3f/0x90
[ 2186.552943]  entry_SYSCALL_64_after_hwframe+0x72/0xdc
[ 2186.553320] RIP: 0033:0x7fee82b12b19
[ 2186.553614] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
[ 2186.554916] RSP: 002b:00007fee80088188 EFLAGS: 00000246 ORIG_RAX: 0000000000000127
[ 2186.555393] RAX: ffffffffffffffda RBX: 00007fee82c25f60 RCX: 00007fee82b12b19
[ 2186.555912] RDX: 0000000000000001 RSI: 0000000020000100 RDI: 0000000000000005
[ 2186.556422] RBP: 00007fee800881d0 R08: 0000000000000000 R09: 0000000000000000
[ 2186.556882] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
[ 2186.557348] R13: 00007ffeca18172f R14: 00007fee80088300 R15: 0000000000022000
[ 2186.557830]  </TASK>
[ 2186.576642] loop3: detected capacity change from 0 to 40
[ 2186.605185] loop4: detected capacity change from 0 to 40
[ 2186.690604] syz-executor.4: attempt to access beyond end of device
[ 2186.690604] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2186.691493] Buffer I/O error on dev loop4, logical block 10, lost async page write
00:08:35 executing program 5:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 6)

00:08:35 executing program 7:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684fd2981c8409820000080000000000000000"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x100d}], 0x1, 0x0, 0x0) (fail_nth: 6)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:08:35 executing program 3:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r0, &(0x7f0000001180)=ANY=[], 0x220)

00:08:35 executing program 0:
perf_event_open(&(0x7f0000000080)={0x0, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r1, &(0x7f0000000100), 0x0, 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r0, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r2, 0x8, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0x0, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r1, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:08:35 executing program 2:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684f"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x100d}], 0x1, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, 0x0, &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:08:35 executing program 6:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 5)

00:08:35 executing program 1:
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}}, 0x0, 0x6, 0xffffffffffffffff, 0xb)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
r1 = gettid()
rt_sigqueueinfo(0x0, 0x0, 0x0)
r2 = pidfd_getfd(0xffffffffffffffff, r0, 0x0)
perf_event_open(&(0x7f0000000040)={0x5, 0x80, 0x40, 0x71, 0x2, 0x0, 0x0, 0x8000, 0x20, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, @perf_config_ext={0xff}, 0x0, 0x9b5, 0xfa, 0xd, 0x0, 0x8000, 0x55, 0x0, 0x0, 0x0, 0x3ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000400)={0x2, 0x80, 0x2a, 0x81, 0xe0, 0x40, 0x0, 0x63c5ef1c, 0x80, 0x3, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x7, 0x2, @perf_config_ext={0xf2, 0x6}, 0x0, 0x5, 0xfffffff8, 0x0, 0x1, 0x0, 0x1b6, 0x0, 0x6}, 0x0, 0xd, 0xffffffffffffffff, 0x0)
rt_sigqueueinfo(0x0, 0x0, &(0x7f0000000000))
setsockopt$sock_timeval(r0, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10)
bind$packet(r2, &(0x7f00000000c0)={0x11, 0xfe, 0x0, 0x1, 0xfb, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}}, 0x14)
perf_event_open(&(0x7f0000000100)={0x0, 0x80, 0xff, 0x8, 0x0, 0x1, 0x0, 0x4, 0x684, 0x4, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0xdbc, 0x0, @perf_config_ext={0xd03, 0x80000000}, 0x800, 0x3, 0x3, 0x5, 0x300000000000000, 0x7, 0x7ff, 0x0, 0x0, 0x0, 0x5}, r1, 0x10, 0xffffffffffffffff, 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r3, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
openat(r3, &(0x7f0000000180)='\x00', 0x400040, 0x80)
rt_sigqueueinfo(0x0, 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f0000000240)={'ip6_vti0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x4, 0x0, 0x7f, 0x40, 0xb, @local, @mcast1, 0x88, 0x20, 0x8, 0x2}})

00:08:35 executing program 4:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_mount_image$tmpfs(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 7)

[ 2204.821981] loop5: detected capacity change from 0 to 40
[ 2204.839280] loop6: detected capacity change from 0 to 40
[ 2204.848146] loop4: detected capacity change from 0 to 40
[ 2204.888880] FAULT_INJECTION: forcing a failure.
[ 2204.888880] name fail_usercopy, interval 1, probability 0, space 0, times 0
[ 2204.891573] CPU: 1 PID: 12024 Comm: syz-executor.7 Not tainted 6.1.0-rc8-next-20221208 #1
[ 2204.892609] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
[ 2204.893656] Call Trace:
[ 2204.893994]  <TASK>
[ 2204.894296]  dump_stack_lvl+0x8f/0xb7
[ 2204.894810]  should_fail_ex.cold+0x5/0xa
[ 2204.895365]  _copy_to_user+0x30/0x1c0
[ 2204.895889]  simple_read_from_buffer+0xd0/0x170
[ 2204.896520]  proc_fail_nth_read+0x19c/0x230
[ 2204.897098]  ? __pfx_proc_fail_nth_read+0x10/0x10
[ 2204.897762]  ? security_file_permission+0xb5/0xe0
[ 2204.898399]  vfs_read+0x2e1/0x9f0
[ 2204.898882]  ? __pfx_proc_fail_nth_read+0x10/0x10
[ 2204.899537]  ? __pfx_vfs_read+0x10/0x10
[ 2204.900100]  ? __fget_files+0x270/0x450
[ 2204.900652]  ksys_read+0x12b/0x260
[ 2204.901173]  ? __pfx_ksys_read+0x10/0x10
[ 2204.901743]  ? syscall_enter_from_user_mode+0x21/0x50
[ 2204.902432]  ? syscall_enter_from_user_mode+0x21/0x50
[ 2204.903143]  do_syscall_64+0x3f/0x90
[ 2204.903660]  entry_SYSCALL_64_after_hwframe+0x72/0xdc
[ 2204.904370] RIP: 0033:0x7fee82ac569c
[ 2204.904879] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 f9 fc ff ff 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 2f fd ff ff 48
[ 2204.907238] RSP: 002b:00007fee80088170 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
[ 2204.908246] RAX: ffffffffffffffda RBX: 0000000000000a68 RCX: 00007fee82ac569c
[ 2204.909196] RDX: 000000000000000f RSI: 00007fee800881e0 RDI: 0000000000000006
[ 2204.910125] RBP: 00007fee800881d0 R08: 0000000000000000 R09: 0000000000000000
[ 2204.911073] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
[ 2204.912011] R13: 00007ffeca18172f R14: 00007fee80088300 R15: 0000000000022000
[ 2204.912981]  </TASK>
[ 2204.959672] FAULT_INJECTION: forcing a failure.
[ 2204.959672] name failslab, interval 1, probability 0, space 0, times 0
[ 2204.961234] CPU: 1 PID: 12023 Comm: syz-executor.6 Not tainted 6.1.0-rc8-next-20221208 #1
[ 2204.962263] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
[ 2204.963300] Call Trace:
[ 2204.963634]  <TASK>
[ 2204.963937]  dump_stack_lvl+0x8f/0xb7
[ 2204.964467]  should_fail_ex.cold+0x5/0xa
[ 2204.965011]  should_failslab+0x9/0x20
[ 2204.965540]  __kmem_cache_alloc_node+0x5b/0x400
[ 2204.966161]  ? iter_file_splice_write+0x169/0xcb0
[ 2204.966782]  ? iter_file_splice_write+0x169/0xcb0
[ 2204.967397]  __kmalloc+0x46/0xc0
[ 2204.967849]  iter_file_splice_write+0x169/0xcb0
[ 2204.968443]  ? generic_file_read_iter+0x330/0x550
[ 2204.969080]  ? generic_file_splice_read+0x1bc/0x4d0
[ 2204.969730]  ? __pfx_iter_file_splice_write+0x10/0x10
[ 2204.970405]  ? __pfx_generic_file_splice_read+0x10/0x10
[ 2204.971099]  ? inode_security+0x105/0x140
[ 2204.971681]  ? security_file_permission+0xb5/0xe0
[ 2204.972325]  ? __pfx_iter_file_splice_write+0x10/0x10
[ 2204.973003]  direct_splice_actor+0x113/0x180
[ 2204.973616]  splice_direct_to_actor+0x33a/0x8c0
[ 2204.974236]  ? __pfx_direct_splice_actor+0x10/0x10
[ 2204.974885]  ? __pfx_splice_direct_to_actor+0x10/0x10
[ 2204.975540]  ? security_file_permission+0xb5/0xe0
[ 2204.976196]  do_splice_direct+0x1bc/0x290
[ 2204.976749]  ? __pfx_do_splice_direct+0x10/0x10
[ 2204.977390]  ? lock_is_held_type+0xdb/0x130
[ 2204.977981]  do_sendfile+0xb1d/0x1280
[ 2204.978530]  ? __pfx_do_sendfile+0x10/0x10
[ 2204.979116]  ? lock_is_held_type+0xdb/0x130
[ 2204.979707]  __x64_sys_sendfile64+0x248/0x2a0
[ 2204.980299]  ? trace_rcu_dyntick+0x1a7/0x250
[ 2204.980903]  ? __pfx___x64_sys_sendfile64+0x10/0x10
[ 2204.981563]  ? syscall_enter_from_user_mode+0x21/0x50
[ 2204.982231]  ? syscall_enter_from_user_mode+0x21/0x50
[ 2204.982908]  do_syscall_64+0x3f/0x90
[ 2204.983410]  entry_SYSCALL_64_after_hwframe+0x72/0xdc
[ 2204.984089] RIP: 0033:0x7f3186383b19
[ 2204.984583] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
[ 2204.986854] RSP: 002b:00007f31838f9188 EFLAGS: 00000246 ORIG_RAX: 0000000000000028
[ 2204.987814] RAX: ffffffffffffffda RBX: 00007f3186496f60 RCX: 00007f3186383b19
[ 2204.988715] RDX: 0000000000000000 RSI: 0000000000000003 RDI: 0000000000000004
[ 2204.989628] RBP: 00007f31838f91d0 R08: 0000000000000000 R09: 0000000000000000
[ 2204.990532] R10: 00000000fffffdef R11: 0000000000000246 R12: 0000000000000001
[ 2204.991431] R13: 00007ffc1396bf2f R14: 00007f31838f9300 R15: 0000000000022000
[ 2204.992364]  </TASK>
[ 2205.020780] syz-executor.5: attempt to access beyond end of device
[ 2205.020780] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2205.022374] Buffer I/O error on dev loop5, logical block 10, lost async page write
[ 2205.084923] syz-executor.4: attempt to access beyond end of device
[ 2205.084923] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2205.086798] Buffer I/O error on dev loop4, logical block 10, lost async page write
00:08:52 executing program 3:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r0, &(0x7f0000001180)=ANY=[], 0x220)

00:08:52 executing program 0:
perf_event_open(&(0x7f0000000080)={0x0, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r1, &(0x7f0000000100), 0x0, 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r0, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r2, 0xc, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0x0, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r1, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:08:52 executing program 7:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684fd2981c8409820000080000000000000000"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x100d}], 0x1, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:08:52 executing program 6:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 6)

00:08:52 executing program 1:
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}}, 0x0, 0x6, 0xffffffffffffffff, 0xb)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
r1 = gettid()
rt_sigqueueinfo(0x0, 0x0, 0x0)
r2 = pidfd_getfd(0xffffffffffffffff, r0, 0x0)
perf_event_open(&(0x7f0000000040)={0x5, 0x80, 0x40, 0x71, 0x2, 0x0, 0x0, 0x8000, 0x20, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, @perf_config_ext={0xff}, 0x0, 0x9b5, 0xfa, 0xd, 0x0, 0x8000, 0x55, 0x0, 0x0, 0x0, 0x3ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000400)={0x2, 0x80, 0x2a, 0x81, 0xe0, 0x40, 0x0, 0x63c5ef1c, 0x80, 0x3, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x7, 0x2, @perf_config_ext={0xf2, 0x6}, 0x0, 0x5, 0xfffffff8, 0x0, 0x1, 0x0, 0x1b6, 0x0, 0x6}, 0x0, 0xd, 0xffffffffffffffff, 0x0)
rt_sigqueueinfo(0x0, 0x0, &(0x7f0000000000))
setsockopt$sock_timeval(r0, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10)
bind$packet(r2, &(0x7f00000000c0)={0x11, 0xfe, 0x0, 0x1, 0xfb, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}}, 0x14)
perf_event_open(&(0x7f0000000100)={0x0, 0x80, 0xff, 0x8, 0x0, 0x1, 0x0, 0x4, 0x684, 0x4, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0xdbc, 0x0, @perf_config_ext={0xd03, 0x80000000}, 0x800, 0x3, 0x3, 0x5, 0x300000000000000, 0x7, 0x7ff, 0x0, 0x0, 0x0, 0x5}, r1, 0x10, 0xffffffffffffffff, 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r3, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
openat(r3, &(0x7f0000000180)='\x00', 0x400040, 0x80)
rt_sigqueueinfo(0x0, 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f0000000240)={'ip6_vti0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x4, 0x0, 0x7f, 0x40, 0xb, @local, @mcast1, 0x88, 0x20, 0x8, 0x2}})

00:08:52 executing program 4:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_mount_image$tmpfs(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 8)

00:08:52 executing program 2:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684f"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x100d}], 0x1, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, 0x0, &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:08:52 executing program 5:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 7)

[ 2221.474906] loop6: detected capacity change from 0 to 40
[ 2221.477383] loop4: detected capacity change from 0 to 40
[ 2221.484919] loop5: detected capacity change from 0 to 40
[ 2221.536718] syz-executor.6: attempt to access beyond end of device
[ 2221.536718] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2221.537622] Buffer I/O error on dev loop6, logical block 10, lost async page write
[ 2221.556832] syz-executor.5: attempt to access beyond end of device
[ 2221.556832] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2221.557770] Buffer I/O error on dev loop5, logical block 10, lost async page write
00:08:52 executing program 6:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 7)

00:08:52 executing program 5:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 8)

[ 2221.654644] syz-executor.4: attempt to access beyond end of device
[ 2221.654644] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2221.656322] Buffer I/O error on dev loop4, logical block 10, lost async page write
00:08:52 executing program 3:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r0, &(0x7f0000001180)=ANY=[], 0x220)

00:08:52 executing program 0:
perf_event_open(&(0x7f0000000080)={0x0, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r1, &(0x7f0000000100), 0x0, 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r0, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r2, 0x10, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0x0, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r1, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:08:52 executing program 2:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684f"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x100d}], 0x1, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, 0x0, &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

[ 2221.738580] loop5: detected capacity change from 0 to 40
[ 2221.750839] loop6: detected capacity change from 0 to 40
00:08:52 executing program 1:
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}}, 0x0, 0x6, 0xffffffffffffffff, 0xb)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
r1 = gettid()
rt_sigqueueinfo(0x0, 0x0, 0x0)
r2 = pidfd_getfd(0xffffffffffffffff, r0, 0x0)
perf_event_open(&(0x7f0000000040)={0x5, 0x80, 0x40, 0x71, 0x2, 0x0, 0x0, 0x8000, 0x20, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, @perf_config_ext={0xff}, 0x0, 0x9b5, 0xfa, 0xd, 0x0, 0x8000, 0x55, 0x0, 0x0, 0x0, 0x3ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000400)={0x2, 0x80, 0x2a, 0x81, 0xe0, 0x40, 0x0, 0x63c5ef1c, 0x80, 0x3, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x7, 0x2, @perf_config_ext={0xf2, 0x6}, 0x0, 0x5, 0xfffffff8, 0x0, 0x1, 0x0, 0x1b6, 0x0, 0x6}, 0x0, 0xd, 0xffffffffffffffff, 0x0)
rt_sigqueueinfo(0x0, 0x0, &(0x7f0000000000))
setsockopt$sock_timeval(r0, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10)
bind$packet(r2, &(0x7f00000000c0)={0x11, 0xfe, 0x0, 0x1, 0xfb, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}}, 0x14)
perf_event_open(&(0x7f0000000100)={0x0, 0x80, 0xff, 0x8, 0x4, 0x0, 0x0, 0x4, 0x684, 0x4, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0xdbc, 0x0, @perf_config_ext={0xd03, 0x80000000}, 0x800, 0x3, 0x3, 0x5, 0x300000000000000, 0x7, 0x7ff, 0x0, 0x0, 0x0, 0x5}, r1, 0x10, 0xffffffffffffffff, 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r3, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
openat(r3, &(0x7f0000000180)='\x00', 0x400040, 0x80)
rt_sigqueueinfo(0x0, 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f0000000240)={'ip6_vti0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x4, 0x0, 0x7f, 0x40, 0xb, @local, @mcast1, 0x88, 0x20, 0x8, 0x2}})

00:08:52 executing program 4:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_mount_image$tmpfs(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 9)

[ 2221.811058] syz-executor.5: attempt to access beyond end of device
[ 2221.811058] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2221.811959] Buffer I/O error on dev loop5, logical block 10, lost async page write
00:08:52 executing program 5:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 9)

[ 2221.893784] syz-executor.6: attempt to access beyond end of device
[ 2221.893784] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2221.895188] Buffer I/O error on dev loop6, logical block 10, lost async page write
[ 2221.948355] loop4: detected capacity change from 0 to 40
00:08:52 executing program 1:
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}}, 0x0, 0x6, 0xffffffffffffffff, 0xb)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
r1 = gettid()
rt_sigqueueinfo(0x0, 0x0, 0x0)
r2 = pidfd_getfd(0xffffffffffffffff, r0, 0x0)
perf_event_open(&(0x7f0000000040)={0x5, 0x80, 0x40, 0x71, 0x2, 0x0, 0x0, 0x8000, 0x20, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, @perf_config_ext={0xff}, 0x0, 0x9b5, 0xfa, 0xd, 0x0, 0x8000, 0x55, 0x0, 0x0, 0x0, 0x3ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000400)={0x2, 0x80, 0x2a, 0x81, 0xe0, 0x40, 0x0, 0x63c5ef1c, 0x80, 0x3, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x7, 0x2, @perf_config_ext={0xf2, 0x6}, 0x0, 0x5, 0xfffffff8, 0x0, 0x1, 0x0, 0x1b6, 0x0, 0x6}, 0x0, 0xd, 0xffffffffffffffff, 0x0)
rt_sigqueueinfo(0x0, 0x0, &(0x7f0000000000))
setsockopt$sock_timeval(r0, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10)
bind$packet(r2, &(0x7f00000000c0)={0x11, 0xfe, 0x0, 0x1, 0xfb, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}}, 0x14)
perf_event_open(&(0x7f0000000100)={0x0, 0x80, 0xff, 0x8, 0x4, 0x0, 0x0, 0x4, 0x684, 0x4, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0xdbc, 0x0, @perf_config_ext={0xd03, 0x80000000}, 0x800, 0x3, 0x3, 0x5, 0x300000000000000, 0x7, 0x7ff, 0x0, 0x0, 0x0, 0x5}, r1, 0x10, 0xffffffffffffffff, 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r3, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
openat(r3, &(0x7f0000000180)='\x00', 0x400040, 0x80)
rt_sigqueueinfo(0x0, 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f0000000240)={'ip6_vti0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x4, 0x0, 0x7f, 0x40, 0xb, @local, @mcast1, 0x88, 0x20, 0x8, 0x2}})

[ 2222.018744] loop5: detected capacity change from 0 to 40
[ 2222.053370] syz-executor.4: attempt to access beyond end of device
[ 2222.053370] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2222.055149] Buffer I/O error on dev loop4, logical block 10, lost async page write
[ 2222.123463] syz-executor.5: attempt to access beyond end of device
[ 2222.123463] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2222.124825] Buffer I/O error on dev loop5, logical block 10, lost async page write
[ 2241.747566] loop4: detected capacity change from 0 to 40
00:09:12 executing program 5:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 10)

00:09:12 executing program 3:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r0, &(0x7f0000001180)=ANY=[], 0x220)

00:09:12 executing program 1:
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}}, 0x0, 0x6, 0xffffffffffffffff, 0xb)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
r1 = gettid()
rt_sigqueueinfo(0x0, 0x0, 0x0)
r2 = pidfd_getfd(0xffffffffffffffff, r0, 0x0)
perf_event_open(&(0x7f0000000040)={0x5, 0x80, 0x40, 0x71, 0x2, 0x0, 0x0, 0x8000, 0x20, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, @perf_config_ext={0xff}, 0x0, 0x9b5, 0xfa, 0xd, 0x0, 0x8000, 0x55, 0x0, 0x0, 0x0, 0x3ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000400)={0x2, 0x80, 0x2a, 0x81, 0xe0, 0x40, 0x0, 0x63c5ef1c, 0x80, 0x3, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x7, 0x2, @perf_config_ext={0xf2, 0x6}, 0x0, 0x5, 0xfffffff8, 0x0, 0x1, 0x0, 0x1b6, 0x0, 0x6}, 0x0, 0xd, 0xffffffffffffffff, 0x0)
rt_sigqueueinfo(0x0, 0x0, &(0x7f0000000000))
setsockopt$sock_timeval(r0, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10)
bind$packet(r2, &(0x7f00000000c0)={0x11, 0xfe, 0x0, 0x1, 0xfb, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}}, 0x14)
perf_event_open(&(0x7f0000000100)={0x0, 0x80, 0xff, 0x8, 0x4, 0x0, 0x0, 0x4, 0x684, 0x4, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0xdbc, 0x0, @perf_config_ext={0xd03, 0x80000000}, 0x800, 0x3, 0x3, 0x5, 0x300000000000000, 0x7, 0x7ff, 0x0, 0x0, 0x0, 0x5}, r1, 0x10, 0xffffffffffffffff, 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r3, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
openat(r3, &(0x7f0000000180)='\x00', 0x400040, 0x80)
rt_sigqueueinfo(0x0, 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f0000000240)={'ip6_vti0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x4, 0x0, 0x7f, 0x40, 0xb, @local, @mcast1, 0x88, 0x20, 0x8, 0x2}})

00:09:12 executing program 6:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 8)

00:09:12 executing program 7:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684fd2981c8409820000080000000000000000"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x43}], 0x1, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:09:12 executing program 0:
perf_event_open(&(0x7f0000000080)={0x0, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r1, &(0x7f0000000100), 0x0, 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r0, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r2, 0x12, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0x0, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r1, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:09:12 executing program 2:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684f"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x100d}], 0x1, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), 0x0, 0x0, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:09:12 executing program 4:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_mount_image$tmpfs(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 10)

[ 2241.801333] loop6: detected capacity change from 0 to 40
[ 2241.804488] loop5: detected capacity change from 0 to 40
[ 2241.849878] syz-executor.4: attempt to access beyond end of device
[ 2241.849878] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2241.851668] Buffer I/O error on dev loop4, logical block 10, lost async page write
[ 2241.865956] syz-executor.6: attempt to access beyond end of device
[ 2241.865956] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2241.866980] Buffer I/O error on dev loop6, logical block 10, lost async page write
[ 2241.877332] FAT-fs (loop3): bogus number of reserved sectors
[ 2241.878304] FAT-fs (loop3): Can't find a valid FAT filesystem
[ 2241.954572] syz-executor.5: attempt to access beyond end of device
[ 2241.954572] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2241.956264] Buffer I/O error on dev loop5, logical block 10, lost async page write
00:09:12 executing program 4:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_mount_image$tmpfs(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 11)

00:09:12 executing program 3:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r0, &(0x7f0000001180)=ANY=[], 0x220)

00:09:12 executing program 6:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 9)

00:09:12 executing program 5:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 11)

00:09:12 executing program 1:
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}}, 0x0, 0x6, 0xffffffffffffffff, 0xb)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
r1 = gettid()
rt_sigqueueinfo(0x0, 0x0, 0x0)
r2 = pidfd_getfd(0xffffffffffffffff, r0, 0x0)
perf_event_open(&(0x7f0000000040)={0x5, 0x80, 0x40, 0x71, 0x2, 0x0, 0x0, 0x8000, 0x20, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, @perf_config_ext={0xff}, 0x0, 0x9b5, 0xfa, 0xd, 0x0, 0x8000, 0x55, 0x0, 0x0, 0x0, 0x3ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000400)={0x2, 0x80, 0x2a, 0x81, 0xe0, 0x40, 0x0, 0x63c5ef1c, 0x80, 0x3, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x7, 0x2, @perf_config_ext={0xf2, 0x6}, 0x0, 0x5, 0xfffffff8, 0x0, 0x1, 0x0, 0x1b6, 0x0, 0x6}, 0x0, 0xd, 0xffffffffffffffff, 0x0)
rt_sigqueueinfo(0x0, 0x0, &(0x7f0000000000))
setsockopt$sock_timeval(r0, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10)
bind$packet(r2, &(0x7f00000000c0)={0x11, 0xfe, 0x0, 0x1, 0xfb, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}}, 0x14)
perf_event_open(&(0x7f0000000100)={0x0, 0x80, 0xff, 0x8, 0x4, 0x1, 0x0, 0x0, 0x684, 0x4, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0xdbc, 0x0, @perf_config_ext={0xd03, 0x80000000}, 0x800, 0x3, 0x3, 0x5, 0x300000000000000, 0x7, 0x7ff, 0x0, 0x0, 0x0, 0x5}, r1, 0x10, 0xffffffffffffffff, 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r3, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
openat(r3, &(0x7f0000000180)='\x00', 0x400040, 0x80)
rt_sigqueueinfo(0x0, 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f0000000240)={'ip6_vti0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x4, 0x0, 0x7f, 0x40, 0xb, @local, @mcast1, 0x88, 0x20, 0x8, 0x2}})

00:09:12 executing program 2:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684f"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x100d}], 0x1, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), 0x0, 0x0, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:09:12 executing program 0:
perf_event_open(&(0x7f0000000080)={0x0, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r1, &(0x7f0000000100), 0x0, 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r0, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r2, 0x18, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0x0, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r1, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

[ 2242.196607] loop6: detected capacity change from 0 to 40
[ 2242.201437] loop4: detected capacity change from 0 to 40
[ 2242.230180] FAT-fs (loop3): bogus number of reserved sectors
[ 2242.231115] FAT-fs (loop3): Can't find a valid FAT filesystem
[ 2242.242336] loop5: detected capacity change from 0 to 40
[ 2242.320875] syz-executor.6: attempt to access beyond end of device
[ 2242.320875] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2242.322601] Buffer I/O error on dev loop6, logical block 10, lost async page write
[ 2242.339773] syz-executor.4: attempt to access beyond end of device
[ 2242.339773] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2242.341461] Buffer I/O error on dev loop4, logical block 10, lost async page write
[ 2242.373088] syz-executor.5: attempt to access beyond end of device
[ 2242.373088] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2242.374739] Buffer I/O error on dev loop5, logical block 10, lost async page write
00:09:13 executing program 6:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 10)

[ 2242.603605] loop6: detected capacity change from 0 to 40
[ 2242.649471] syz-executor.6: attempt to access beyond end of device
[ 2242.649471] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2242.651077] Buffer I/O error on dev loop6, logical block 10, lost async page write
00:09:30 executing program 3:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r0, &(0x7f0000001180)=ANY=[], 0x220)

00:09:30 executing program 5:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 12)

00:09:30 executing program 6:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 11)

00:09:30 executing program 2:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684f"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x100d}], 0x1, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), 0x0, 0x0, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:09:30 executing program 7:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684fd2981c8409820000080000000000000000"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x86}], 0x1, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:09:30 executing program 4:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_mount_image$tmpfs(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 12)

00:09:30 executing program 0:
perf_event_open(&(0x7f0000000080)={0x0, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r1, &(0x7f0000000100), 0x0, 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r0, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r2, 0x28, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0x0, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r1, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:09:30 executing program 1:
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}}, 0x0, 0x6, 0xffffffffffffffff, 0xb)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
r1 = gettid()
rt_sigqueueinfo(0x0, 0x0, 0x0)
r2 = pidfd_getfd(0xffffffffffffffff, r0, 0x0)
perf_event_open(&(0x7f0000000040)={0x5, 0x80, 0x40, 0x71, 0x2, 0x0, 0x0, 0x8000, 0x20, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, @perf_config_ext={0xff}, 0x0, 0x9b5, 0xfa, 0xd, 0x0, 0x8000, 0x55, 0x0, 0x0, 0x0, 0x3ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000400)={0x2, 0x80, 0x2a, 0x81, 0xe0, 0x40, 0x0, 0x63c5ef1c, 0x80, 0x3, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x7, 0x2, @perf_config_ext={0xf2, 0x6}, 0x0, 0x5, 0xfffffff8, 0x0, 0x1, 0x0, 0x1b6, 0x0, 0x6}, 0x0, 0xd, 0xffffffffffffffff, 0x0)
rt_sigqueueinfo(0x0, 0x0, &(0x7f0000000000))
setsockopt$sock_timeval(r0, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10)
bind$packet(r2, &(0x7f00000000c0)={0x11, 0xfe, 0x0, 0x1, 0xfb, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}}, 0x14)
perf_event_open(&(0x7f0000000100)={0x0, 0x80, 0xff, 0x8, 0x4, 0x1, 0x0, 0x0, 0x684, 0x4, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0xdbc, 0x0, @perf_config_ext={0xd03, 0x80000000}, 0x800, 0x3, 0x3, 0x5, 0x300000000000000, 0x7, 0x7ff, 0x0, 0x0, 0x0, 0x5}, r1, 0x10, 0xffffffffffffffff, 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r3, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
openat(r3, &(0x7f0000000180)='\x00', 0x400040, 0x80)
rt_sigqueueinfo(0x0, 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f0000000240)={'ip6_vti0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x4, 0x0, 0x7f, 0x40, 0xb, @local, @mcast1, 0x88, 0x20, 0x8, 0x2}})

[ 2259.644302] loop4: detected capacity change from 0 to 40
[ 2259.644911] FAT-fs (loop3): bogus number of reserved sectors
[ 2259.645969] FAT-fs (loop3): Can't find a valid FAT filesystem
[ 2259.655215] loop5: detected capacity change from 0 to 40
[ 2259.656439] loop6: detected capacity change from 0 to 40
[ 2259.775042] syz-executor.4: attempt to access beyond end of device
[ 2259.775042] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2259.776457] Buffer I/O error on dev loop4, logical block 10, lost async page write
[ 2259.809435] syz-executor.6: attempt to access beyond end of device
[ 2259.809435] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2259.811312] Buffer I/O error on dev loop6, logical block 10, lost async page write
[ 2259.815135] syz-executor.5: attempt to access beyond end of device
[ 2259.815135] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2259.816873] Buffer I/O error on dev loop5, logical block 10, lost async page write
00:09:30 executing program 1:
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}}, 0x0, 0x6, 0xffffffffffffffff, 0xb)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
r1 = gettid()
rt_sigqueueinfo(0x0, 0x0, 0x0)
r2 = pidfd_getfd(0xffffffffffffffff, r0, 0x0)
perf_event_open(&(0x7f0000000040)={0x5, 0x80, 0x40, 0x71, 0x2, 0x0, 0x0, 0x8000, 0x20, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, @perf_config_ext={0xff}, 0x0, 0x9b5, 0xfa, 0xd, 0x0, 0x8000, 0x55, 0x0, 0x0, 0x0, 0x3ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000400)={0x2, 0x80, 0x2a, 0x81, 0xe0, 0x40, 0x0, 0x63c5ef1c, 0x80, 0x3, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x7, 0x2, @perf_config_ext={0xf2, 0x6}, 0x0, 0x5, 0xfffffff8, 0x0, 0x1, 0x0, 0x1b6, 0x0, 0x6}, 0x0, 0xd, 0xffffffffffffffff, 0x0)
rt_sigqueueinfo(0x0, 0x0, &(0x7f0000000000))
setsockopt$sock_timeval(r0, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10)
bind$packet(r2, &(0x7f00000000c0)={0x11, 0xfe, 0x0, 0x1, 0xfb, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}}, 0x14)
perf_event_open(&(0x7f0000000100)={0x0, 0x80, 0xff, 0x8, 0x4, 0x1, 0x0, 0x0, 0x684, 0x4, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0xdbc, 0x0, @perf_config_ext={0xd03, 0x80000000}, 0x800, 0x3, 0x3, 0x5, 0x300000000000000, 0x7, 0x7ff, 0x0, 0x0, 0x0, 0x5}, r1, 0x10, 0xffffffffffffffff, 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r3, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
openat(r3, &(0x7f0000000180)='\x00', 0x400040, 0x80)
rt_sigqueueinfo(0x0, 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f0000000240)={'ip6_vti0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x4, 0x0, 0x7f, 0x40, 0xb, @local, @mcast1, 0x88, 0x20, 0x8, 0x2}})

00:09:30 executing program 0:
perf_event_open(&(0x7f0000000080)={0x0, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r1, &(0x7f0000000100), 0x0, 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r0, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r2, 0x30, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0x0, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r1, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:09:30 executing program 3:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r0, &(0x7f0000001180)=ANY=[], 0x220)

00:09:30 executing program 4:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_mount_image$tmpfs(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 13)

00:09:30 executing program 5:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 13)

00:09:30 executing program 6:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 12)

00:09:30 executing program 2:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684f"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x100d}], 0x1, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x0)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

[ 2260.039147] FAT-fs (loop3): bogus number of reserved sectors
[ 2260.039743] FAT-fs (loop3): Can't find a valid FAT filesystem
00:09:30 executing program 1:
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}}, 0x0, 0x6, 0xffffffffffffffff, 0xb)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
r1 = gettid()
rt_sigqueueinfo(0x0, 0x0, 0x0)
r2 = pidfd_getfd(0xffffffffffffffff, r0, 0x0)
perf_event_open(&(0x7f0000000040)={0x5, 0x80, 0x40, 0x71, 0x2, 0x0, 0x0, 0x8000, 0x20, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, @perf_config_ext={0xff}, 0x0, 0x9b5, 0xfa, 0xd, 0x0, 0x8000, 0x55, 0x0, 0x0, 0x0, 0x3ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000400)={0x2, 0x80, 0x2a, 0x81, 0xe0, 0x40, 0x0, 0x63c5ef1c, 0x80, 0x3, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x7, 0x2, @perf_config_ext={0xf2, 0x6}, 0x0, 0x5, 0xfffffff8, 0x0, 0x1, 0x0, 0x1b6, 0x0, 0x6}, 0x0, 0xd, 0xffffffffffffffff, 0x0)
rt_sigqueueinfo(0x0, 0x0, &(0x7f0000000000))
setsockopt$sock_timeval(r0, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10)
bind$packet(r2, &(0x7f00000000c0)={0x11, 0xfe, 0x0, 0x1, 0xfb, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}}, 0x14)
perf_event_open(&(0x7f0000000100)={0x0, 0x80, 0xff, 0x8, 0x4, 0x1, 0x0, 0x4, 0x0, 0x4, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0xdbc, 0x0, @perf_config_ext={0xd03, 0x80000000}, 0x800, 0x3, 0x3, 0x5, 0x300000000000000, 0x7, 0x7ff, 0x0, 0x0, 0x0, 0x5}, r1, 0x10, 0xffffffffffffffff, 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r3, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
openat(r3, &(0x7f0000000180)='\x00', 0x400040, 0x80)
rt_sigqueueinfo(0x0, 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f0000000240)={'ip6_vti0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x4, 0x0, 0x7f, 0x40, 0xb, @local, @mcast1, 0x88, 0x20, 0x8, 0x2}})

00:09:30 executing program 7:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684fd2981c8409820000080000000000000000"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0xc9}], 0x1, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

[ 2260.136454] loop4: detected capacity change from 0 to 40
[ 2260.140615] loop6: detected capacity change from 0 to 40
[ 2260.148754] loop5: detected capacity change from 0 to 40
00:09:30 executing program 3:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r0, &(0x7f0000001180)=ANY=[], 0x220)

[ 2260.212392] FAULT_INJECTION: forcing a failure.
[ 2260.212392] name failslab, interval 1, probability 0, space 0, times 0
[ 2260.214054] CPU: 0 PID: 12168 Comm: syz-executor.4 Not tainted 6.1.0-rc8-next-20221208 #1
[ 2260.215170] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
[ 2260.216337] Call Trace:
[ 2260.216726]  <TASK>
[ 2260.217061]  dump_stack_lvl+0x8f/0xb7
[ 2260.217646]  should_fail_ex.cold+0x5/0xa
[ 2260.218274]  should_failslab+0x9/0x20
[ 2260.218838]  __kmem_cache_alloc_node+0x5b/0x400
[ 2260.219547]  ? iter_file_splice_write+0x169/0xcb0
[ 2260.220262]  ? iter_file_splice_write+0x169/0xcb0
[ 2260.220964]  __kmalloc+0x46/0xc0
[ 2260.221483]  iter_file_splice_write+0x169/0xcb0
[ 2260.222192]  ? generic_file_read_iter+0x330/0x550
[ 2260.222886]  ? generic_file_splice_read+0x1bc/0x4d0
[ 2260.223617]  ? __pfx_iter_file_splice_write+0x10/0x10
[ 2260.224327]  ? __pfx_generic_file_splice_read+0x10/0x10
[ 2260.225064]  ? inode_security+0x105/0x140
[ 2260.225722]  ? security_file_permission+0xb5/0xe0
[ 2260.226432]  ? __pfx_iter_file_splice_write+0x10/0x10
[ 2260.227213]  direct_splice_actor+0x113/0x180
[ 2260.227871]  splice_direct_to_actor+0x33a/0x8c0
[ 2260.228556]  ? __pfx_direct_splice_actor+0x10/0x10
[ 2260.229292]  ? __pfx_splice_direct_to_actor+0x10/0x10
[ 2260.230017]  ? security_file_permission+0xb5/0xe0
[ 2260.230736]  do_splice_direct+0x1bc/0x290
[ 2260.231564]  ? __pfx_do_splice_direct+0x10/0x10
[ 2260.232299]  ? lock_is_held_type+0xdb/0x130
[ 2260.232938]  do_sendfile+0xb1d/0x1280
[ 2260.233529]  ? __pfx_do_sendfile+0x10/0x10
[ 2260.234190]  ? lock_is_held_type+0xdb/0x130
[ 2260.234824]  __x64_sys_sendfile64+0x248/0x2a0
[ 2260.235490]  ? trace_rcu_dyntick+0x1a7/0x250
[ 2260.236123]  ? __pfx___x64_sys_sendfile64+0x10/0x10
[ 2260.236874]  ? syscall_enter_from_user_mode+0x21/0x50
[ 2260.237631]  ? syscall_enter_from_user_mode+0x21/0x50
[ 2260.238396]  do_syscall_64+0x3f/0x90
[ 2260.238932]  entry_SYSCALL_64_after_hwframe+0x72/0xdc
[ 2260.239710] RIP: 0033:0x7f5dbe2acb19
[ 2260.240258] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
[ 2260.242855] RSP: 002b:00007f5dbb822188 EFLAGS: 00000246 ORIG_RAX: 0000000000000028
[ 2260.243906] RAX: ffffffffffffffda RBX: 00007f5dbe3bff60 RCX: 00007f5dbe2acb19
[ 2260.244911] RDX: 0000000000000000 RSI: 0000000000000003 RDI: 0000000000000004
[ 2260.245920] RBP: 00007f5dbb8221d0 R08: 0000000000000000 R09: 0000000000000000
[ 2260.246954] R10: 00000000fffffdef R11: 0000000000000246 R12: 0000000000000002
[ 2260.247980] R13: 00007ffc7a53101f R14: 00007f5dbb822300 R15: 0000000000022000
[ 2260.249054]  </TASK>
[ 2260.262645] syz-executor.6: attempt to access beyond end of device
[ 2260.262645] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2260.263810] Buffer I/O error on dev loop6, logical block 10, lost async page write
[ 2260.270717] FAULT_INJECTION: forcing a failure.
[ 2260.270717] name failslab, interval 1, probability 0, space 0, times 0
[ 2260.272376] CPU: 0 PID: 12179 Comm: syz-executor.5 Not tainted 6.1.0-rc8-next-20221208 #1
[ 2260.273522] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
[ 2260.274680] Call Trace:
[ 2260.275045]  <TASK>
[ 2260.275375]  dump_stack_lvl+0x8f/0xb7
[ 2260.275944]  should_fail_ex.cold+0x5/0xa
[ 2260.276563]  should_failslab+0x9/0x20
[ 2260.277112]  __kmem_cache_alloc_node+0x5b/0x400
[ 2260.277807]  ? iter_file_splice_write+0x169/0xcb0
[ 2260.278540]  ? iter_file_splice_write+0x169/0xcb0
[ 2260.279248]  __kmalloc+0x46/0xc0
[ 2260.279764]  iter_file_splice_write+0x169/0xcb0
[ 2260.280428]  ? generic_file_read_iter+0x330/0x550
[ 2260.281131]  ? generic_file_splice_read+0x1bc/0x4d0
[ 2260.281878]  ? __pfx_iter_file_splice_write+0x10/0x10
[ 2260.282646]  ? __pfx_generic_file_splice_read+0x10/0x10
[ 2260.283376]  ? inode_security+0x105/0x140
[ 2260.283990]  ? security_file_permission+0xb5/0xe0
[ 2260.284693]  ? __pfx_iter_file_splice_write+0x10/0x10
[ 2260.285423]  direct_splice_actor+0x113/0x180
[ 2260.286068]  splice_direct_to_actor+0x33a/0x8c0
[ 2260.286769]  ? __pfx_direct_splice_actor+0x10/0x10
[ 2260.287489]  ? __pfx_splice_direct_to_actor+0x10/0x10
[ 2260.288250]  ? security_file_permission+0xb5/0xe0
[ 2260.288937]  do_splice_direct+0x1bc/0x290
[ 2260.289563]  ? __pfx_do_splice_direct+0x10/0x10
[ 2260.290285]  ? lock_is_held_type+0xdb/0x130
[ 2260.290919]  do_sendfile+0xb1d/0x1280
[ 2260.291498]  ? __pfx_do_sendfile+0x10/0x10
[ 2260.292121]  ? lock_is_held_type+0xdb/0x130
[ 2260.292762]  __x64_sys_sendfile64+0x248/0x2a0
[ 2260.293382]  ? trace_rcu_dyntick+0x1a7/0x250
[ 2260.294033]  ? __pfx___x64_sys_sendfile64+0x10/0x10
[ 2260.294755]  ? syscall_enter_from_user_mode+0x21/0x50
[ 2260.295501]  ? syscall_enter_from_user_mode+0x21/0x50
[ 2260.296226]  do_syscall_64+0x3f/0x90
[ 2260.296784]  entry_SYSCALL_64_after_hwframe+0x72/0xdc
[ 2260.297537] RIP: 0033:0x7f5e74c67b19
[ 2260.298100] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
[ 2260.300641] RSP: 002b:00007f5e721bc188 EFLAGS: 00000246 ORIG_RAX: 0000000000000028
[ 2260.301724] RAX: ffffffffffffffda RBX: 00007f5e74d7b020 RCX: 00007f5e74c67b19
[ 2260.302757] RDX: 0000000000000000 RSI: 0000000000000003 RDI: 0000000000000004
[ 2260.303759] RBP: 00007f5e721bc1d0 R08: 0000000000000000 R09: 0000000000000000
[ 2260.304766] R10: 00000000fffffdef R11: 0000000000000246 R12: 0000000000000002
[ 2260.305775] R13: 00007ffd3dbd647f R14: 00007f5e721bc300 R15: 0000000000022000
[ 2260.306840]  </TASK>
00:09:46 executing program 0:
perf_event_open(&(0x7f0000000080)={0x0, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r1, &(0x7f0000000100), 0x0, 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r0, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r2, 0x38, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0x0, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r1, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:09:46 executing program 1:
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}}, 0x0, 0x6, 0xffffffffffffffff, 0xb)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
r1 = gettid()
rt_sigqueueinfo(0x0, 0x0, 0x0)
r2 = pidfd_getfd(0xffffffffffffffff, r0, 0x0)
perf_event_open(&(0x7f0000000040)={0x5, 0x80, 0x40, 0x71, 0x2, 0x0, 0x0, 0x8000, 0x20, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, @perf_config_ext={0xff}, 0x0, 0x9b5, 0xfa, 0xd, 0x0, 0x8000, 0x55, 0x0, 0x0, 0x0, 0x3ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000400)={0x2, 0x80, 0x2a, 0x81, 0xe0, 0x40, 0x0, 0x63c5ef1c, 0x80, 0x3, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x7, 0x2, @perf_config_ext={0xf2, 0x6}, 0x0, 0x5, 0xfffffff8, 0x0, 0x1, 0x0, 0x1b6, 0x0, 0x6}, 0x0, 0xd, 0xffffffffffffffff, 0x0)
rt_sigqueueinfo(0x0, 0x0, &(0x7f0000000000))
setsockopt$sock_timeval(r0, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10)
bind$packet(r2, &(0x7f00000000c0)={0x11, 0xfe, 0x0, 0x1, 0xfb, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}}, 0x14)
perf_event_open(&(0x7f0000000100)={0x0, 0x80, 0xff, 0x8, 0x4, 0x1, 0x0, 0x4, 0x0, 0x4, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0xdbc, 0x0, @perf_config_ext={0xd03, 0x80000000}, 0x800, 0x3, 0x3, 0x5, 0x300000000000000, 0x7, 0x7ff, 0x0, 0x0, 0x0, 0x5}, r1, 0x10, 0xffffffffffffffff, 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r3, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
openat(r3, &(0x7f0000000180)='\x00', 0x400040, 0x80)
rt_sigqueueinfo(0x0, 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f0000000240)={'ip6_vti0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x4, 0x0, 0x7f, 0x40, 0xb, @local, @mcast1, 0x88, 0x20, 0x8, 0x2}})

00:09:46 executing program 5:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 14)

00:09:46 executing program 6:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 13)

00:09:46 executing program 7:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684fd2981c8409820000080000000000000000"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x10c}], 0x1, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:09:46 executing program 4:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_mount_image$tmpfs(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 14)

00:09:46 executing program 3:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r0, &(0x7f0000001180)=ANY=[], 0x220)

00:09:46 executing program 2:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684f"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x100d}], 0x1, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x0)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

[ 2276.003646] FAT-fs (loop3): bogus number of reserved sectors
[ 2276.004118] FAT-fs (loop3): Can't find a valid FAT filesystem
[ 2276.014280] loop5: detected capacity change from 0 to 40
[ 2276.020293] loop4: detected capacity change from 0 to 40
[ 2276.051101] loop6: detected capacity change from 0 to 40
[ 2276.098454] FAULT_INJECTION: forcing a failure.
[ 2276.098454] name failslab, interval 1, probability 0, space 0, times 0
[ 2276.099282] CPU: 1 PID: 12206 Comm: syz-executor.6 Not tainted 6.1.0-rc8-next-20221208 #1
[ 2276.099838] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
[ 2276.100402] Call Trace:
[ 2276.100588]  <TASK>
[ 2276.100754]  dump_stack_lvl+0x8f/0xb7
[ 2276.101039]  should_fail_ex.cold+0x5/0xa
[ 2276.101339]  should_failslab+0x9/0x20
[ 2276.101616]  __kmem_cache_alloc_node+0x5b/0x400
[ 2276.101953]  ? iter_file_splice_write+0x169/0xcb0
[ 2276.102302]  ? iter_file_splice_write+0x169/0xcb0
[ 2276.102651]  __kmalloc+0x46/0xc0
[ 2276.102905]  iter_file_splice_write+0x169/0xcb0
[ 2276.103235]  ? generic_file_read_iter+0x330/0x550
[ 2276.103606]  ? generic_file_splice_read+0x1bc/0x4d0
[ 2276.103966]  ? __pfx_iter_file_splice_write+0x10/0x10
[ 2276.104327]  ? __pfx_generic_file_splice_read+0x10/0x10
[ 2276.104708]  ? inode_security+0x105/0x140
[ 2276.105022]  ? security_file_permission+0xb5/0xe0
[ 2276.105374]  ? __pfx_iter_file_splice_write+0x10/0x10
[ 2276.105746]  direct_splice_actor+0x113/0x180
[ 2276.106090]  splice_direct_to_actor+0x33a/0x8c0
[ 2276.106430]  ? __pfx_direct_splice_actor+0x10/0x10
[ 2276.106780]  ? __pfx_splice_direct_to_actor+0x10/0x10
[ 2276.107140]  ? security_file_permission+0xb5/0xe0
[ 2276.107486]  do_splice_direct+0x1bc/0x290
[ 2276.107787]  ? __pfx_do_splice_direct+0x10/0x10
[ 2276.108124]  ? lock_is_held_type+0xdb/0x130
[ 2276.108459]  do_sendfile+0xb1d/0x1280
[ 2276.108773]  ? __pfx_do_sendfile+0x10/0x10
[ 2276.109100]  ? lock_is_held_type+0xdb/0x130
[ 2276.109423]  __x64_sys_sendfile64+0x248/0x2a0
[ 2276.109760]  ? trace_rcu_dyntick+0x1a7/0x250
[ 2276.110099]  ? __pfx___x64_sys_sendfile64+0x10/0x10
[ 2276.110468]  ? syscall_enter_from_user_mode+0x21/0x50
[ 2276.110833]  ? syscall_enter_from_user_mode+0x21/0x50
[ 2276.111224]  do_syscall_64+0x3f/0x90
[ 2276.111495]  entry_SYSCALL_64_after_hwframe+0x72/0xdc
[ 2276.111879] RIP: 0033:0x7f3186383b19
[ 2276.112147] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
[ 2276.113443] RSP: 002b:00007f31838f9188 EFLAGS: 00000246 ORIG_RAX: 0000000000000028
[ 2276.113960] RAX: ffffffffffffffda RBX: 00007f3186496f60 RCX: 00007f3186383b19
[ 2276.114482] RDX: 0000000000000000 RSI: 0000000000000003 RDI: 0000000000000004
[ 2276.114999] RBP: 00007f31838f91d0 R08: 0000000000000000 R09: 0000000000000000
[ 2276.115523] R10: 00000000fffffdef R11: 0000000000000246 R12: 0000000000000002
[ 2276.116043] R13: 00007ffc1396bf2f R14: 00007f31838f9300 R15: 0000000000022000
[ 2276.116577]  </TASK>
[ 2276.129691] syz-executor.4: attempt to access beyond end of device
[ 2276.129691] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2276.130694] Buffer I/O error on dev loop4, logical block 10, lost async page write
[ 2276.131902] syz-executor.5: attempt to access beyond end of device
[ 2276.131902] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2276.133577] Buffer I/O error on dev loop5, logical block 10, lost async page write
[ 2291.393089] loop6: detected capacity change from 0 to 40
00:10:02 executing program 7:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684fd2981c8409820000080000000000000000"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x14f}], 0x1, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:10:02 executing program 3:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r0, &(0x7f0000001180)=ANY=[], 0x220)

00:10:02 executing program 5:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 15)

00:10:02 executing program 2:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684f"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x100d}], 0x1, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x0)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:10:02 executing program 0:
perf_event_open(&(0x7f0000000080)={0x0, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r1, &(0x7f0000000100), 0x0, 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r0, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r2, 0x48, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0x0, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r1, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:10:02 executing program 4:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_mount_image$tmpfs(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 15)

00:10:02 executing program 6:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 14)

00:10:02 executing program 1:
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}}, 0x0, 0x6, 0xffffffffffffffff, 0xb)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
r1 = gettid()
rt_sigqueueinfo(0x0, 0x0, 0x0)
r2 = pidfd_getfd(0xffffffffffffffff, r0, 0x0)
perf_event_open(&(0x7f0000000040)={0x5, 0x80, 0x40, 0x71, 0x2, 0x0, 0x0, 0x8000, 0x20, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, @perf_config_ext={0xff}, 0x0, 0x9b5, 0xfa, 0xd, 0x0, 0x8000, 0x55, 0x0, 0x0, 0x0, 0x3ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000400)={0x2, 0x80, 0x2a, 0x81, 0xe0, 0x40, 0x0, 0x63c5ef1c, 0x80, 0x3, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x7, 0x2, @perf_config_ext={0xf2, 0x6}, 0x0, 0x5, 0xfffffff8, 0x0, 0x1, 0x0, 0x1b6, 0x0, 0x6}, 0x0, 0xd, 0xffffffffffffffff, 0x0)
rt_sigqueueinfo(0x0, 0x0, &(0x7f0000000000))
setsockopt$sock_timeval(r0, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10)
bind$packet(r2, &(0x7f00000000c0)={0x11, 0xfe, 0x0, 0x1, 0xfb, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}}, 0x14)
perf_event_open(&(0x7f0000000100)={0x0, 0x80, 0xff, 0x8, 0x4, 0x1, 0x0, 0x4, 0x0, 0x4, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0xdbc, 0x0, @perf_config_ext={0xd03, 0x80000000}, 0x800, 0x3, 0x3, 0x5, 0x300000000000000, 0x7, 0x7ff, 0x0, 0x0, 0x0, 0x5}, r1, 0x10, 0xffffffffffffffff, 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r3, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
openat(r3, &(0x7f0000000180)='\x00', 0x400040, 0x80)
rt_sigqueueinfo(0x0, 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f0000000240)={'ip6_vti0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x4, 0x0, 0x7f, 0x40, 0xb, @local, @mcast1, 0x88, 0x20, 0x8, 0x2}})

[ 2291.426528] loop3: detected capacity change from 0 to 40
[ 2291.434190] FAT-fs (loop3): bogus number of reserved sectors
[ 2291.434761] FAT-fs (loop3): Can't find a valid FAT filesystem
[ 2291.474703] syz-executor.6: attempt to access beyond end of device
[ 2291.474703] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2291.475805] Buffer I/O error on dev loop6, logical block 10, lost async page write
[ 2291.511475] loop5: detected capacity change from 0 to 40
[ 2291.520144] loop4: detected capacity change from 0 to 40
00:10:02 executing program 3:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r0, &(0x7f0000001180)=ANY=[], 0x220)

00:10:02 executing program 6:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 15)

00:10:02 executing program 0:
perf_event_open(&(0x7f0000000080)={0x0, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r1, &(0x7f0000000100), 0x0, 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r0, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r2, 0x50, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0x0, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r1, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

[ 2291.647730] loop3: detected capacity change from 0 to 40
[ 2291.655580] syz-executor.5: attempt to access beyond end of device
[ 2291.655580] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2291.656567] Buffer I/O error on dev loop5, logical block 10, lost async page write
[ 2291.677299] syz-executor.4: attempt to access beyond end of device
[ 2291.677299] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2291.678343] Buffer I/O error on dev loop4, logical block 10, lost async page write
00:10:02 executing program 7:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684fd2981c8409820000080000000000000000"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x19c}], 0x1, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:10:02 executing program 5:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 16)

[ 2291.720164] FAT-fs (loop3): bogus number of reserved sectors
[ 2291.721107] FAT-fs (loop3): Can't find a valid FAT filesystem
[ 2291.742581] loop6: detected capacity change from 0 to 40
[ 2291.753369] loop5: detected capacity change from 0 to 40
00:10:02 executing program 2:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684f"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x100d}], 0x1, 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(0xffffffffffffffff, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

[ 2291.806318] syz-executor.5: attempt to access beyond end of device
[ 2291.806318] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2291.807290] Buffer I/O error on dev loop5, logical block 10, lost async page write
[ 2291.810958] syz-executor.6: attempt to access beyond end of device
[ 2291.810958] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2291.811889] Buffer I/O error on dev loop6, logical block 10, lost async page write
00:10:02 executing program 5:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 17)

00:10:02 executing program 4:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_mount_image$tmpfs(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 16)

00:10:02 executing program 1:
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}}, 0x0, 0x6, 0xffffffffffffffff, 0xb)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
r1 = gettid()
rt_sigqueueinfo(0x0, 0x0, 0x0)
r2 = pidfd_getfd(0xffffffffffffffff, r0, 0x0)
perf_event_open(&(0x7f0000000040)={0x5, 0x80, 0x40, 0x71, 0x2, 0x0, 0x0, 0x8000, 0x20, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, @perf_config_ext={0xff}, 0x0, 0x9b5, 0xfa, 0xd, 0x0, 0x8000, 0x55, 0x0, 0x0, 0x0, 0x3ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000400)={0x2, 0x80, 0x2a, 0x81, 0xe0, 0x40, 0x0, 0x63c5ef1c, 0x80, 0x3, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x7, 0x2, @perf_config_ext={0xf2, 0x6}, 0x0, 0x5, 0xfffffff8, 0x0, 0x1, 0x0, 0x1b6, 0x0, 0x6}, 0x0, 0xd, 0xffffffffffffffff, 0x0)
rt_sigqueueinfo(0x0, 0x0, &(0x7f0000000000))
setsockopt$sock_timeval(r0, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10)
bind$packet(r2, &(0x7f00000000c0)={0x11, 0xfe, 0x0, 0x1, 0xfb, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}}, 0x14)
perf_event_open(&(0x7f0000000100)={0x0, 0x80, 0xff, 0x8, 0x4, 0x1, 0x0, 0x4, 0x684, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0xdbc, 0x0, @perf_config_ext={0xd03, 0x80000000}, 0x800, 0x3, 0x3, 0x5, 0x300000000000000, 0x7, 0x7ff, 0x0, 0x0, 0x0, 0x5}, r1, 0x10, 0xffffffffffffffff, 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r3, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
openat(r3, &(0x7f0000000180)='\x00', 0x400040, 0x80)
rt_sigqueueinfo(0x0, 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f0000000240)={'ip6_vti0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x4, 0x0, 0x7f, 0x40, 0xb, @local, @mcast1, 0x88, 0x20, 0x8, 0x2}})

00:10:02 executing program 3:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r0, &(0x7f0000001180)=ANY=[], 0x220)

[ 2291.945681] loop5: detected capacity change from 0 to 40
[ 2291.988743] loop4: detected capacity change from 0 to 40
00:10:02 executing program 6:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 16)

00:10:02 executing program 7:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684fd2981c8409820000080000000000000000"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x1e9}], 0x1, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

[ 2292.011596] syz-executor.5: attempt to access beyond end of device
[ 2292.011596] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2292.012553] Buffer I/O error on dev loop5, logical block 10, lost async page write
00:10:02 executing program 0:
perf_event_open(&(0x7f0000000080)={0x0, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r1, &(0x7f0000000100), 0x0, 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r0, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r2, 0x58, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0x0, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r1, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

[ 2292.058965] loop6: detected capacity change from 0 to 40
[ 2292.074196] loop3: detected capacity change from 0 to 40
00:10:02 executing program 1:
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}}, 0x0, 0x6, 0xffffffffffffffff, 0xb)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
r1 = gettid()
rt_sigqueueinfo(0x0, 0x0, 0x0)
r2 = pidfd_getfd(0xffffffffffffffff, r0, 0x0)
perf_event_open(&(0x7f0000000040)={0x5, 0x80, 0x40, 0x71, 0x2, 0x0, 0x0, 0x8000, 0x20, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, @perf_config_ext={0xff}, 0x0, 0x9b5, 0xfa, 0xd, 0x0, 0x8000, 0x55, 0x0, 0x0, 0x0, 0x3ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000400)={0x2, 0x80, 0x2a, 0x81, 0xe0, 0x40, 0x0, 0x63c5ef1c, 0x80, 0x3, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x7, 0x2, @perf_config_ext={0xf2, 0x6}, 0x0, 0x5, 0xfffffff8, 0x0, 0x1, 0x0, 0x1b6, 0x0, 0x6}, 0x0, 0xd, 0xffffffffffffffff, 0x0)
rt_sigqueueinfo(0x0, 0x0, &(0x7f0000000000))
setsockopt$sock_timeval(r0, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10)
bind$packet(r2, &(0x7f00000000c0)={0x11, 0xfe, 0x0, 0x1, 0xfb, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}}, 0x14)
perf_event_open(&(0x7f0000000100)={0x0, 0x80, 0xff, 0x8, 0x4, 0x1, 0x0, 0x4, 0x684, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0xdbc, 0x0, @perf_config_ext={0xd03, 0x80000000}, 0x800, 0x3, 0x3, 0x5, 0x300000000000000, 0x7, 0x7ff, 0x0, 0x0, 0x0, 0x5}, r1, 0x10, 0xffffffffffffffff, 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r3, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
openat(r3, &(0x7f0000000180)='\x00', 0x400040, 0x80)
rt_sigqueueinfo(0x0, 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f0000000240)={'ip6_vti0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x4, 0x0, 0x7f, 0x40, 0xb, @local, @mcast1, 0x88, 0x20, 0x8, 0x2}})

00:10:02 executing program 5:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 18)

[ 2292.105653] FAT-fs (loop3): bogus number of reserved sectors
[ 2292.106318] FAT-fs (loop3): Can't find a valid FAT filesystem
[ 2292.131832] syz-executor.4: attempt to access beyond end of device
[ 2292.131832] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2292.133772] Buffer I/O error on dev loop4, logical block 10, lost async page write
[ 2292.136462] syz-executor.6: attempt to access beyond end of device
[ 2292.136462] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2292.137346] Buffer I/O error on dev loop6, logical block 10, lost async page write
[ 2292.190272] loop5: detected capacity change from 0 to 40
00:10:02 executing program 6:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 17)

[ 2292.267433] syz-executor.5: attempt to access beyond end of device
[ 2292.267433] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2292.268350] Buffer I/O error on dev loop5, logical block 10, lost async page write
[ 2292.316402] loop6: detected capacity change from 0 to 40
[ 2292.430988] syz-executor.6: attempt to access beyond end of device
[ 2292.430988] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2292.432831] Buffer I/O error on dev loop6, logical block 10, lost async page write
00:10:21 executing program 4:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_mount_image$tmpfs(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 17)

00:10:21 executing program 1:
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}}, 0x0, 0x6, 0xffffffffffffffff, 0xb)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
r1 = gettid()
rt_sigqueueinfo(0x0, 0x0, 0x0)
r2 = pidfd_getfd(0xffffffffffffffff, r0, 0x0)
perf_event_open(&(0x7f0000000040)={0x5, 0x80, 0x40, 0x71, 0x2, 0x0, 0x0, 0x8000, 0x20, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, @perf_config_ext={0xff}, 0x0, 0x9b5, 0xfa, 0xd, 0x0, 0x8000, 0x55, 0x0, 0x0, 0x0, 0x3ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000400)={0x2, 0x80, 0x2a, 0x81, 0xe0, 0x40, 0x0, 0x63c5ef1c, 0x80, 0x3, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x7, 0x2, @perf_config_ext={0xf2, 0x6}, 0x0, 0x5, 0xfffffff8, 0x0, 0x1, 0x0, 0x1b6, 0x0, 0x6}, 0x0, 0xd, 0xffffffffffffffff, 0x0)
rt_sigqueueinfo(0x0, 0x0, &(0x7f0000000000))
setsockopt$sock_timeval(r0, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10)
bind$packet(r2, &(0x7f00000000c0)={0x11, 0xfe, 0x0, 0x1, 0xfb, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}}, 0x14)
perf_event_open(&(0x7f0000000100)={0x0, 0x80, 0xff, 0x8, 0x4, 0x1, 0x0, 0x4, 0x684, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0xdbc, 0x0, @perf_config_ext={0xd03, 0x80000000}, 0x800, 0x3, 0x3, 0x5, 0x300000000000000, 0x7, 0x7ff, 0x0, 0x0, 0x0, 0x5}, r1, 0x10, 0xffffffffffffffff, 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r3, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
openat(r3, &(0x7f0000000180)='\x00', 0x400040, 0x80)
rt_sigqueueinfo(0x0, 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f0000000240)={'ip6_vti0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x4, 0x0, 0x7f, 0x40, 0xb, @local, @mcast1, 0x88, 0x20, 0x8, 0x2}})

00:10:21 executing program 6:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 18)

00:10:21 executing program 3:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{0x0}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r0, &(0x7f0000001180)=ANY=[], 0x220)

00:10:21 executing program 7:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684fd2981c8409820000080000000000000000"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x236}], 0x1, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:10:21 executing program 5:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 19)

00:10:21 executing program 2:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684f"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x100d}], 0x1, 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(0xffffffffffffffff, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:10:21 executing program 0:
perf_event_open(&(0x7f0000000080)={0x0, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r1, &(0x7f0000000100), 0x0, 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r0, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r2, 0x60, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0x0, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r1, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

[ 2310.954661] loop6: detected capacity change from 0 to 40
[ 2310.959361] loop5: detected capacity change from 0 to 40
[ 2310.963483] loop4: detected capacity change from 0 to 40
[ 2310.969504] loop3: detected capacity change from 0 to 40
[ 2310.971270] FAT-fs (loop3): bogus number of reserved sectors
[ 2310.971695] FAT-fs (loop3): Can't find a valid FAT filesystem
[ 2311.030682] syz-executor.6: attempt to access beyond end of device
[ 2311.030682] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2311.031581] Buffer I/O error on dev loop6, logical block 10, lost async page write
[ 2311.040331] syz-executor.4: attempt to access beyond end of device
[ 2311.040331] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2311.041794] syz-executor.5: attempt to access beyond end of device
[ 2311.041794] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2311.041978] Buffer I/O error on dev loop4, logical block 10, lost async page write
[ 2311.042746] Buffer I/O error on dev loop5, logical block 10, lost async page write
00:10:21 executing program 3:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{0x0}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r0, &(0x7f0000001180)=ANY=[], 0x220)

00:10:21 executing program 6:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 19)

00:10:21 executing program 0:
perf_event_open(&(0x7f0000000080)={0x0, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r1, &(0x7f0000000100), 0x0, 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r0, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r2, 0x64, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0x0, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r1, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:10:21 executing program 4:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_mount_image$tmpfs(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 18)

00:10:21 executing program 5:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 20)

[ 2311.170733] loop6: detected capacity change from 0 to 40
[ 2311.190085] loop4: detected capacity change from 0 to 40
[ 2311.218650] syz-executor.6: attempt to access beyond end of device
[ 2311.218650] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2311.219559] Buffer I/O error on dev loop6, logical block 10, lost async page write
[ 2311.241189] syz-executor.4: attempt to access beyond end of device
[ 2311.241189] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2311.242182] Buffer I/O error on dev loop4, logical block 10, lost async page write
[ 2311.258392] loop3: detected capacity change from 0 to 40
00:10:21 executing program 0:
perf_event_open(&(0x7f0000000080)={0x0, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r1, &(0x7f0000000100), 0x0, 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r0, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r2, 0x68, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0x0, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r1, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

[ 2311.269717] FAT-fs (loop3): bogus number of reserved sectors
[ 2311.270181] FAT-fs (loop3): Can't find a valid FAT filesystem
00:10:21 executing program 1:
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}}, 0x0, 0x6, 0xffffffffffffffff, 0xb)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
r1 = gettid()
rt_sigqueueinfo(0x0, 0x0, 0x0)
r2 = pidfd_getfd(0xffffffffffffffff, r0, 0x0)
perf_event_open(&(0x7f0000000040)={0x5, 0x80, 0x40, 0x71, 0x2, 0x0, 0x0, 0x8000, 0x20, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, @perf_config_ext={0xff}, 0x0, 0x9b5, 0xfa, 0xd, 0x0, 0x8000, 0x55, 0x0, 0x0, 0x0, 0x3ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000400)={0x2, 0x80, 0x2a, 0x81, 0xe0, 0x40, 0x0, 0x63c5ef1c, 0x80, 0x3, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x7, 0x2, @perf_config_ext={0xf2, 0x6}, 0x0, 0x5, 0xfffffff8, 0x0, 0x1, 0x0, 0x1b6, 0x0, 0x6}, 0x0, 0xd, 0xffffffffffffffff, 0x0)
rt_sigqueueinfo(0x0, 0x0, &(0x7f0000000000))
setsockopt$sock_timeval(r0, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10)
bind$packet(r2, &(0x7f00000000c0)={0x11, 0xfe, 0x0, 0x1, 0xfb, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}}, 0x14)
perf_event_open(&(0x7f0000000100)={0x0, 0x80, 0xff, 0x8, 0x4, 0x1, 0x0, 0x4, 0x684, 0x4, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0xdbc, 0x0, @perf_config_ext={0xd03, 0x80000000}, 0x800, 0x3, 0x3, 0x5, 0x300000000000000, 0x7, 0x7ff, 0x0, 0x0, 0x0, 0x5}, r1, 0x10, 0xffffffffffffffff, 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r3, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
openat(r3, &(0x7f0000000180)='\x00', 0x400040, 0x80)
rt_sigqueueinfo(0x0, 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f0000000240)={'ip6_vti0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x4, 0x0, 0x7f, 0x40, 0xb, @local, @mcast1, 0x88, 0x20, 0x8, 0x2}})

00:10:21 executing program 6:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 20)

00:10:21 executing program 4:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_mount_image$tmpfs(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 19)

00:10:22 executing program 7:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684fd2981c8409820000080000000000000000"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x279}], 0x1, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

[ 2311.366326] loop6: detected capacity change from 0 to 40
00:10:22 executing program 3:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{0x0}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r0, &(0x7f0000001180)=ANY=[], 0x220)

[ 2311.371758] loop5: detected capacity change from 0 to 40
[ 2311.379307] loop4: detected capacity change from 0 to 40
[ 2311.402779] syz-executor.6: attempt to access beyond end of device
[ 2311.402779] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2311.403745] Buffer I/O error on dev loop6, logical block 10, lost async page write
[ 2311.443640] syz-executor.4: attempt to access beyond end of device
[ 2311.443640] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2311.444548] Buffer I/O error on dev loop4, logical block 10, lost async page write
[ 2311.451566] loop3: detected capacity change from 0 to 40
[ 2311.462418] FAT-fs (loop3): bogus number of reserved sectors
[ 2311.462920] FAT-fs (loop3): Can't find a valid FAT filesystem
[ 2311.469504] syz-executor.5: attempt to access beyond end of device
[ 2311.469504] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2311.470395] Buffer I/O error on dev loop5, logical block 10, lost async page write
00:10:37 executing program 7:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684fd2981c8409820000080000000000000000"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x2c6}], 0x1, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:10:37 executing program 2:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684f"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x100d}], 0x1, 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(0xffffffffffffffff, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:10:37 executing program 1:
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}}, 0x0, 0x6, 0xffffffffffffffff, 0xb)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
r1 = gettid()
rt_sigqueueinfo(0x0, 0x0, 0x0)
r2 = pidfd_getfd(0xffffffffffffffff, r0, 0x0)
perf_event_open(&(0x7f0000000040)={0x5, 0x80, 0x40, 0x71, 0x2, 0x0, 0x0, 0x8000, 0x20, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, @perf_config_ext={0xff}, 0x0, 0x9b5, 0xfa, 0xd, 0x0, 0x8000, 0x55, 0x0, 0x0, 0x0, 0x3ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000400)={0x2, 0x80, 0x2a, 0x81, 0xe0, 0x40, 0x0, 0x63c5ef1c, 0x80, 0x3, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x7, 0x2, @perf_config_ext={0xf2, 0x6}, 0x0, 0x5, 0xfffffff8, 0x0, 0x1, 0x0, 0x1b6, 0x0, 0x6}, 0x0, 0xd, 0xffffffffffffffff, 0x0)
rt_sigqueueinfo(0x0, 0x0, &(0x7f0000000000))
setsockopt$sock_timeval(r0, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10)
bind$packet(r2, &(0x7f00000000c0)={0x11, 0xfe, 0x0, 0x1, 0xfb, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}}, 0x14)
perf_event_open(&(0x7f0000000100)={0x0, 0x80, 0xff, 0x8, 0x4, 0x1, 0x0, 0x4, 0x684, 0x4, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0xdbc, 0x0, @perf_config_ext={0xd03, 0x80000000}, 0x800, 0x3, 0x3, 0x5, 0x300000000000000, 0x7, 0x7ff, 0x0, 0x0, 0x0, 0x5}, r1, 0x10, 0xffffffffffffffff, 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r3, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
openat(r3, &(0x7f0000000180)='\x00', 0x400040, 0x80)
rt_sigqueueinfo(0x0, 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f0000000240)={'ip6_vti0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x4, 0x0, 0x7f, 0x40, 0xb, @local, @mcast1, 0x88, 0x20, 0x8, 0x2}})

00:10:37 executing program 5:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 21)

00:10:37 executing program 4:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_mount_image$tmpfs(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 20)

00:10:37 executing program 6:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 21)

00:10:37 executing program 3:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r0, &(0x7f0000001180)=ANY=[], 0x220)

00:10:37 executing program 0:
perf_event_open(&(0x7f0000000080)={0x0, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r1, &(0x7f0000000100), 0x0, 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r0, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r2, 0x70, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0x0, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r1, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

[ 2326.534145] loop5: detected capacity change from 0 to 40
[ 2326.577925] loop3: detected capacity change from 0 to 40
[ 2326.579226] FAULT_INJECTION: forcing a failure.
[ 2326.579226] name failslab, interval 1, probability 0, space 0, times 0
[ 2326.580073] CPU: 1 PID: 12351 Comm: syz-executor.5 Not tainted 6.1.0-rc8-next-20221208 #1
[ 2326.580667] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
[ 2326.581255] Call Trace:
[ 2326.581447]  <TASK>
[ 2326.581617]  dump_stack_lvl+0x8f/0xb7
[ 2326.581907]  should_fail_ex.cold+0x5/0xa
[ 2326.582221]  should_failslab+0x9/0x20
[ 2326.582514]  __kmem_cache_alloc_node+0x5b/0x400
[ 2326.582872]  ? iter_file_splice_write+0x169/0xcb0
[ 2326.583233]  ? iter_file_splice_write+0x169/0xcb0
[ 2326.583587]  __kmalloc+0x46/0xc0
[ 2326.583850]  iter_file_splice_write+0x169/0xcb0
[ 2326.584190]  ? generic_file_read_iter+0x330/0x550
[ 2326.584564]  ? generic_file_splice_read+0x1bc/0x4d0
[ 2326.584945]  ? __pfx_iter_file_splice_write+0x10/0x10
[ 2326.585325]  ? __pfx_generic_file_splice_read+0x10/0x10
[ 2326.585715]  ? inode_security+0x105/0x140
[ 2326.586036]  ? security_file_permission+0xb5/0xe0
[ 2326.586395]  ? __pfx_iter_file_splice_write+0x10/0x10
[ 2326.586799]  direct_splice_actor+0x113/0x180
[ 2326.587130]  splice_direct_to_actor+0x33a/0x8c0
[ 2326.587477]  ? __pfx_direct_splice_actor+0x10/0x10
[ 2326.587842]  ? __pfx_splice_direct_to_actor+0x10/0x10
[ 2326.588226]  ? security_file_permission+0xb5/0xe0
[ 2326.588587]  do_splice_direct+0x1bc/0x290
[ 2326.588893]  ? __pfx_do_splice_direct+0x10/0x10
[ 2326.589245]  ? lock_is_held_type+0xdb/0x130
[ 2326.589584]  do_sendfile+0xb1d/0x1280
[ 2326.589886]  ? __pfx_do_sendfile+0x10/0x10
[ 2326.590228]  ? lock_is_held_type+0xdb/0x130
[ 2326.590563]  __x64_sys_sendfile64+0x248/0x2a0
[ 2326.590922]  ? trace_rcu_dyntick+0x1a7/0x250
[ 2326.591265]  ? __pfx___x64_sys_sendfile64+0x10/0x10
[ 2326.591644]  ? syscall_enter_from_user_mode+0x21/0x50
[ 2326.592020]  ? syscall_enter_from_user_mode+0x21/0x50
[ 2326.592412]  do_syscall_64+0x3f/0x90
[ 2326.592688]  entry_SYSCALL_64_after_hwframe+0x72/0xdc
[ 2326.593086] RIP: 0033:0x7f5e74c67b19
[ 2326.593359] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
[ 2326.594377] loop4: detected capacity change from 0 to 40
[ 2326.594655] RSP: 002b:00007f5e721dd188 EFLAGS: 00000246 ORIG_RAX: 0000000000000028
[ 2326.595938] RAX: ffffffffffffffda RBX: 00007f5e74d7af60 RCX: 00007f5e74c67b19
[ 2326.596440] RDX: 0000000000000000 RSI: 0000000000000003 RDI: 0000000000000004
[ 2326.596942] RBP: 00007f5e721dd1d0 R08: 0000000000000000 R09: 0000000000000000
[ 2326.597444] R10: 00000000fffffdef R11: 0000000000000246 R12: 0000000000000002
[ 2326.597946] R13: 00007ffd3dbd647f R14: 00007f5e721dd300 R15: 0000000000022000
[ 2326.598463]  </TASK>
[ 2326.600485] loop6: detected capacity change from 0 to 40
[ 2326.608581] FAT-fs (loop3): bogus number of reserved sectors
[ 2326.609177] FAT-fs (loop3): Can't find a valid FAT filesystem
00:10:37 executing program 1:
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}}, 0x0, 0x6, 0xffffffffffffffff, 0xb)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
r1 = gettid()
rt_sigqueueinfo(0x0, 0x0, 0x0)
r2 = pidfd_getfd(0xffffffffffffffff, r0, 0x0)
perf_event_open(&(0x7f0000000040)={0x5, 0x80, 0x40, 0x71, 0x2, 0x0, 0x0, 0x8000, 0x20, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, @perf_config_ext={0xff}, 0x0, 0x9b5, 0xfa, 0xd, 0x0, 0x8000, 0x55, 0x0, 0x0, 0x0, 0x3ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000400)={0x2, 0x80, 0x2a, 0x81, 0xe0, 0x40, 0x0, 0x63c5ef1c, 0x80, 0x3, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x7, 0x2, @perf_config_ext={0xf2, 0x6}, 0x0, 0x5, 0xfffffff8, 0x0, 0x1, 0x0, 0x1b6, 0x0, 0x6}, 0x0, 0xd, 0xffffffffffffffff, 0x0)
rt_sigqueueinfo(0x0, 0x0, &(0x7f0000000000))
setsockopt$sock_timeval(r0, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10)
bind$packet(r2, &(0x7f00000000c0)={0x11, 0xfe, 0x0, 0x1, 0xfb, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}}, 0x14)
perf_event_open(&(0x7f0000000100)={0x0, 0x80, 0xff, 0x8, 0x4, 0x1, 0x0, 0x4, 0x684, 0x4, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0xdbc, 0x0, @perf_config_ext={0xd03, 0x80000000}, 0x800, 0x3, 0x3, 0x5, 0x300000000000000, 0x7, 0x7ff, 0x0, 0x0, 0x0, 0x5}, r1, 0x10, 0xffffffffffffffff, 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r3, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
openat(r3, &(0x7f0000000180)='\x00', 0x400040, 0x80)
rt_sigqueueinfo(0x0, 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f0000000240)={'ip6_vti0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x4, 0x0, 0x7f, 0x40, 0xb, @local, @mcast1, 0x88, 0x20, 0x8, 0x2}})

00:10:37 executing program 2:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684f"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x100d}], 0x1, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x0)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

[ 2326.685423] syz-executor.6: attempt to access beyond end of device
[ 2326.685423] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2326.686457] Buffer I/O error on dev loop6, logical block 10, lost async page write
[ 2326.704272] syz-executor.4: attempt to access beyond end of device
[ 2326.704272] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2326.706134] Buffer I/O error on dev loop4, logical block 10, lost async page write
00:10:37 executing program 3:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r0, &(0x7f0000001180)=ANY=[], 0x220)

00:10:37 executing program 0:
perf_event_open(&(0x7f0000000080)={0x0, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r1, &(0x7f0000000100), 0x0, 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r0, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r2, 0x78, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0x0, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r1, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:10:37 executing program 5:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 22)

00:10:37 executing program 6:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 22)

00:10:37 executing program 7:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684fd2981c8409820000080000000000000000"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x313}], 0x1, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

[ 2326.863324] loop5: detected capacity change from 0 to 40
[ 2326.918621] loop3: detected capacity change from 0 to 40
[ 2326.931573] syz-executor.5: attempt to access beyond end of device
[ 2326.931573] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2326.932484] Buffer I/O error on dev loop5, logical block 10, lost async page write
[ 2326.938122] FAT-fs (loop3): bogus number of reserved sectors
[ 2326.938933] FAT-fs (loop3): Can't find a valid FAT filesystem
[ 2326.959481] loop6: detected capacity change from 0 to 40
[ 2327.024428] syz-executor.6: attempt to access beyond end of device
[ 2327.024428] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2327.025352] Buffer I/O error on dev loop6, logical block 10, lost async page write
00:10:51 executing program 6:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 23)

00:10:51 executing program 4:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_mount_image$tmpfs(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 21)

00:10:51 executing program 7:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684fd2981c8409820000080000000000000000"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x360}], 0x1, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:10:51 executing program 1:
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}}, 0x0, 0x6, 0xffffffffffffffff, 0xb)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
r1 = gettid()
rt_sigqueueinfo(0x0, 0x0, 0x0)
r2 = pidfd_getfd(0xffffffffffffffff, r0, 0x0)
perf_event_open(&(0x7f0000000040)={0x5, 0x80, 0x40, 0x71, 0x2, 0x0, 0x0, 0x8000, 0x20, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, @perf_config_ext={0xff}, 0x0, 0x9b5, 0xfa, 0xd, 0x0, 0x8000, 0x55, 0x0, 0x0, 0x0, 0x3ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000400)={0x2, 0x80, 0x2a, 0x81, 0xe0, 0x40, 0x0, 0x63c5ef1c, 0x80, 0x3, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x7, 0x2, @perf_config_ext={0xf2, 0x6}, 0x0, 0x5, 0xfffffff8, 0x0, 0x1, 0x0, 0x1b6, 0x0, 0x6}, 0x0, 0xd, 0xffffffffffffffff, 0x0)
rt_sigqueueinfo(0x0, 0x0, &(0x7f0000000000))
setsockopt$sock_timeval(r0, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10)
bind$packet(r2, &(0x7f00000000c0)={0x11, 0xfe, 0x0, 0x1, 0xfb, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}}, 0x14)
perf_event_open(&(0x7f0000000100)={0x0, 0x80, 0xff, 0x8, 0x4, 0x1, 0x0, 0x4, 0x684, 0x4, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0xdbc, 0x0, @perf_config_ext={0xd03, 0x80000000}, 0x800, 0x3, 0x3, 0x5, 0x300000000000000, 0x7, 0x7ff, 0x0, 0x0, 0x0, 0x5}, r1, 0x10, 0xffffffffffffffff, 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r3, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
openat(r3, &(0x7f0000000180)='\x00', 0x400040, 0x80)
rt_sigqueueinfo(0x0, 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f0000000240)={'ip6_vti0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x4, 0x0, 0x7f, 0x40, 0xb, @local, @mcast1, 0x88, 0x20, 0x8, 0x2}})

00:10:51 executing program 2:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684f"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x100d}], 0x1, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x0)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:10:51 executing program 0:
perf_event_open(&(0x7f0000000080)={0x0, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r1, &(0x7f0000000100), 0x0, 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r0, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r2, 0x10c, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0x0, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r1, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:10:51 executing program 5:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 23)

00:10:51 executing program 3:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r0, &(0x7f0000001180)=ANY=[], 0x220)

[ 2341.061089] loop6: detected capacity change from 0 to 40
[ 2341.066440] loop5: detected capacity change from 0 to 40
[ 2341.090827] FAULT_INJECTION: forcing a failure.
[ 2341.090827] name failslab, interval 1, probability 0, space 0, times 0
[ 2341.091897] CPU: 1 PID: 12394 Comm: syz-executor.5 Not tainted 6.1.0-rc8-next-20221208 #1
[ 2341.092472] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
[ 2341.093046] Call Trace:
[ 2341.093237]  <TASK>
[ 2341.093406]  dump_stack_lvl+0x8f/0xb7
[ 2341.093695]  should_fail_ex.cold+0x5/0xa
[ 2341.094002]  ? fat_cache_add.part.0+0x5b4/0xb50
[ 2341.094347]  should_failslab+0x9/0x20
[ 2341.094639]  kmem_cache_alloc+0x5a/0x410
[ 2341.094953]  fat_cache_add.part.0+0x5b4/0xb50
[ 2341.095293]  fat_get_cluster+0x922/0xd40
[ 2341.095607]  ? __pfx_fat_get_cluster+0x10/0x10
[ 2341.095957]  ? __brelse+0x88/0xa0
[ 2341.096242]  fat_get_mapped_cluster+0x216/0x450
[ 2341.096576]  ? __pfx_fat_get_mapped_cluster+0x10/0x10
[ 2341.096957]  ? mark_lock.part.0+0xef/0x2f70
[ 2341.097288]  fat_bmap+0x1fc/0x460
[ 2341.097558]  fat_get_block+0x33e/0x930
[ 2341.097861]  ? __pfx_fat_get_block+0x10/0x10
[ 2341.098190]  ? lock_is_held_type+0xdb/0x130
[ 2341.098526]  __block_write_begin_int+0x380/0x13d0
[ 2341.098889]  ? __pfx_fat_get_block+0x10/0x10
[ 2341.099221]  ? __pfx___block_write_begin_int+0x10/0x10
[ 2341.099601]  ? __pfx___lock_acquire+0x10/0x10
[ 2341.099923]  ? PageHeadHuge+0x169/0x1b0
[ 2341.100227]  ? __pfx_fat_get_block+0x10/0x10
[ 2341.100547]  block_write_begin+0xb9/0x450
[ 2341.100860]  cont_write_begin+0x4fe/0x700
[ 2341.101175]  ? __pfx_fat_get_block+0x10/0x10
[ 2341.101499]  ? mark_held_locks+0x9e/0xe0
[ 2341.101803]  ? __pfx_cont_write_begin+0x10/0x10
[ 2341.102150]  ? ktime_get_coarse_real_ts64+0x15d/0x190
[ 2341.102524]  ? ktime_get_coarse_real_ts64+0x15d/0x190
[ 2341.102912]  ? lockdep_hardirqs_on+0x7d/0x100
[ 2341.103250]  ? ktime_get_coarse_real_ts64+0x15d/0x190
[ 2341.103619]  ? ktime_get_coarse_real_ts64+0x100/0x190
[ 2341.103995]  fat_write_begin+0x89/0x180
[ 2341.104288]  ? __pfx_fat_get_block+0x10/0x10
[ 2341.104619]  generic_perform_write+0x25a/0x580
[ 2341.104968]  ? __pfx_generic_perform_write+0x10/0x10
[ 2341.104985] loop3: detected capacity change from 0 to 40
[ 2341.105330]  ? __pfx_fat_update_time+0x10/0x10
[ 2341.106465]  ? __pfx_file_update_time+0x10/0x10
[ 2341.106822]  ? generic_write_checks+0x2c0/0x400
[ 2341.107168]  __generic_file_write_iter+0x308/0x4b0
[ 2341.107531]  ? do_sendfile+0xb1d/0x1280
[ 2341.107833]  ? __x64_sys_sendfile64+0x248/0x2a0
[ 2341.108179]  generic_file_write_iter+0xe7/0x350
[ 2341.108528]  do_iter_readv_writev+0x211/0x3c0
[ 2341.108871]  ? __pfx_do_iter_readv_writev+0x10/0x10
[ 2341.109239]  ? avc_policy_seqno+0xd/0x70
[ 2341.109549]  ? security_file_permission+0xb5/0xe0
[ 2341.109911]  do_iter_write+0x18b/0x700
[ 2341.110205]  ? lock_is_held_type+0xdb/0x130
[ 2341.110535]  vfs_iter_write+0x74/0xb0
[ 2341.110814]  iter_file_splice_write+0x73e/0xcb0
[ 2341.111186]  ? __pfx_iter_file_splice_write+0x10/0x10
[ 2341.111508] loop4: detected capacity change from 0 to 40
[ 2341.111555]  ? __pfx_generic_file_splice_read+0x10/0x10
[ 2341.112707]  ? inode_security+0x105/0x140
[ 2341.113029]  ? security_file_permission+0xb5/0xe0
[ 2341.113386]  ? __pfx_iter_file_splice_write+0x10/0x10
[ 2341.113763]  direct_splice_actor+0x113/0x180
[ 2341.114089]  splice_direct_to_actor+0x33a/0x8c0
[ 2341.114432]  ? __pfx_direct_splice_actor+0x10/0x10
[ 2341.114781]  ? __pfx_splice_direct_to_actor+0x10/0x10
[ 2341.115151]  ? security_file_permission+0xb5/0xe0
[ 2341.115501]  do_splice_direct+0x1bc/0x290
[ 2341.115790]  ? __pfx_do_splice_direct+0x10/0x10
[ 2341.116131]  ? lock_is_held_type+0xdb/0x130
[ 2341.116443]  do_sendfile+0xb1d/0x1280
[ 2341.116726]  ? __pfx_do_sendfile+0x10/0x10
[ 2341.117039]  ? lock_is_held_type+0xdb/0x130
[ 2341.117362]  __x64_sys_sendfile64+0x248/0x2a0
[ 2341.117674]  ? trace_rcu_dyntick+0x1a7/0x250
[ 2341.117991]  ? __pfx___x64_sys_sendfile64+0x10/0x10
[ 2341.118338]  ? syscall_enter_from_user_mode+0x21/0x50
[ 2341.118694]  ? syscall_enter_from_user_mode+0x21/0x50
[ 2341.119056]  do_syscall_64+0x3f/0x90
[ 2341.119323]  entry_SYSCALL_64_after_hwframe+0x72/0xdc
[ 2341.119689] RIP: 0033:0x7f5e74c67b19
[ 2341.119951] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
[ 2341.121144] RSP: 002b:00007f5e721dd188 EFLAGS: 00000246 ORIG_RAX: 0000000000000028
[ 2341.121660] RAX: ffffffffffffffda RBX: 00007f5e74d7af60 RCX: 00007f5e74c67b19
[ 2341.122136] RDX: 0000000000000000 RSI: 0000000000000003 RDI: 0000000000000004
[ 2341.122615] RBP: 00007f5e721dd1d0 R08: 0000000000000000 R09: 0000000000000000
[ 2341.123102] R10: 00000000fffffdef R11: 0000000000000246 R12: 0000000000000002
[ 2341.123573] R13: 00007ffd3dbd647f R14: 00007f5e721dd300 R15: 0000000000022000
[ 2341.124075]  </TASK>
[ 2341.133330] FAT-fs (loop3): bogus number of reserved sectors
[ 2341.134453] FAT-fs (loop3): Can't find a valid FAT filesystem
[ 2341.193195] FAULT_INJECTION: forcing a failure.
[ 2341.193195] name failslab, interval 1, probability 0, space 0, times 0
[ 2341.194086] CPU: 1 PID: 12402 Comm: syz-executor.4 Not tainted 6.1.0-rc8-next-20221208 #1
[ 2341.194689] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
[ 2341.195295] Call Trace:
[ 2341.195498]  <TASK>
[ 2341.195683]  dump_stack_lvl+0x8f/0xb7
[ 2341.195998]  should_fail_ex.cold+0x5/0xa
[ 2341.196328]  should_failslab+0x9/0x20
[ 2341.196625]  __kmem_cache_alloc_node+0x5b/0x400
[ 2341.196975]  ? iter_file_splice_write+0x169/0xcb0
[ 2341.197345]  ? iter_file_splice_write+0x169/0xcb0
[ 2341.197708]  __kmalloc+0x46/0xc0
[ 2341.197983]  iter_file_splice_write+0x169/0xcb0
[ 2341.198341]  ? generic_file_read_iter+0x330/0x550
[ 2341.198726]  ? generic_file_splice_read+0x1bc/0x4d0
[ 2341.199108]  ? __pfx_iter_file_splice_write+0x10/0x10
[ 2341.199494]  ? __pfx_generic_file_splice_read+0x10/0x10
[ 2341.199894]  ? inode_security+0x105/0x140
[ 2341.200224]  ? security_file_permission+0xb5/0xe0
[ 2341.200584]  ? __pfx_iter_file_splice_write+0x10/0x10
[ 2341.200973]  direct_splice_actor+0x113/0x180
[ 2341.201310]  splice_direct_to_actor+0x33a/0x8c0
[ 2341.201670]  ? __pfx_direct_splice_actor+0x10/0x10
[ 2341.202047]  ? __pfx_splice_direct_to_actor+0x10/0x10
[ 2341.202435]  ? security_file_permission+0xb5/0xe0
[ 2341.202800]  do_splice_direct+0x1bc/0x290
[ 2341.203134]  ? __pfx_do_splice_direct+0x10/0x10
[ 2341.203495]  ? lock_is_held_type+0xdb/0x130
[ 2341.203830]  do_sendfile+0xb1d/0x1280
[ 2341.204137]  ? __pfx_do_sendfile+0x10/0x10
[ 2341.204472]  ? lock_is_held_type+0xdb/0x130
[ 2341.204803]  __x64_sys_sendfile64+0x248/0x2a0
[ 2341.205142]  ? trace_rcu_dyntick+0x1a7/0x250
[ 2341.205483]  ? __pfx___x64_sys_sendfile64+0x10/0x10
[ 2341.205850]  ? syscall_enter_from_user_mode+0x21/0x50
[ 2341.206233]  ? syscall_enter_from_user_mode+0x21/0x50
[ 2341.206625]  do_syscall_64+0x3f/0x90
[ 2341.206920]  entry_SYSCALL_64_after_hwframe+0x72/0xdc
[ 2341.207303] RIP: 0033:0x7f5dbe2acb19
[ 2341.207576] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
[ 2341.208878] RSP: 002b:00007f5dbb822188 EFLAGS: 00000246 ORIG_RAX: 0000000000000028
[ 2341.209436] RAX: ffffffffffffffda RBX: 00007f5dbe3bff60 RCX: 00007f5dbe2acb19
[ 2341.209968] RDX: 0000000000000000 RSI: 0000000000000003 RDI: 0000000000000004
[ 2341.210490] RBP: 00007f5dbb8221d0 R08: 0000000000000000 R09: 0000000000000000
[ 2341.211038] R10: 00000000fffffdef R11: 0000000000000246 R12: 0000000000000002
[ 2341.211556] R13: 00007ffc7a53101f R14: 00007f5dbb822300 R15: 0000000000022000
[ 2341.212095]  </TASK>
[ 2341.214682] FAULT_INJECTION: forcing a failure.
[ 2341.214682] name failslab, interval 1, probability 0, space 0, times 0
[ 2341.215509] CPU: 1 PID: 12395 Comm: syz-executor.6 Not tainted 6.1.0-rc8-next-20221208 #1
[ 2341.216109] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
[ 2341.216708] Call Trace:
[ 2341.216905]  <TASK>
[ 2341.217084]  dump_stack_lvl+0x8f/0xb7
[ 2341.217377]  should_fail_ex.cold+0x5/0xa
[ 2341.217691]  ? fat_cache_add.part.0+0x5b4/0xb50
[ 2341.218045]  should_failslab+0x9/0x20
[ 2341.218340]  kmem_cache_alloc+0x5a/0x410
[ 2341.218652]  fat_cache_add.part.0+0x5b4/0xb50
[ 2341.219054]  fat_get_cluster+0x922/0xd40
[ 2341.219356]  ? __pfx_fat_get_cluster+0x10/0x10
[ 2341.219692]  ? __brelse+0x88/0xa0
[ 2341.219966]  fat_get_mapped_cluster+0x216/0x450
[ 2341.220293]  ? __pfx_fat_get_mapped_cluster+0x10/0x10
[ 2341.220653]  ? mark_lock.part.0+0xef/0x2f70
[ 2341.220975]  fat_bmap+0x1fc/0x460
[ 2341.221237]  fat_get_block+0x33e/0x930
[ 2341.221529]  ? __pfx_fat_get_block+0x10/0x10
[ 2341.221840]  ? lock_is_held_type+0xdb/0x130
[ 2341.222166]  __block_write_begin_int+0x380/0x13d0
[ 2341.222510]  ? __pfx_fat_get_block+0x10/0x10
[ 2341.222829]  ? __pfx___block_write_begin_int+0x10/0x10
[ 2341.223199]  ? __pfx___lock_acquire+0x10/0x10
[ 2341.223525]  ? PageHeadHuge+0x169/0x1b0
[ 2341.223827]  ? __pfx_fat_get_block+0x10/0x10
[ 2341.224141]  block_write_begin+0xb9/0x450
[ 2341.224439]  cont_write_begin+0x4fe/0x700
[ 2341.224753]  ? __pfx_fat_get_block+0x10/0x10
[ 2341.225071]  ? mark_held_locks+0x9e/0xe0
[ 2341.225371]  ? __pfx_cont_write_begin+0x10/0x10
[ 2341.225694]  ? ktime_get_coarse_real_ts64+0x15d/0x190
[ 2341.226058]  ? ktime_get_coarse_real_ts64+0x15d/0x190
[ 2341.226420]  ? lockdep_hardirqs_on+0x7d/0x100
[ 2341.226750]  ? ktime_get_coarse_real_ts64+0x15d/0x190
[ 2341.227119]  ? ktime_get_coarse_real_ts64+0x100/0x190
[ 2341.227485]  fat_write_begin+0x89/0x180
[ 2341.227771]  ? __pfx_fat_get_block+0x10/0x10
[ 2341.228099]  generic_perform_write+0x25a/0x580
[ 2341.228458]  ? __pfx_generic_perform_write+0x10/0x10
[ 2341.228840]  ? __pfx_fat_update_time+0x10/0x10
[ 2341.229188]  ? __pfx_file_update_time+0x10/0x10
[ 2341.229546]  ? generic_write_checks+0x2c0/0x400
[ 2341.229903]  __generic_file_write_iter+0x308/0x4b0
[ 2341.230279]  ? do_sendfile+0xb1d/0x1280
[ 2341.230581]  ? __x64_sys_sendfile64+0x248/0x2a0
[ 2341.230944]  generic_file_write_iter+0xe7/0x350
[ 2341.231313]  do_iter_readv_writev+0x211/0x3c0
[ 2341.231661]  ? __pfx_do_iter_readv_writev+0x10/0x10
[ 2341.232044]  ? avc_policy_seqno+0xd/0x70
[ 2341.232366]  ? security_file_permission+0xb5/0xe0
[ 2341.232732]  do_iter_write+0x18b/0x700
[ 2341.233035]  ? lock_is_held_type+0xdb/0x130
[ 2341.233376]  vfs_iter_write+0x74/0xb0
[ 2341.233677]  iter_file_splice_write+0x73e/0xcb0
[ 2341.234047]  ? __pfx_iter_file_splice_write+0x10/0x10
[ 2341.234431]  ? __pfx_generic_file_splice_read+0x10/0x10
[ 2341.234835]  ? inode_security+0x105/0x140
[ 2341.235176]  ? security_file_permission+0xb5/0xe0
[ 2341.235547]  ? __pfx_iter_file_splice_write+0x10/0x10
[ 2341.235935]  direct_splice_actor+0x113/0x180
[ 2341.236277]  splice_direct_to_actor+0x33a/0x8c0
[ 2341.236636]  ? __pfx_direct_splice_actor+0x10/0x10
[ 2341.237013]  ? __pfx_splice_direct_to_actor+0x10/0x10
[ 2341.237393]  ? security_file_permission+0xb5/0xe0
[ 2341.237766]  do_splice_direct+0x1bc/0x290
[ 2341.238077]  ? __pfx_do_splice_direct+0x10/0x10
[ 2341.238447]  ? lock_is_held_type+0xdb/0x130
[ 2341.238780]  do_sendfile+0xb1d/0x1280
[ 2341.239094]  ? __pfx_do_sendfile+0x10/0x10
[ 2341.239421]  ? lock_is_held_type+0xdb/0x130
[ 2341.239756]  __x64_sys_sendfile64+0x248/0x2a0
[ 2341.240105]  ? trace_rcu_dyntick+0x1a7/0x250
[ 2341.240450]  ? __pfx___x64_sys_sendfile64+0x10/0x10
[ 2341.240824]  ? syscall_enter_from_user_mode+0x21/0x50
[ 2341.241212]  ? syscall_enter_from_user_mode+0x21/0x50
[ 2341.241592]  do_syscall_64+0x3f/0x90
[ 2341.241878]  entry_SYSCALL_64_after_hwframe+0x72/0xdc
[ 2341.242273] RIP: 0033:0x7f3186383b19
[ 2341.242553] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
[ 2341.243871] RSP: 002b:00007f31838f9188 EFLAGS: 00000246 ORIG_RAX: 0000000000000028
[ 2341.244433] RAX: ffffffffffffffda RBX: 00007f3186496f60 RCX: 00007f3186383b19
[ 2341.244951] RDX: 0000000000000000 RSI: 0000000000000003 RDI: 0000000000000004
[ 2341.245470] RBP: 00007f31838f91d0 R08: 0000000000000000 R09: 0000000000000000
[ 2341.245996] R10: 00000000fffffdef R11: 0000000000000246 R12: 0000000000000002
[ 2341.246508] R13: 00007ffc1396bf2f R14: 00007f31838f9300 R15: 0000000000022000
[ 2341.247055]  </TASK>
[ 2341.258667] syz-executor.5: attempt to access beyond end of device
[ 2341.258667] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2341.259573] Buffer I/O error on dev loop5, logical block 10, lost async page write
00:10:51 executing program 2:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684f"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x100d}], 0x1, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x0)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:10:51 executing program 5:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 24)

00:10:51 executing program 3:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00", 0xc}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r0, &(0x7f0000001180)=ANY=[], 0x220)

[ 2341.364761] loop5: detected capacity change from 0 to 40
[ 2341.396235] syz-executor.6: attempt to access beyond end of device
[ 2341.396235] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2341.397149] Buffer I/O error on dev loop6, logical block 10, lost async page write
[ 2341.453337] syz-executor.5: attempt to access beyond end of device
[ 2341.453337] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2341.455243] Buffer I/O error on dev loop5, logical block 10, lost async page write
[ 2341.462086] loop3: detected capacity change from 0 to 40
[ 2341.478025] FAT-fs (loop3): bogus number of reserved sectors
[ 2341.478458] FAT-fs (loop3): Can't find a valid FAT filesystem
00:11:06 executing program 3:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00", 0xc}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r0, &(0x7f0000001180)=ANY=[], 0x220)

00:11:06 executing program 0:
perf_event_open(&(0x7f0000000080)={0x0, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r1, &(0x7f0000000100), 0x0, 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r0, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r2, 0x10d, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0x0, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r1, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:11:06 executing program 5:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 25)

00:11:06 executing program 7:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684fd2981c8409820000080000000000000000"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x3b0}], 0x1, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:11:06 executing program 1:
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}}, 0x0, 0x6, 0xffffffffffffffff, 0xb)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
r1 = gettid()
rt_sigqueueinfo(0x0, 0x0, 0x0)
r2 = pidfd_getfd(0xffffffffffffffff, r0, 0x0)
perf_event_open(&(0x7f0000000040)={0x5, 0x80, 0x40, 0x71, 0x2, 0x0, 0x0, 0x8000, 0x20, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, @perf_config_ext={0xff}, 0x0, 0x9b5, 0xfa, 0xd, 0x0, 0x8000, 0x55, 0x0, 0x0, 0x0, 0x3ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000400)={0x2, 0x80, 0x2a, 0x81, 0xe0, 0x40, 0x0, 0x63c5ef1c, 0x80, 0x3, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x7, 0x2, @perf_config_ext={0xf2, 0x6}, 0x0, 0x5, 0xfffffff8, 0x0, 0x1, 0x0, 0x1b6, 0x0, 0x6}, 0x0, 0xd, 0xffffffffffffffff, 0x0)
rt_sigqueueinfo(0x0, 0x0, &(0x7f0000000000))
setsockopt$sock_timeval(r0, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10)
bind$packet(r2, &(0x7f00000000c0)={0x11, 0xfe, 0x0, 0x1, 0xfb, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}}, 0x14)
perf_event_open(&(0x7f0000000100)={0x0, 0x80, 0xff, 0x8, 0x4, 0x1, 0x0, 0x4, 0x684, 0x4, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0xdbc, 0x0, @perf_config_ext={0xd03, 0x80000000}, 0x800, 0x3, 0x3, 0x5, 0x300000000000000, 0x7, 0x7ff, 0x0, 0x0, 0x0, 0x5}, r1, 0x10, 0xffffffffffffffff, 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r3, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
openat(r3, &(0x7f0000000180)='\x00', 0x400040, 0x80)
rt_sigqueueinfo(0x0, 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f0000000240)={'ip6_vti0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x4, 0x0, 0x7f, 0x40, 0xb, @local, @mcast1, 0x88, 0x20, 0x8, 0x2}})

00:11:06 executing program 4:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_mount_image$tmpfs(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 22)

00:11:06 executing program 2:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684f"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x100d}], 0x1, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, 0x0, 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:11:06 executing program 6:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 24)

[ 2355.833869] loop5: detected capacity change from 0 to 40
[ 2355.839583] loop6: detected capacity change from 0 to 40
[ 2355.842035] loop3: detected capacity change from 0 to 40
[ 2355.849887] loop4: detected capacity change from 0 to 40
[ 2355.862640] FAT-fs (loop3): bogus number of reserved sectors
[ 2355.863648] FAT-fs (loop3): Can't find a valid FAT filesystem
[ 2355.890413] syz-executor.5: attempt to access beyond end of device
[ 2355.890413] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2355.891329] Buffer I/O error on dev loop5, logical block 10, lost async page write
[ 2355.948748] syz-executor.4: attempt to access beyond end of device
[ 2355.948748] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2355.949622] Buffer I/O error on dev loop4, logical block 10, lost async page write
[ 2355.970898] syz-executor.6: attempt to access beyond end of device
[ 2355.970898] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2355.972764] Buffer I/O error on dev loop6, logical block 10, lost async page write
00:11:06 executing program 5:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 26)

00:11:06 executing program 1:
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}}, 0x0, 0x6, 0xffffffffffffffff, 0xb)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
r1 = gettid()
rt_sigqueueinfo(0x0, 0x0, 0x0)
r2 = pidfd_getfd(0xffffffffffffffff, r0, 0x0)
perf_event_open(&(0x7f0000000040)={0x5, 0x80, 0x40, 0x71, 0x2, 0x0, 0x0, 0x8000, 0x20, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, @perf_config_ext={0xff}, 0x0, 0x9b5, 0xfa, 0xd, 0x0, 0x8000, 0x55, 0x0, 0x0, 0x0, 0x3ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000400)={0x2, 0x80, 0x2a, 0x81, 0xe0, 0x40, 0x0, 0x63c5ef1c, 0x80, 0x3, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x7, 0x2, @perf_config_ext={0xf2, 0x6}, 0x0, 0x5, 0xfffffff8, 0x0, 0x1, 0x0, 0x1b6, 0x0, 0x6}, 0x0, 0xd, 0xffffffffffffffff, 0x0)
rt_sigqueueinfo(0x0, 0x0, &(0x7f0000000000))
setsockopt$sock_timeval(r0, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10)
bind$packet(r2, &(0x7f00000000c0)={0x11, 0xfe, 0x0, 0x1, 0xfb, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}}, 0x14)
perf_event_open(&(0x7f0000000100)={0x0, 0x80, 0xff, 0x8, 0x4, 0x1, 0x0, 0x4, 0x684, 0x4, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0xdbc, 0x0, @perf_config_ext={0xd03, 0x80000000}, 0x800, 0x3, 0x3, 0x5, 0x300000000000000, 0x7, 0x7ff, 0x0, 0x0, 0x0, 0x5}, r1, 0x10, 0xffffffffffffffff, 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r3, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
openat(r3, &(0x7f0000000180)='\x00', 0x400040, 0x80)
rt_sigqueueinfo(0x0, 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f0000000240)={'ip6_vti0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x4, 0x0, 0x7f, 0x40, 0xb, @local, @mcast1, 0x88, 0x20, 0x8, 0x2}})

00:11:06 executing program 4:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_mount_image$tmpfs(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 23)

00:11:06 executing program 6:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 25)

00:11:06 executing program 3:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00", 0xc}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r0, &(0x7f0000001180)=ANY=[], 0x220)

[ 2356.093299] loop5: detected capacity change from 0 to 40
00:11:06 executing program 2:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684f"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x100d}], 0x1, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, 0x0, 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:11:06 executing program 0:
perf_event_open(&(0x7f0000000080)={0x0, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r1, &(0x7f0000000100), 0x0, 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r0, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r2, 0x281, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0x0, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r1, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:11:06 executing program 7:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684fd2981c8409820000080000000000000000"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x3f3}], 0x1, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

[ 2356.145837] loop6: detected capacity change from 0 to 40
[ 2356.153888] loop4: detected capacity change from 0 to 40
[ 2356.186370] loop3: detected capacity change from 0 to 40
[ 2356.196595] FAT-fs (loop3): bogus number of reserved sectors
[ 2356.197099] FAT-fs (loop3): Can't find a valid FAT filesystem
[ 2356.210079] syz-executor.6: attempt to access beyond end of device
[ 2356.210079] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2356.210942] Buffer I/O error on dev loop6, logical block 10, lost async page write
[ 2356.266744] syz-executor.5: attempt to access beyond end of device
[ 2356.266744] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2356.268570] Buffer I/O error on dev loop5, logical block 10, lost async page write
00:11:06 executing program 6:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 26)

[ 2356.303967] syz-executor.4: attempt to access beyond end of device
[ 2356.303967] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2356.305724] Buffer I/O error on dev loop4, logical block 10, lost async page write
00:11:06 executing program 3:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440", 0x12}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r0, &(0x7f0000001180)=ANY=[], 0x220)

00:11:06 executing program 5:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 27)

00:11:07 executing program 1:
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}}, 0x0, 0x6, 0xffffffffffffffff, 0xb)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
r1 = gettid()
rt_sigqueueinfo(0x0, 0x0, 0x0)
r2 = pidfd_getfd(0xffffffffffffffff, r0, 0x0)
perf_event_open(&(0x7f0000000040)={0x5, 0x80, 0x40, 0x71, 0x2, 0x0, 0x0, 0x8000, 0x20, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, @perf_config_ext={0xff}, 0x0, 0x9b5, 0xfa, 0xd, 0x0, 0x8000, 0x55, 0x0, 0x0, 0x0, 0x3ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000400)={0x2, 0x80, 0x2a, 0x81, 0xe0, 0x40, 0x0, 0x63c5ef1c, 0x80, 0x3, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x7, 0x2, @perf_config_ext={0xf2, 0x6}, 0x0, 0x5, 0xfffffff8, 0x0, 0x1, 0x0, 0x1b6, 0x0, 0x6}, 0x0, 0xd, 0xffffffffffffffff, 0x0)
rt_sigqueueinfo(0x0, 0x0, &(0x7f0000000000))
setsockopt$sock_timeval(r0, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10)
bind$packet(r2, &(0x7f00000000c0)={0x11, 0xfe, 0x0, 0x1, 0xfb, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}}, 0x14)
perf_event_open(&(0x7f0000000100)={0x0, 0x80, 0xff, 0x8, 0x4, 0x1, 0x0, 0x4, 0x684, 0x4, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0xdbc, 0x0, @perf_config_ext={0xd03, 0x80000000}, 0x800, 0x3, 0x3, 0x5, 0x300000000000000, 0x7, 0x7ff, 0x0, 0x0, 0x0, 0x5}, r1, 0x10, 0xffffffffffffffff, 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r3, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
openat(r3, &(0x7f0000000180)='\x00', 0x400040, 0x80)
rt_sigqueueinfo(0x0, 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f0000000240)={'ip6_vti0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x4, 0x0, 0x7f, 0x40, 0xb, @local, @mcast1, 0x88, 0x20, 0x8, 0x2}})

[ 2356.403580] loop3: detected capacity change from 0 to 40
[ 2356.419190] FAT-fs (loop3): invalid media value (0x00)
[ 2356.419585] FAT-fs (loop3): Can't find a valid FAT filesystem
[ 2356.427617] loop6: detected capacity change from 0 to 40
[ 2356.434686] loop5: detected capacity change from 0 to 40
[ 2356.479260] syz-executor.5: attempt to access beyond end of device
[ 2356.479260] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2356.480145] Buffer I/O error on dev loop5, logical block 10, lost async page write
[ 2356.490318] syz-executor.6: attempt to access beyond end of device
[ 2356.490318] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2356.491285] Buffer I/O error on dev loop6, logical block 10, lost async page write
00:11:21 executing program 6:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 27)

00:11:21 executing program 4:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_mount_image$tmpfs(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 24)

00:11:21 executing program 3:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440", 0x12}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r0, &(0x7f0000001180)=ANY=[], 0x220)

00:11:21 executing program 2:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684f"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x100d}], 0x1, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, 0x0, 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:11:21 executing program 0:
perf_event_open(&(0x7f0000000080)={0x0, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r1, &(0x7f0000000100), 0x0, 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r0, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r2, 0x300, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0x0, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r1, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:11:21 executing program 7:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684fd2981c8409820000080000000000000000"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x442}], 0x1, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:11:21 executing program 5:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 28)

00:11:21 executing program 1:
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}}, 0x0, 0x6, 0xffffffffffffffff, 0xb)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
r1 = gettid()
rt_sigqueueinfo(0x0, 0x0, 0x0)
r2 = pidfd_getfd(0xffffffffffffffff, r0, 0x0)
perf_event_open(&(0x7f0000000040)={0x5, 0x80, 0x40, 0x71, 0x2, 0x0, 0x0, 0x8000, 0x20, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, @perf_config_ext={0xff}, 0x0, 0x9b5, 0xfa, 0xd, 0x0, 0x8000, 0x55, 0x0, 0x0, 0x0, 0x3ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000400)={0x2, 0x80, 0x2a, 0x81, 0xe0, 0x40, 0x0, 0x63c5ef1c, 0x80, 0x3, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x7, 0x2, @perf_config_ext={0xf2, 0x6}, 0x0, 0x5, 0xfffffff8, 0x0, 0x1, 0x0, 0x1b6, 0x0, 0x6}, 0x0, 0xd, 0xffffffffffffffff, 0x0)
rt_sigqueueinfo(0x0, 0x0, &(0x7f0000000000))
setsockopt$sock_timeval(r0, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10)
bind$packet(r2, &(0x7f00000000c0)={0x11, 0xfe, 0x0, 0x1, 0xfb, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}}, 0x14)
perf_event_open(&(0x7f0000000100)={0x0, 0x80, 0xff, 0x8, 0x4, 0x1, 0x0, 0x4, 0x684, 0x4, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0xdbc, 0x0, @perf_config_ext={0xd03, 0x80000000}, 0x800, 0x3, 0x3, 0x5, 0x300000000000000, 0x7, 0x7ff, 0x0, 0x0, 0x0, 0x5}, r1, 0x10, 0xffffffffffffffff, 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r3, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
openat(r3, &(0x7f0000000180)='\x00', 0x400040, 0x80)
rt_sigqueueinfo(0x0, 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f0000000240)={'ip6_vti0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x4, 0x0, 0x7f, 0x40, 0xb, @local, @mcast1, 0x88, 0x20, 0x8, 0x2}})

[ 2370.718540] loop4: detected capacity change from 0 to 40
[ 2370.754598] syz-executor.4: attempt to access beyond end of device
[ 2370.754598] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2370.755524] Buffer I/O error on dev loop4, logical block 10, lost async page write
[ 2370.788496] loop3: detected capacity change from 0 to 40
[ 2370.803036] FAT-fs (loop3): invalid media value (0x00)
[ 2370.803480] FAT-fs (loop3): Can't find a valid FAT filesystem
[ 2370.806467] loop5: detected capacity change from 0 to 40
[ 2370.810610] loop6: detected capacity change from 0 to 40
00:11:21 executing program 1:
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}}, 0x0, 0x6, 0xffffffffffffffff, 0xb)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
r1 = gettid()
rt_sigqueueinfo(0x0, 0x0, 0x0)
r2 = pidfd_getfd(0xffffffffffffffff, r0, 0x0)
perf_event_open(&(0x7f0000000040)={0x5, 0x80, 0x40, 0x71, 0x2, 0x0, 0x0, 0x8000, 0x20, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, @perf_config_ext={0xff}, 0x0, 0x9b5, 0xfa, 0xd, 0x0, 0x8000, 0x55, 0x0, 0x0, 0x0, 0x3ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000400)={0x2, 0x80, 0x2a, 0x81, 0xe0, 0x40, 0x0, 0x63c5ef1c, 0x80, 0x3, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x7, 0x2, @perf_config_ext={0xf2, 0x6}, 0x0, 0x5, 0xfffffff8, 0x0, 0x1, 0x0, 0x1b6, 0x0, 0x6}, 0x0, 0xd, 0xffffffffffffffff, 0x0)
rt_sigqueueinfo(0x0, 0x0, &(0x7f0000000000))
setsockopt$sock_timeval(r0, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10)
bind$packet(r2, &(0x7f00000000c0)={0x11, 0xfe, 0x0, 0x1, 0xfb, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}}, 0x14)
perf_event_open(&(0x7f0000000100)={0x0, 0x80, 0xff, 0x8, 0x4, 0x1, 0x0, 0x4, 0x684, 0x4, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0xdbc, 0x0, @perf_config_ext={0xd03, 0x80000000}, 0x800, 0x3, 0x3, 0x5, 0x300000000000000, 0x7, 0x7ff, 0x0, 0x0, 0x0, 0x5}, r1, 0x10, 0xffffffffffffffff, 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r3, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
openat(r3, &(0x7f0000000180)='\x00', 0x400040, 0x80)
rt_sigqueueinfo(0x0, 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f0000000240)={'ip6_vti0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x4, 0x0, 0x7f, 0x40, 0xb, @local, @mcast1, 0x88, 0x20, 0x8, 0x2}})

00:11:21 executing program 4:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_mount_image$tmpfs(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 25)

[ 2370.923394] syz-executor.6: attempt to access beyond end of device
[ 2370.923394] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2370.927374] Buffer I/O error on dev loop6, logical block 10, lost async page write
00:11:21 executing program 3:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440", 0x12}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r0, &(0x7f0000001180)=ANY=[], 0x220)

[ 2370.931795] syz-executor.5: attempt to access beyond end of device
[ 2370.931795] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2370.933540] Buffer I/O error on dev loop5, logical block 10, lost async page write
[ 2370.949725] loop4: detected capacity change from 0 to 40
00:11:21 executing program 0:
perf_event_open(&(0x7f0000000080)={0x0, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r1, &(0x7f0000000100), 0x0, 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r0, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r2, 0x321, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0x0, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r1, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

[ 2371.014250] loop3: detected capacity change from 0 to 40
[ 2371.023833] FAT-fs (loop3): invalid media value (0x00)
[ 2371.024243] FAT-fs (loop3): Can't find a valid FAT filesystem
00:11:21 executing program 1:
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}}, 0x0, 0x6, 0xffffffffffffffff, 0xb)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
r1 = gettid()
rt_sigqueueinfo(0x0, 0x0, 0x0)
r2 = pidfd_getfd(0xffffffffffffffff, r0, 0x0)
perf_event_open(&(0x7f0000000040)={0x5, 0x80, 0x40, 0x71, 0x2, 0x0, 0x0, 0x8000, 0x20, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, @perf_config_ext={0xff}, 0x0, 0x9b5, 0xfa, 0xd, 0x0, 0x8000, 0x55, 0x0, 0x0, 0x0, 0x3ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000400)={0x2, 0x80, 0x2a, 0x81, 0xe0, 0x40, 0x0, 0x63c5ef1c, 0x80, 0x3, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x7, 0x2, @perf_config_ext={0xf2, 0x6}, 0x0, 0x5, 0xfffffff8, 0x0, 0x1, 0x0, 0x1b6, 0x0, 0x6}, 0x0, 0xd, 0xffffffffffffffff, 0x0)
rt_sigqueueinfo(0x0, 0x0, &(0x7f0000000000))
setsockopt$sock_timeval(r0, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10)
bind$packet(r2, &(0x7f00000000c0)={0x11, 0xfe, 0x0, 0x1, 0xfb, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}}, 0x14)
perf_event_open(&(0x7f0000000100)={0x0, 0x80, 0xff, 0x8, 0x4, 0x1, 0x0, 0x4, 0x684, 0x4, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0xdbc, 0x0, @perf_config_ext={0xd03, 0x80000000}, 0x800, 0x3, 0x3, 0x5, 0x300000000000000, 0x7, 0x7ff, 0x0, 0x0, 0x0, 0x5}, r1, 0x10, 0xffffffffffffffff, 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r3, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
openat(r3, &(0x7f0000000180)='\x00', 0x400040, 0x80)
rt_sigqueueinfo(0x0, 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f0000000240)={'ip6_vti0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x4, 0x0, 0x7f, 0x40, 0xb, @local, @mcast1, 0x88, 0x20, 0x8, 0x2}})

00:11:21 executing program 6:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 28)

[ 2371.126680] syz-executor.4: attempt to access beyond end of device
[ 2371.126680] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2371.128627] Buffer I/O error on dev loop4, logical block 10, lost async page write
[ 2371.228465] loop6: detected capacity change from 0 to 40
[ 2371.254299] syz-executor.6: attempt to access beyond end of device
[ 2371.254299] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2371.255339] Buffer I/O error on dev loop6, logical block 10, lost async page write
00:11:40 executing program 2:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684f"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x100d}], 0x1, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x0)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:11:40 executing program 7:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684fd2981c8409820000080000000000000000"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x48f}], 0x1, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:11:40 executing program 6:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 29)

00:11:40 executing program 4:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_mount_image$tmpfs(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 26)

00:11:40 executing program 3:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034", 0x15}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r0, &(0x7f0000001180)=ANY=[], 0x220)

00:11:40 executing program 0:
perf_event_open(&(0x7f0000000080)={0x0, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r1, &(0x7f0000000100), 0x0, 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r0, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r2, 0x500, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0x0, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r1, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:11:40 executing program 1:
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}}, 0x0, 0x6, 0xffffffffffffffff, 0xb)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
r1 = gettid()
rt_sigqueueinfo(0x0, 0x0, 0x0)
r2 = pidfd_getfd(0xffffffffffffffff, r0, 0x0)
perf_event_open(&(0x7f0000000040)={0x5, 0x80, 0x40, 0x71, 0x2, 0x0, 0x0, 0x8000, 0x20, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, @perf_config_ext={0xff}, 0x0, 0x9b5, 0xfa, 0xd, 0x0, 0x8000, 0x55, 0x0, 0x0, 0x0, 0x3ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000400)={0x2, 0x80, 0x2a, 0x81, 0xe0, 0x40, 0x0, 0x63c5ef1c, 0x80, 0x3, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x7, 0x2, @perf_config_ext={0xf2, 0x6}, 0x0, 0x5, 0xfffffff8, 0x0, 0x1, 0x0, 0x1b6, 0x0, 0x6}, 0x0, 0xd, 0xffffffffffffffff, 0x0)
rt_sigqueueinfo(0x0, 0x0, &(0x7f0000000000))
setsockopt$sock_timeval(r0, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10)
bind$packet(r2, &(0x7f00000000c0)={0x11, 0xfe, 0x0, 0x1, 0xfb, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}}, 0x14)
perf_event_open(&(0x7f0000000100)={0x0, 0x80, 0xff, 0x8, 0x4, 0x1, 0x0, 0x4, 0x684, 0x4, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0xdbc, 0x0, @perf_config_ext={0xd03, 0x80000000}, 0x800, 0x3, 0x3, 0x5, 0x300000000000000, 0x7, 0x7ff, 0x0, 0x0, 0x0, 0x5}, r1, 0x10, 0xffffffffffffffff, 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r3, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
openat(r3, &(0x7f0000000180)='\x00', 0x400040, 0x80)
rt_sigqueueinfo(0x0, 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f0000000240)={'ip6_vti0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x4, 0x0, 0x7f, 0x40, 0xb, @local, @mcast1, 0x88, 0x20, 0x8, 0x2}})

00:11:40 executing program 5:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 29)

[ 2389.970911] loop6: detected capacity change from 0 to 40
[ 2389.980383] loop3: detected capacity change from 0 to 40
[ 2389.981427] loop5: detected capacity change from 0 to 40
[ 2389.986145] loop4: detected capacity change from 0 to 40
[ 2390.002490] FAT-fs (loop3): invalid media value (0x00)
[ 2390.003249] FAT-fs (loop3): Can't find a valid FAT filesystem
[ 2390.068886] syz-executor.6: attempt to access beyond end of device
[ 2390.068886] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2390.070900] Buffer I/O error on dev loop6, logical block 10, lost async page write
00:11:40 executing program 0:
perf_event_open(&(0x7f0000000080)={0x0, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r1, &(0x7f0000000100), 0x0, 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r0, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r2, 0x600, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0x0, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r1, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

[ 2390.157327] syz-executor.5: attempt to access beyond end of device
[ 2390.157327] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2390.158938] Buffer I/O error on dev loop5, logical block 10, lost async page write
[ 2390.186445] syz-executor.4: attempt to access beyond end of device
[ 2390.186445] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2390.188057] Buffer I/O error on dev loop4, logical block 10, lost async page write
00:11:40 executing program 6:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 30)

00:11:40 executing program 3:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034", 0x15}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r0, &(0x7f0000001180)=ANY=[], 0x220)

00:11:40 executing program 1:
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}}, 0x0, 0x6, 0xffffffffffffffff, 0xb)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
r1 = gettid()
rt_sigqueueinfo(0x0, 0x0, 0x0)
r2 = pidfd_getfd(0xffffffffffffffff, r0, 0x0)
perf_event_open(&(0x7f0000000040)={0x5, 0x80, 0x40, 0x71, 0x2, 0x0, 0x0, 0x8000, 0x20, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, @perf_config_ext={0xff}, 0x0, 0x9b5, 0xfa, 0xd, 0x0, 0x8000, 0x55, 0x0, 0x0, 0x0, 0x3ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000400)={0x2, 0x80, 0x2a, 0x81, 0xe0, 0x40, 0x0, 0x63c5ef1c, 0x80, 0x3, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x7, 0x2, @perf_config_ext={0xf2, 0x6}, 0x0, 0x5, 0xfffffff8, 0x0, 0x1, 0x0, 0x1b6, 0x0, 0x6}, 0x0, 0xd, 0xffffffffffffffff, 0x0)
rt_sigqueueinfo(0x0, 0x0, &(0x7f0000000000))
setsockopt$sock_timeval(r0, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10)
bind$packet(r2, &(0x7f00000000c0)={0x11, 0xfe, 0x0, 0x1, 0xfb, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}}, 0x14)
perf_event_open(&(0x7f0000000100)={0x0, 0x80, 0xff, 0x8, 0x4, 0x1, 0x0, 0x4, 0x684, 0x4, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0xdbc, 0x0, @perf_config_ext={0xd03, 0x80000000}, 0x800, 0x3, 0x3, 0x5, 0x300000000000000, 0x7, 0x7ff, 0x0, 0x0, 0x0, 0x5}, r1, 0x10, 0xffffffffffffffff, 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r3, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
openat(r3, &(0x7f0000000180)='\x00', 0x400040, 0x80)
rt_sigqueueinfo(0x0, 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f0000000240)={'ip6_vti0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x4, 0x0, 0x7f, 0x40, 0xb, @local, @mcast1, 0x88, 0x20, 0x8, 0x2}})

00:11:40 executing program 5:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 30)

00:11:40 executing program 4:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_mount_image$tmpfs(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 27)

[ 2390.361720] loop3: detected capacity change from 0 to 40
[ 2390.394225] FAT-fs (loop3): invalid media value (0x00)
[ 2390.394852] FAT-fs (loop3): Can't find a valid FAT filesystem
[ 2390.404257] loop6: detected capacity change from 0 to 40
[ 2390.480474] loop4: detected capacity change from 0 to 40
[ 2390.506202] loop5: detected capacity change from 0 to 40
[ 2390.510471] syz-executor.6: attempt to access beyond end of device
[ 2390.510471] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2390.511793] Buffer I/O error on dev loop6, logical block 10, lost async page write
[ 2390.580941] syz-executor.4: attempt to access beyond end of device
[ 2390.580941] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2390.582278] Buffer I/O error on dev loop4, logical block 10, lost async page write
[ 2390.623951] syz-executor.5: attempt to access beyond end of device
[ 2390.623951] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2390.625189] Buffer I/O error on dev loop5, logical block 10, lost async page write
00:11:58 executing program 0:
perf_event_open(&(0x7f0000000080)={0x0, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r1, &(0x7f0000000100), 0x0, 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r0, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r2, 0xc00, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0x0, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r1, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:11:58 executing program 5:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 31)

00:11:58 executing program 4:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_mount_image$tmpfs(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 28)

00:11:58 executing program 7:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684fd2981c8409820000080000000000000000"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x4d8}], 0x1, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:11:58 executing program 3:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034", 0x15}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r0, &(0x7f0000001180)=ANY=[], 0x220)

00:11:58 executing program 2:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684f"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x100d}], 0x1, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x0)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:11:58 executing program 1:
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}}, 0x0, 0x6, 0xffffffffffffffff, 0xb)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
r1 = gettid()
rt_sigqueueinfo(0x0, 0x0, 0x0)
r2 = pidfd_getfd(0xffffffffffffffff, r0, 0x0)
perf_event_open(&(0x7f0000000040)={0x5, 0x80, 0x40, 0x71, 0x2, 0x0, 0x0, 0x8000, 0x20, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, @perf_config_ext={0xff}, 0x0, 0x9b5, 0xfa, 0xd, 0x0, 0x8000, 0x55, 0x0, 0x0, 0x0, 0x3ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000400)={0x2, 0x80, 0x2a, 0x81, 0xe0, 0x40, 0x0, 0x63c5ef1c, 0x80, 0x3, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x7, 0x2, @perf_config_ext={0xf2, 0x6}, 0x0, 0x5, 0xfffffff8, 0x0, 0x1, 0x0, 0x1b6, 0x0, 0x6}, 0x0, 0xd, 0xffffffffffffffff, 0x0)
rt_sigqueueinfo(0x0, 0x0, &(0x7f0000000000))
setsockopt$sock_timeval(r0, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10)
bind$packet(r2, &(0x7f00000000c0)={0x11, 0xfe, 0x0, 0x1, 0xfb, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}}, 0x14)
perf_event_open(&(0x7f0000000100)={0x0, 0x80, 0xff, 0x8, 0x4, 0x1, 0x0, 0x4, 0x684, 0x4, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0xdbc, 0x0, @perf_config_ext={0xd03, 0x80000000}, 0x800, 0x3, 0x3, 0x5, 0x300000000000000, 0x7, 0x7ff, 0x0, 0x0, 0x0, 0x5}, r1, 0x10, 0xffffffffffffffff, 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r3, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
openat(r3, &(0x7f0000000180)='\x00', 0x400040, 0x80)
rt_sigqueueinfo(0x0, 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f0000000240)={'ip6_vti0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x4, 0x0, 0x7f, 0x40, 0xb, @local, @mcast1, 0x88, 0x20, 0x8, 0x2}})

00:11:58 executing program 6:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 31)

[ 2407.782814] loop5: detected capacity change from 0 to 40
[ 2407.797865] loop6: detected capacity change from 0 to 40
[ 2407.840067] loop3: detected capacity change from 0 to 40
[ 2407.858921] FAT-fs (loop3): invalid media value (0x00)
[ 2407.859574] FAT-fs (loop3): Can't find a valid FAT filesystem
[ 2407.861675] loop4: detected capacity change from 0 to 40
[ 2407.874122] syz-executor.5: attempt to access beyond end of device
[ 2407.874122] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2407.875364] Buffer I/O error on dev loop5, logical block 10, lost async page write
[ 2407.885804] syz-executor.6: attempt to access beyond end of device
[ 2407.885804] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2407.886945] Buffer I/O error on dev loop6, logical block 10, lost async page write
00:11:58 executing program 0:
perf_event_open(&(0x7f0000000080)={0x0, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r1, &(0x7f0000000100), 0x0, 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r0, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r2, 0xc01, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0x0, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r1, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:11:58 executing program 5:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 32)

00:11:58 executing program 6:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 32)

00:11:58 executing program 1:
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}}, 0x0, 0x6, 0xffffffffffffffff, 0xb)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
r1 = gettid()
rt_sigqueueinfo(0x0, 0x0, 0x0)
r2 = pidfd_getfd(0xffffffffffffffff, r0, 0x0)
perf_event_open(&(0x7f0000000040)={0x5, 0x80, 0x40, 0x71, 0x2, 0x0, 0x0, 0x8000, 0x20, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, @perf_config_ext={0xff}, 0x0, 0x9b5, 0xfa, 0xd, 0x0, 0x8000, 0x55, 0x0, 0x0, 0x0, 0x3ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000400)={0x2, 0x80, 0x2a, 0x81, 0xe0, 0x40, 0x0, 0x63c5ef1c, 0x80, 0x3, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x7, 0x2, @perf_config_ext={0xf2, 0x6}, 0x0, 0x5, 0xfffffff8, 0x0, 0x1, 0x0, 0x1b6, 0x0, 0x6}, 0x0, 0xd, 0xffffffffffffffff, 0x0)
rt_sigqueueinfo(0x0, 0x0, &(0x7f0000000000))
setsockopt$sock_timeval(r0, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10)
bind$packet(r2, &(0x7f00000000c0)={0x11, 0xfe, 0x0, 0x1, 0xfb, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}}, 0x14)
perf_event_open(&(0x7f0000000100)={0x0, 0x80, 0xff, 0x8, 0x4, 0x1, 0x0, 0x4, 0x684, 0x4, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0xdbc, 0x0, @perf_config_ext={0xd03, 0x80000000}, 0x800, 0x3, 0x3, 0x5, 0x300000000000000, 0x7, 0x7ff, 0x0, 0x0, 0x0, 0x5}, r1, 0x10, 0xffffffffffffffff, 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r3, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
openat(r3, &(0x7f0000000180)='\x00', 0x400040, 0x80)
rt_sigqueueinfo(0x0, 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f0000000240)={'ip6_vti0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x4, 0x0, 0x7f, 0x40, 0xb, @local, @mcast1, 0x88, 0x20, 0x8, 0x2}})

[ 2408.023659] syz-executor.4: attempt to access beyond end of device
[ 2408.023659] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2408.025408] Buffer I/O error on dev loop4, logical block 10, lost async page write
00:11:58 executing program 3:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f8", 0x16}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r0, &(0x7f0000001180)=ANY=[], 0x220)

[ 2408.099821] loop3: detected capacity change from 0 to 40
[ 2408.102785] loop6: detected capacity change from 0 to 40
[ 2408.112671] FAT-fs (loop3): bogus number of FAT sectors
[ 2408.113196] FAT-fs (loop3): Can't find a valid FAT filesystem
[ 2408.114638] loop5: detected capacity change from 0 to 40
00:11:58 executing program 7:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684fd2981c8409820000080000000000000000"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x51b}], 0x1, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:11:58 executing program 0:
perf_event_open(&(0x7f0000000080)={0x0, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r1, &(0x7f0000000100), 0x0, 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r0, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r2, 0xd01, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0x0, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r1, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:11:58 executing program 4:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_mount_image$tmpfs(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 29)

[ 2408.186934] syz-executor.6: attempt to access beyond end of device
[ 2408.186934] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2408.187909] Buffer I/O error on dev loop6, logical block 10, lost async page write
00:11:58 executing program 3:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f8", 0x16}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r0, &(0x7f0000001180)=ANY=[], 0x220)

[ 2408.245371] syz-executor.5: attempt to access beyond end of device
[ 2408.245371] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2408.246287] Buffer I/O error on dev loop5, logical block 10, lost async page write
[ 2408.310823] loop4: detected capacity change from 0 to 40
[ 2408.408943] loop3: detected capacity change from 0 to 40
[ 2408.415944] syz-executor.4: attempt to access beyond end of device
[ 2408.415944] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2408.416777] FAT-fs (loop3): bogus number of FAT sectors
[ 2408.416979] Buffer I/O error on dev loop4, logical block 10, lost async page write
[ 2408.417769] FAT-fs (loop3): Can't find a valid FAT filesystem
00:12:15 executing program 0:
perf_event_open(&(0x7f0000000080)={0x0, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r1, &(0x7f0000000100), 0x0, 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r0, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r2, 0x1200, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0x0, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r1, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:12:15 executing program 3:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f8", 0x16}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r0, &(0x7f0000001180)=ANY=[], 0x220)

00:12:15 executing program 7:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684fd2981c8409820000080000000000000000"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x55e}], 0x1, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:12:15 executing program 6:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 33)

00:12:15 executing program 2:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684f"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x100d}], 0x1, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x0)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:12:15 executing program 1:
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}}, 0x0, 0x6, 0xffffffffffffffff, 0xb)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
r1 = gettid()
rt_sigqueueinfo(0x0, 0x0, 0x0)
r2 = pidfd_getfd(0xffffffffffffffff, r0, 0x0)
perf_event_open(&(0x7f0000000040)={0x5, 0x80, 0x40, 0x71, 0x2, 0x0, 0x0, 0x8000, 0x20, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, @perf_config_ext={0xff}, 0x0, 0x9b5, 0xfa, 0xd, 0x0, 0x8000, 0x55, 0x0, 0x0, 0x0, 0x3ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000400)={0x2, 0x80, 0x2a, 0x81, 0xe0, 0x40, 0x0, 0x63c5ef1c, 0x80, 0x3, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x7, 0x2, @perf_config_ext={0xf2, 0x6}, 0x0, 0x5, 0xfffffff8, 0x0, 0x1, 0x0, 0x1b6, 0x0, 0x6}, 0x0, 0xd, 0xffffffffffffffff, 0x0)
rt_sigqueueinfo(0x0, 0x0, &(0x7f0000000000))
setsockopt$sock_timeval(r0, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10)
bind$packet(r2, &(0x7f00000000c0)={0x11, 0xfe, 0x0, 0x1, 0xfb, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}}, 0x14)
perf_event_open(&(0x7f0000000100)={0x0, 0x80, 0xff, 0x8, 0x4, 0x1, 0x0, 0x4, 0x684, 0x4, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0xdbc, 0x0, @perf_config_ext={0xd03, 0x80000000}, 0x800, 0x3, 0x3, 0x5, 0x300000000000000, 0x7, 0x7ff, 0x0, 0x0, 0x0, 0x5}, r1, 0x10, 0xffffffffffffffff, 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r3, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
openat(r3, &(0x7f0000000180)='\x00', 0x400040, 0x80)
rt_sigqueueinfo(0x0, 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f0000000240)={'ip6_vti0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x4, 0x0, 0x7f, 0x40, 0xb, @local, @mcast1, 0x88, 0x20, 0x8, 0x2}})

00:12:15 executing program 4:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_mount_image$tmpfs(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 30)

00:12:15 executing program 5:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 33)

[ 2424.974953] loop4: detected capacity change from 0 to 40
[ 2424.998716] loop3: detected capacity change from 0 to 40
[ 2425.006550] loop6: detected capacity change from 0 to 40
[ 2425.007132] FAT-fs (loop3): bogus number of FAT sectors
[ 2425.007717] FAT-fs (loop3): Can't find a valid FAT filesystem
[ 2425.023487] syz-executor.4: attempt to access beyond end of device
[ 2425.023487] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2425.024460] Buffer I/O error on dev loop4, logical block 10, lost async page write
[ 2425.027592] loop5: detected capacity change from 0 to 40
[ 2425.089501] syz-executor.6: attempt to access beyond end of device
[ 2425.089501] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2425.090447] Buffer I/O error on dev loop6, logical block 10, lost async page write
[ 2425.117181] syz-executor.5: attempt to access beyond end of device
[ 2425.117181] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2425.118875] Buffer I/O error on dev loop5, logical block 10, lost async page write
00:12:15 executing program 4:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_mount_image$tmpfs(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 31)

00:12:15 executing program 0:
perf_event_open(&(0x7f0000000080)={0x0, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r1, &(0x7f0000000100), 0x0, 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r0, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r2, 0x17ff, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0x0, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r1, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:12:15 executing program 1:
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}}, 0x0, 0x6, 0xffffffffffffffff, 0xb)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
r1 = gettid()
rt_sigqueueinfo(0x0, 0x0, 0x0)
r2 = pidfd_getfd(0xffffffffffffffff, r0, 0x0)
perf_event_open(&(0x7f0000000040)={0x5, 0x80, 0x40, 0x71, 0x2, 0x0, 0x0, 0x8000, 0x20, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, @perf_config_ext={0xff}, 0x0, 0x9b5, 0xfa, 0xd, 0x0, 0x8000, 0x55, 0x0, 0x0, 0x0, 0x3ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000400)={0x2, 0x80, 0x2a, 0x81, 0xe0, 0x40, 0x0, 0x63c5ef1c, 0x80, 0x3, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x7, 0x2, @perf_config_ext={0xf2, 0x6}, 0x0, 0x5, 0xfffffff8, 0x0, 0x1, 0x0, 0x1b6, 0x0, 0x6}, 0x0, 0xd, 0xffffffffffffffff, 0x0)
rt_sigqueueinfo(0x0, 0x0, &(0x7f0000000000))
setsockopt$sock_timeval(r0, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10)
bind$packet(r2, &(0x7f00000000c0)={0x11, 0xfe, 0x0, 0x1, 0xfb, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}}, 0x14)
perf_event_open(&(0x7f0000000100)={0x0, 0x80, 0xff, 0x8, 0x4, 0x1, 0x0, 0x4, 0x684, 0x4, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0xdbc, 0x0, @perf_config_ext={0xd03, 0x80000000}, 0x800, 0x3, 0x3, 0x5, 0x300000000000000, 0x7, 0x7ff, 0x0, 0x0, 0x0, 0x5}, r1, 0x10, 0xffffffffffffffff, 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r3, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
openat(r3, &(0x7f0000000180)='\x00', 0x400040, 0x80)
rt_sigqueueinfo(0x0, 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f0000000240)={'ip6_vti0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x4, 0x0, 0x7f, 0x40, 0xb, @local, @mcast1, 0x88, 0x20, 0x8, 0x2}})

00:12:15 executing program 3:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, 0x0)
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r0, &(0x7f0000001180)=ANY=[], 0x220)

[ 2425.203314] loop3: detected capacity change from 0 to 40
00:12:15 executing program 6:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 34)

[ 2425.210928] loop4: detected capacity change from 0 to 40
[ 2425.265551] syz-executor.4: attempt to access beyond end of device
[ 2425.265551] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2425.266553] Buffer I/O error on dev loop4, logical block 10, lost async page write
00:12:15 executing program 2:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684f"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x100d}], 0x1, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0x0, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:12:15 executing program 5:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 34)

[ 2425.378791] loop6: detected capacity change from 0 to 40
[ 2425.451519] loop5: detected capacity change from 0 to 40
[ 2425.461268] syz-executor.6: attempt to access beyond end of device
[ 2425.461268] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2425.462492] Buffer I/O error on dev loop6, logical block 10, lost async page write
[ 2425.546714] syz-executor.5: attempt to access beyond end of device
[ 2425.546714] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2425.548463] Buffer I/O error on dev loop5, logical block 10, lost async page write
00:12:34 executing program 5:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 35)

00:12:34 executing program 0:
perf_event_open(&(0x7f0000000080)={0x0, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r1, &(0x7f0000000100), 0x0, 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r0, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r2, 0x1800, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0x0, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r1, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:12:34 executing program 6:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 35)

00:12:34 executing program 3:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, 0x0)
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r0, &(0x7f0000001180)=ANY=[], 0x220)

00:12:34 executing program 4:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_mount_image$tmpfs(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 32)

00:12:34 executing program 1:
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}}, 0x0, 0x6, 0xffffffffffffffff, 0xb)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
r1 = gettid()
rt_sigqueueinfo(0x0, 0x0, 0x0)
r2 = pidfd_getfd(0xffffffffffffffff, r0, 0x0)
perf_event_open(&(0x7f0000000040)={0x5, 0x80, 0x40, 0x71, 0x2, 0x0, 0x0, 0x8000, 0x20, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, @perf_config_ext={0xff}, 0x0, 0x9b5, 0xfa, 0xd, 0x0, 0x8000, 0x55, 0x0, 0x0, 0x0, 0x3ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000400)={0x2, 0x80, 0x2a, 0x81, 0xe0, 0x40, 0x0, 0x63c5ef1c, 0x80, 0x3, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x7, 0x2, @perf_config_ext={0xf2, 0x6}, 0x0, 0x5, 0xfffffff8, 0x0, 0x1, 0x0, 0x1b6, 0x0, 0x6}, 0x0, 0xd, 0xffffffffffffffff, 0x0)
rt_sigqueueinfo(0x0, 0x0, &(0x7f0000000000))
setsockopt$sock_timeval(r0, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10)
bind$packet(r2, &(0x7f00000000c0)={0x11, 0xfe, 0x0, 0x1, 0xfb, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}}, 0x14)
perf_event_open(&(0x7f0000000100)={0x0, 0x80, 0xff, 0x8, 0x4, 0x1, 0x0, 0x4, 0x684, 0x4, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0xdbc, 0x0, @perf_config_ext={0xd03, 0x80000000}, 0x800, 0x3, 0x3, 0x5, 0x300000000000000, 0x7, 0x7ff, 0x0, 0x0, 0x0, 0x5}, r1, 0x10, 0xffffffffffffffff, 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r3, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
openat(r3, &(0x7f0000000180)='\x00', 0x400040, 0x80)
rt_sigqueueinfo(0x0, 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f0000000240)={'ip6_vti0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x4, 0x0, 0x7f, 0x40, 0xb, @local, @mcast1, 0x88, 0x20, 0x8, 0x2}})

00:12:34 executing program 7:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684fd2981c8409820000080000000000000000"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x5a1}], 0x1, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:12:34 executing program 2:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684f"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x100d}], 0x1, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0x0, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

[ 2443.500819] loop6: detected capacity change from 0 to 40
[ 2443.536743] loop3: detected capacity change from 0 to 40
[ 2443.552488] loop5: detected capacity change from 0 to 40
[ 2443.558686] syz-executor.6: attempt to access beyond end of device
[ 2443.558686] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2443.559567] Buffer I/O error on dev loop6, logical block 10, lost async page write
[ 2443.591986] loop4: detected capacity change from 0 to 40
00:12:34 executing program 6:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 36)

00:12:34 executing program 3:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, 0x0)
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r0, &(0x7f0000001180)=ANY=[], 0x220)

[ 2443.655273] syz-executor.5: attempt to access beyond end of device
[ 2443.655273] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2443.657343] Buffer I/O error on dev loop5, logical block 10, lost async page write
[ 2443.727273] syz-executor.4: attempt to access beyond end of device
[ 2443.727273] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2443.728210] Buffer I/O error on dev loop4, logical block 10, lost async page write
[ 2443.734462] loop3: detected capacity change from 0 to 40
[ 2443.741269] loop6: detected capacity change from 0 to 40
00:12:34 executing program 1:
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}}, 0x0, 0x6, 0xffffffffffffffff, 0xb)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
r1 = gettid()
rt_sigqueueinfo(0x0, 0x0, 0x0)
r2 = pidfd_getfd(0xffffffffffffffff, r0, 0x0)
perf_event_open(&(0x7f0000000040)={0x5, 0x80, 0x40, 0x71, 0x2, 0x0, 0x0, 0x8000, 0x20, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, @perf_config_ext={0xff}, 0x0, 0x9b5, 0xfa, 0xd, 0x0, 0x8000, 0x55, 0x0, 0x0, 0x0, 0x3ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000400)={0x2, 0x80, 0x2a, 0x81, 0xe0, 0x40, 0x0, 0x63c5ef1c, 0x80, 0x3, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x7, 0x2, @perf_config_ext={0xf2, 0x6}, 0x0, 0x5, 0xfffffff8, 0x0, 0x1, 0x0, 0x1b6, 0x0, 0x6}, 0x0, 0xd, 0xffffffffffffffff, 0x0)
rt_sigqueueinfo(0x0, 0x0, &(0x7f0000000000))
setsockopt$sock_timeval(r0, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10)
bind$packet(r2, &(0x7f00000000c0)={0x11, 0xfe, 0x0, 0x1, 0xfb, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}}, 0x14)
perf_event_open(&(0x7f0000000100)={0x0, 0x80, 0xff, 0x8, 0x4, 0x1, 0x0, 0x4, 0x684, 0x4, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0xdbc, 0x0, @perf_config_ext={0xd03, 0x80000000}, 0x800, 0x3, 0x3, 0x5, 0x300000000000000, 0x7, 0x7ff, 0x0, 0x0, 0x0, 0x5}, r1, 0x10, 0xffffffffffffffff, 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r3, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
openat(r3, &(0x7f0000000180)='\x00', 0x400040, 0x80)
rt_sigqueueinfo(0x0, 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f0000000240)={'ip6_vti0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x4, 0x0, 0x7f, 0x40, 0xb, @local, @mcast1, 0x88, 0x20, 0x8, 0x2}})

00:12:34 executing program 0:
perf_event_open(&(0x7f0000000080)={0x0, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r1, &(0x7f0000000100), 0x0, 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r0, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r2, 0x1fff, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0x0, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r1, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

[ 2443.809529] syz-executor.6: attempt to access beyond end of device
[ 2443.809529] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2443.810521] Buffer I/O error on dev loop6, logical block 10, lost async page write
00:12:34 executing program 2:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684f"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x100d}], 0x1, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0x0, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:12:34 executing program 5:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 36)

00:12:34 executing program 3:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r0, &(0x7f0000001180)=ANY=[], 0x220)

00:12:34 executing program 4:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_mount_image$tmpfs(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 33)

[ 2443.890501] loop5: detected capacity change from 0 to 40
[ 2443.923432] loop3: detected capacity change from 0 to 40
[ 2443.949295] syz-executor.5: attempt to access beyond end of device
[ 2443.949295] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2443.950286] Buffer I/O error on dev loop5, logical block 10, lost async page write
00:12:34 executing program 0:
perf_event_open(&(0x7f0000000080)={0x0, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r1, &(0x7f0000000100), 0x0, 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r0, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r2, 0x2000, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0x0, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r1, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:12:34 executing program 6:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 37)

[ 2444.023067] loop4: detected capacity change from 0 to 40
00:12:34 executing program 5:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 37)

00:12:34 executing program 3:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r0, &(0x7f0000001180)=ANY=[], 0x220)

[ 2444.100406] loop6: detected capacity change from 0 to 40
[ 2444.127514] loop5: detected capacity change from 0 to 40
[ 2444.143437] syz-executor.4: attempt to access beyond end of device
[ 2444.143437] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2444.145267] Buffer I/O error on dev loop4, logical block 10, lost async page write
[ 2444.150371] loop3: detected capacity change from 0 to 40
[ 2444.185163] syz-executor.5: attempt to access beyond end of device
[ 2444.185163] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2444.186488] Buffer I/O error on dev loop5, logical block 10, lost async page write
[ 2444.189410] syz-executor.6: attempt to access beyond end of device
[ 2444.189410] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2444.191053] Buffer I/O error on dev loop6, logical block 10, lost async page write
00:12:51 executing program 6:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 38)

00:12:51 executing program 3:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r0, &(0x7f0000001180)=ANY=[], 0x220)

00:12:51 executing program 0:
perf_event_open(&(0x7f0000000080)={0x0, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r1, &(0x7f0000000100), 0x0, 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r0, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r2, 0x2103, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0x0, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r1, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:12:51 executing program 2:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684f"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x100d}], 0x1, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, 0x0, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:12:51 executing program 7:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684fd2981c8409820000080000000000000000"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x5ee}], 0x1, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:12:51 executing program 5:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 38)

00:12:51 executing program 4:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_mount_image$tmpfs(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 34)

[ 2460.931700] loop5: detected capacity change from 0 to 40
[ 2460.932975] loop3: detected capacity change from 0 to 40
00:12:51 executing program 1:
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}}, 0x0, 0x6, 0xffffffffffffffff, 0xb)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
r1 = gettid()
rt_sigqueueinfo(0x0, 0x0, 0x0)
r2 = pidfd_getfd(0xffffffffffffffff, r0, 0x0)
perf_event_open(&(0x7f0000000040)={0x5, 0x80, 0x40, 0x71, 0x2, 0x0, 0x0, 0x8000, 0x20, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, @perf_config_ext={0xff}, 0x0, 0x9b5, 0xfa, 0xd, 0x0, 0x8000, 0x55, 0x0, 0x0, 0x0, 0x3ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000400)={0x2, 0x80, 0x2a, 0x81, 0xe0, 0x40, 0x0, 0x63c5ef1c, 0x80, 0x3, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x7, 0x2, @perf_config_ext={0xf2, 0x6}, 0x0, 0x5, 0xfffffff8, 0x0, 0x1, 0x0, 0x1b6, 0x0, 0x6}, 0x0, 0xd, 0xffffffffffffffff, 0x0)
rt_sigqueueinfo(0x0, 0x0, &(0x7f0000000000))
setsockopt$sock_timeval(r0, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10)
bind$packet(r2, &(0x7f00000000c0)={0x11, 0xfe, 0x0, 0x1, 0xfb, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}}, 0x14)
perf_event_open(&(0x7f0000000100)={0x0, 0x80, 0xff, 0x8, 0x4, 0x1, 0x0, 0x4, 0x684, 0x4, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0xdbc, 0x0, @perf_config_ext={0xd03, 0x80000000}, 0x800, 0x3, 0x3, 0x5, 0x300000000000000, 0x7, 0x7ff, 0x0, 0x0, 0x0, 0x5}, r1, 0x10, 0xffffffffffffffff, 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r3, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
openat(r3, &(0x7f0000000180)='\x00', 0x400040, 0x80)
rt_sigqueueinfo(0x0, 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f0000000240)={'ip6_vti0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x4, 0x0, 0x7f, 0x40, 0xb, @local, @mcast1, 0x88, 0x20, 0x8, 0x2}})

[ 2460.956825] loop4: detected capacity change from 0 to 40
[ 2460.985151] loop6: detected capacity change from 0 to 40
[ 2460.990456] syz-executor.5: attempt to access beyond end of device
[ 2460.990456] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2460.991352] Buffer I/O error on dev loop5, logical block 10, lost async page write
[ 2461.033341] syz-executor.4: attempt to access beyond end of device
[ 2461.033341] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2461.034198] Buffer I/O error on dev loop4, logical block 10, lost async page write
00:12:51 executing program 3:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, 0x0, 0x101042, 0x0)
write$binfmt_aout(r0, &(0x7f0000001180)=ANY=[], 0x220)

00:12:51 executing program 5:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 39)

[ 2461.113210] syz-executor.6: attempt to access beyond end of device
[ 2461.113210] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2461.115263] Buffer I/O error on dev loop6, logical block 10, lost async page write
[ 2461.171946] loop5: detected capacity change from 0 to 40
[ 2461.233403] syz-executor.5: attempt to access beyond end of device
[ 2461.233403] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2461.234323] Buffer I/O error on dev loop5, logical block 10, lost async page write
[ 2461.251584] loop3: detected capacity change from 0 to 40
00:13:07 executing program 4:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_mount_image$tmpfs(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 35)

00:13:07 executing program 0:
perf_event_open(&(0x7f0000000080)={0x0, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r1, &(0x7f0000000100), 0x0, 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r0, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r2, 0x27ff, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0x0, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r1, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:13:07 executing program 1:
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}}, 0x0, 0x6, 0xffffffffffffffff, 0xb)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
r1 = gettid()
rt_sigqueueinfo(0x0, 0x0, 0x0)
r2 = pidfd_getfd(0xffffffffffffffff, r0, 0x0)
perf_event_open(&(0x7f0000000040)={0x5, 0x80, 0x40, 0x71, 0x2, 0x0, 0x0, 0x8000, 0x20, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, @perf_config_ext={0xff}, 0x0, 0x9b5, 0xfa, 0xd, 0x0, 0x8000, 0x55, 0x0, 0x0, 0x0, 0x3ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000400)={0x2, 0x80, 0x2a, 0x81, 0xe0, 0x40, 0x0, 0x63c5ef1c, 0x80, 0x3, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x7, 0x2, @perf_config_ext={0xf2, 0x6}, 0x0, 0x5, 0xfffffff8, 0x0, 0x1, 0x0, 0x1b6, 0x0, 0x6}, 0x0, 0xd, 0xffffffffffffffff, 0x0)
rt_sigqueueinfo(0x0, 0x0, &(0x7f0000000000))
setsockopt$sock_timeval(r0, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10)
bind$packet(r2, &(0x7f00000000c0)={0x11, 0xfe, 0x0, 0x1, 0xfb, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}}, 0x14)
perf_event_open(&(0x7f0000000100)={0x0, 0x80, 0xff, 0x8, 0x4, 0x1, 0x0, 0x4, 0x684, 0x4, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0xdbc, 0x0, @perf_config_ext={0xd03, 0x80000000}, 0x800, 0x3, 0x3, 0x5, 0x300000000000000, 0x7, 0x7ff, 0x0, 0x0, 0x0, 0x5}, r1, 0x10, 0xffffffffffffffff, 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r3, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
openat(r3, &(0x7f0000000180)='\x00', 0x400040, 0x80)
rt_sigqueueinfo(0x0, 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f0000000240)={'ip6_vti0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x4, 0x0, 0x7f, 0x40, 0xb, @local, @mcast1, 0x88, 0x20, 0x8, 0x2}})

[ 2476.472603] loop5: detected capacity change from 0 to 40
[ 2476.473466] loop6: detected capacity change from 0 to 40
00:13:07 executing program 2:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684f"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x100d}], 0x1, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, 0x0, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:13:07 executing program 7:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684fd2981c8409820000080000000000000000"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x631}], 0x1, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:13:07 executing program 6:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 39)

00:13:07 executing program 5:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 40)

00:13:07 executing program 3:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, 0x0, 0x101042, 0x0)
write$binfmt_aout(r0, &(0x7f0000001180)=ANY=[], 0x220)

[ 2476.496729] FAULT_INJECTION: forcing a failure.
[ 2476.496729] name failslab, interval 1, probability 0, space 0, times 0
[ 2476.497705] CPU: 1 PID: 12754 Comm: syz-executor.6 Not tainted 6.1.0-rc8-next-20221208 #1
[ 2476.498277] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
[ 2476.498846] Call Trace:
[ 2476.499034]  <TASK>
[ 2476.499207]  dump_stack_lvl+0x8f/0xb7
[ 2476.499495]  should_fail_ex.cold+0x5/0xa
[ 2476.499809]  should_failslab+0x9/0x20
[ 2476.500108]  __kmem_cache_alloc_node+0x5b/0x400
[ 2476.500453]  ? iter_file_splice_write+0x169/0xcb0
[ 2476.500826]  ? iter_file_splice_write+0x169/0xcb0
[ 2476.501179]  __kmalloc+0x46/0xc0
[ 2476.501442]  iter_file_splice_write+0x169/0xcb0
[ 2476.501783]  ? generic_file_read_iter+0x330/0x550
[ 2476.502156]  ? generic_file_splice_read+0x1bc/0x4d0
[ 2476.502522]  ? __pfx_iter_file_splice_write+0x10/0x10
[ 2476.502891]  ? __pfx_generic_file_splice_read+0x10/0x10
[ 2476.503283]  ? inode_security+0x105/0x140
[ 2476.503609]  ? security_file_permission+0xb5/0xe0
[ 2476.503992]  ? __pfx_iter_file_splice_write+0x10/0x10
[ 2476.504384]  direct_splice_actor+0x113/0x180
[ 2476.504719]  splice_direct_to_actor+0x33a/0x8c0
[ 2476.505058]  ? __pfx_direct_splice_actor+0x10/0x10
[ 2476.505434]  ? __pfx_splice_direct_to_actor+0x10/0x10
[ 2476.505798]  ? security_file_permission+0xb5/0xe0
[ 2476.506167]  do_splice_direct+0x1bc/0x290
[ 2476.506483]  ? __pfx_do_splice_direct+0x10/0x10
[ 2476.506821]  ? lock_is_held_type+0xdb/0x130
[ 2476.507137]  do_sendfile+0xb1d/0x1280
[ 2476.507432]  ? __pfx_do_sendfile+0x10/0x10
[ 2476.507740]  ? lock_is_held_type+0xdb/0x130
[ 2476.508061]  __x64_sys_sendfile64+0x248/0x2a0
[ 2476.508403]  ? trace_rcu_dyntick+0x1a7/0x250
[ 2476.508747]  ? __pfx___x64_sys_sendfile64+0x10/0x10
[ 2476.509113]  ? syscall_enter_from_user_mode+0x21/0x50
[ 2476.509508]  ? syscall_enter_from_user_mode+0x21/0x50
[ 2476.509905]  do_syscall_64+0x3f/0x90
[ 2476.510196]  entry_SYSCALL_64_after_hwframe+0x72/0xdc
[ 2476.510581] RIP: 0033:0x7f3186383b19
[ 2476.510865] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
[ 2476.512152] RSP: 002b:00007f31838f9188 EFLAGS: 00000246 ORIG_RAX: 0000000000000028
[ 2476.512715] RAX: ffffffffffffffda RBX: 00007f3186496f60 RCX: 00007f3186383b19
[ 2476.513224] RDX: 0000000000000000 RSI: 0000000000000003 RDI: 0000000000000004
[ 2476.513739] RBP: 00007f31838f91d0 R08: 0000000000000000 R09: 0000000000000000
[ 2476.514247] R10: 00000000fffffdef R11: 0000000000000246 R12: 0000000000000002
[ 2476.514752] R13: 00007ffc1396bf2f R14: 00007f31838f9300 R15: 0000000000022000
[ 2476.515274]  </TASK>
[ 2476.556813] loop3: detected capacity change from 0 to 40
[ 2476.571401] loop4: detected capacity change from 0 to 40
00:13:07 executing program 1:
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}}, 0x0, 0x6, 0xffffffffffffffff, 0xb)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
r1 = gettid()
rt_sigqueueinfo(0x0, 0x0, 0x0)
r2 = pidfd_getfd(0xffffffffffffffff, r0, 0x0)
perf_event_open(&(0x7f0000000040)={0x5, 0x80, 0x40, 0x71, 0x2, 0x0, 0x0, 0x8000, 0x20, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, @perf_config_ext={0xff}, 0x0, 0x9b5, 0xfa, 0xd, 0x0, 0x8000, 0x55, 0x0, 0x0, 0x0, 0x3ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000400)={0x2, 0x80, 0x2a, 0x81, 0xe0, 0x40, 0x0, 0x63c5ef1c, 0x80, 0x3, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x7, 0x2, @perf_config_ext={0xf2, 0x6}, 0x0, 0x5, 0xfffffff8, 0x0, 0x1, 0x0, 0x1b6, 0x0, 0x6}, 0x0, 0xd, 0xffffffffffffffff, 0x0)
rt_sigqueueinfo(0x0, 0x0, &(0x7f0000000000))
setsockopt$sock_timeval(r0, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10)
bind$packet(r2, &(0x7f00000000c0)={0x11, 0xfe, 0x0, 0x1, 0xfb, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}}, 0x14)
perf_event_open(&(0x7f0000000100)={0x0, 0x80, 0xff, 0x8, 0x4, 0x1, 0x0, 0x4, 0x684, 0x4, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0xdbc, 0x0, @perf_config_ext={0xd03, 0x80000000}, 0x800, 0x3, 0x3, 0x5, 0x300000000000000, 0x7, 0x7ff, 0x0, 0x0, 0x0, 0x5}, r1, 0x10, 0xffffffffffffffff, 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r3, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
openat(r3, &(0x7f0000000180)='\x00', 0x400040, 0x80)
rt_sigqueueinfo(0x0, 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f0000000240)={'ip6_vti0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x4, 0x0, 0x7f, 0x40, 0xb, @local, @mcast1, 0x88, 0x20, 0x8, 0x2}})

[ 2476.632533] syz-executor.5: attempt to access beyond end of device
[ 2476.632533] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2476.634412] Buffer I/O error on dev loop5, logical block 10, lost async page write
00:13:07 executing program 6:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 40)

00:13:07 executing program 5:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 41)

[ 2476.717490] syz-executor.4: attempt to access beyond end of device
[ 2476.717490] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2476.719693] Buffer I/O error on dev loop4, logical block 10, lost async page write
00:13:07 executing program 3:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, 0x0, 0x101042, 0x0)
write$binfmt_aout(r0, &(0x7f0000001180)=ANY=[], 0x220)

[ 2476.756914] loop6: detected capacity change from 0 to 40
[ 2476.785147] loop5: detected capacity change from 0 to 40
00:13:07 executing program 1:
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}}, 0x0, 0x6, 0xffffffffffffffff, 0xb)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
r1 = gettid()
rt_sigqueueinfo(0x0, 0x0, 0x0)
r2 = pidfd_getfd(0xffffffffffffffff, r0, 0x0)
perf_event_open(&(0x7f0000000040)={0x5, 0x80, 0x40, 0x71, 0x2, 0x0, 0x0, 0x8000, 0x20, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, @perf_config_ext={0xff}, 0x0, 0x9b5, 0xfa, 0xd, 0x0, 0x8000, 0x55, 0x0, 0x0, 0x0, 0x3ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000400)={0x2, 0x80, 0x2a, 0x81, 0xe0, 0x40, 0x0, 0x63c5ef1c, 0x80, 0x3, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x7, 0x2, @perf_config_ext={0xf2, 0x6}, 0x0, 0x5, 0xfffffff8, 0x0, 0x1, 0x0, 0x1b6, 0x0, 0x6}, 0x0, 0xd, 0xffffffffffffffff, 0x0)
rt_sigqueueinfo(0x0, 0x0, &(0x7f0000000000))
setsockopt$sock_timeval(r0, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10)
bind$packet(r2, &(0x7f00000000c0)={0x11, 0xfe, 0x0, 0x1, 0xfb, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}}, 0x14)
perf_event_open(&(0x7f0000000100)={0x0, 0x80, 0xff, 0x8, 0x4, 0x1, 0x0, 0x4, 0x684, 0x4, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0xdbc, 0x0, @perf_config_ext={0xd03, 0x80000000}, 0x800, 0x3, 0x3, 0x5, 0x300000000000000, 0x7, 0x7ff, 0x0, 0x0, 0x0, 0x5}, r1, 0x10, 0xffffffffffffffff, 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r3, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
openat(r3, &(0x7f0000000180)='\x00', 0x400040, 0x80)
rt_sigqueueinfo(0x0, 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f0000000240)={'ip6_vti0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x4, 0x0, 0x7f, 0x40, 0xb, @local, @mcast1, 0x88, 0x20, 0x8, 0x2}})

00:13:07 executing program 0:
perf_event_open(&(0x7f0000000080)={0x0, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r1, &(0x7f0000000100), 0x0, 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r0, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r2, 0x2800, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0x0, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r1, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

[ 2476.830454] syz-executor.5: attempt to access beyond end of device
[ 2476.830454] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2476.831457] Buffer I/O error on dev loop5, logical block 10, lost async page write
00:13:07 executing program 4:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_mount_image$tmpfs(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 36)

00:13:07 executing program 5:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 42)

[ 2476.924541] syz-executor.6: attempt to access beyond end of device
[ 2476.924541] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2476.926328] Buffer I/O error on dev loop6, logical block 10, lost async page write
[ 2476.928085] loop3: detected capacity change from 0 to 40
00:13:07 executing program 2:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684f"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x100d}], 0x1, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, 0x0, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

[ 2477.003219] loop5: detected capacity change from 0 to 40
[ 2477.048644] syz-executor.5: attempt to access beyond end of device
[ 2477.048644] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2477.049691] Buffer I/O error on dev loop5, logical block 10, lost async page write
[ 2477.070469] loop4: detected capacity change from 0 to 40
[ 2477.158815] syz-executor.4: attempt to access beyond end of device
[ 2477.158815] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2477.160515] Buffer I/O error on dev loop4, logical block 10, lost async page write
00:13:26 executing program 4:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_mount_image$tmpfs(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 37)

00:13:26 executing program 1:
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}}, 0x0, 0x6, 0xffffffffffffffff, 0xb)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
r1 = gettid()
rt_sigqueueinfo(0x0, 0x0, 0x0)
r2 = pidfd_getfd(0xffffffffffffffff, r0, 0x0)
perf_event_open(&(0x7f0000000040)={0x5, 0x80, 0x40, 0x71, 0x2, 0x0, 0x0, 0x8000, 0x20, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, @perf_config_ext={0xff}, 0x0, 0x9b5, 0xfa, 0xd, 0x0, 0x8000, 0x55, 0x0, 0x0, 0x0, 0x3ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000400)={0x2, 0x80, 0x2a, 0x81, 0xe0, 0x40, 0x0, 0x63c5ef1c, 0x80, 0x3, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x7, 0x2, @perf_config_ext={0xf2, 0x6}, 0x0, 0x5, 0xfffffff8, 0x0, 0x1, 0x0, 0x1b6, 0x0, 0x6}, 0x0, 0xd, 0xffffffffffffffff, 0x0)
rt_sigqueueinfo(0x0, 0x0, &(0x7f0000000000))
setsockopt$sock_timeval(r0, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10)
bind$packet(r2, &(0x7f00000000c0)={0x11, 0xfe, 0x0, 0x1, 0xfb, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}}, 0x14)
perf_event_open(&(0x7f0000000100)={0x0, 0x80, 0xff, 0x8, 0x4, 0x1, 0x0, 0x4, 0x684, 0x4, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0xdbc, 0x0, @perf_config_ext={0xd03, 0x80000000}, 0x800, 0x3, 0x3, 0x5, 0x300000000000000, 0x7, 0x7ff, 0x0, 0x0, 0x0, 0x5}, r1, 0x10, 0xffffffffffffffff, 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r3, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
openat(r3, &(0x7f0000000180)='\x00', 0x400040, 0x80)
rt_sigqueueinfo(0x0, 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f0000000240)={'ip6_vti0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x4, 0x0, 0x7f, 0x40, 0xb, @local, @mcast1, 0x88, 0x20, 0x8, 0x2}})

[ 2495.910460] loop4: detected capacity change from 0 to 40
00:13:26 executing program 0:
perf_event_open(&(0x7f0000000080)={0x0, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r1, &(0x7f0000000100), 0x0, 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r0, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r2, 0x2fff, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0x0, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r1, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:13:26 executing program 3:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x0, 0x0)
write$binfmt_aout(r0, &(0x7f0000001180)=ANY=[], 0x220)

00:13:26 executing program 7:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684fd2981c8409820000080000000000000000"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x696}], 0x1, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:13:26 executing program 6:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 41)

00:13:26 executing program 5:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 43)

00:13:26 executing program 2:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684f"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x100d}], 0x1, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, 0x0, &(0x7f0000000000))
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

[ 2495.952942] loop5: detected capacity change from 0 to 40
[ 2495.957279] syz-executor.4: attempt to access beyond end of device
[ 2495.957279] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2495.958357] Buffer I/O error on dev loop4, logical block 10, lost async page write
[ 2495.960234] loop6: detected capacity change from 0 to 40
[ 2495.961645] loop3: detected capacity change from 0 to 40
[ 2496.010793] syz-executor.6: attempt to access beyond end of device
[ 2496.010793] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2496.012244] Buffer I/O error on dev loop6, logical block 10, lost async page write
[ 2496.020796] syz-executor.5: attempt to access beyond end of device
[ 2496.020796] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2496.021865] Buffer I/O error on dev loop5, logical block 10, lost async page write
00:13:26 executing program 4:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_mount_image$tmpfs(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 38)

00:13:26 executing program 3:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x0, 0x0)
write$binfmt_aout(r0, &(0x7f0000001180)=ANY=[], 0x220)

00:13:26 executing program 0:
perf_event_open(&(0x7f0000000080)={0x0, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r1, &(0x7f0000000100), 0x0, 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r0, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r2, 0x3000, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0x0, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r1, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:13:26 executing program 5:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 44)

00:13:26 executing program 1:
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}}, 0x0, 0x6, 0xffffffffffffffff, 0xb)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
r1 = gettid()
rt_sigqueueinfo(0x0, 0x0, 0x0)
r2 = pidfd_getfd(0xffffffffffffffff, r0, 0x0)
perf_event_open(&(0x7f0000000040)={0x5, 0x80, 0x40, 0x71, 0x2, 0x0, 0x0, 0x8000, 0x20, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, @perf_config_ext={0xff}, 0x0, 0x9b5, 0xfa, 0xd, 0x0, 0x8000, 0x55, 0x0, 0x0, 0x0, 0x3ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000400)={0x2, 0x80, 0x2a, 0x81, 0xe0, 0x40, 0x0, 0x63c5ef1c, 0x80, 0x3, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x7, 0x2, @perf_config_ext={0xf2, 0x6}, 0x0, 0x5, 0xfffffff8, 0x0, 0x1, 0x0, 0x1b6, 0x0, 0x6}, 0x0, 0xd, 0xffffffffffffffff, 0x0)
rt_sigqueueinfo(0x0, 0x0, &(0x7f0000000000))
setsockopt$sock_timeval(r0, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10)
bind$packet(r2, &(0x7f00000000c0)={0x11, 0xfe, 0x0, 0x1, 0xfb, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}}, 0x14)
perf_event_open(&(0x7f0000000100)={0x0, 0x80, 0xff, 0x8, 0x4, 0x1, 0x0, 0x4, 0x684, 0x4, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0xdbc, 0x0, @perf_config_ext={0xd03, 0x80000000}, 0x800, 0x3, 0x3, 0x5, 0x300000000000000, 0x7, 0x7ff, 0x0, 0x0, 0x0, 0x5}, r1, 0x10, 0xffffffffffffffff, 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r3, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
openat(r3, &(0x7f0000000180)='\x00', 0x400040, 0x80)
rt_sigqueueinfo(0x0, 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f0000000240)={'ip6_vti0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x4, 0x0, 0x7f, 0x40, 0xb, @local, @mcast1, 0x88, 0x20, 0x8, 0x2}})

00:13:26 executing program 6:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 42)

[ 2496.126904] loop3: detected capacity change from 0 to 40
[ 2496.138482] loop4: detected capacity change from 0 to 40
00:13:26 executing program 2:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684f"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x100d}], 0x1, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, 0x0, &(0x7f0000000000))
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

[ 2496.185955] loop6: detected capacity change from 0 to 40
[ 2496.191409] loop5: detected capacity change from 0 to 40
00:13:26 executing program 7:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684fd2981c8409820000080000000000000000"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x6e8}], 0x1, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

[ 2496.212260] syz-executor.4: attempt to access beyond end of device
[ 2496.212260] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2496.213322] Buffer I/O error on dev loop4, logical block 10, lost async page write
00:13:26 executing program 3:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x0, 0x0)
write$binfmt_aout(r0, &(0x7f0000001180)=ANY=[], 0x220)

[ 2496.268232] syz-executor.6: attempt to access beyond end of device
[ 2496.268232] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2496.269177] Buffer I/O error on dev loop6, logical block 10, lost async page write
00:13:26 executing program 0:
perf_event_open(&(0x7f0000000080)={0x0, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r1, &(0x7f0000000100), 0x0, 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r0, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r2, 0x37ff, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0x0, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r1, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

[ 2496.292548] syz-executor.5: attempt to access beyond end of device
[ 2496.292548] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2496.293512] Buffer I/O error on dev loop5, logical block 10, lost async page write
00:13:26 executing program 1:
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}}, 0x0, 0x6, 0xffffffffffffffff, 0xb)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
r1 = gettid()
rt_sigqueueinfo(0x0, 0x0, 0x0)
r2 = pidfd_getfd(0xffffffffffffffff, r0, 0x0)
perf_event_open(&(0x7f0000000040)={0x5, 0x80, 0x40, 0x71, 0x2, 0x0, 0x0, 0x8000, 0x20, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, @perf_config_ext={0xff}, 0x0, 0x9b5, 0xfa, 0xd, 0x0, 0x8000, 0x55, 0x0, 0x0, 0x0, 0x3ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000400)={0x2, 0x80, 0x2a, 0x81, 0xe0, 0x40, 0x0, 0x63c5ef1c, 0x80, 0x3, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x7, 0x2, @perf_config_ext={0xf2, 0x6}, 0x0, 0x5, 0xfffffff8, 0x0, 0x1, 0x0, 0x1b6, 0x0, 0x6}, 0x0, 0xd, 0xffffffffffffffff, 0x0)
rt_sigqueueinfo(0x0, 0x0, &(0x7f0000000000))
setsockopt$sock_timeval(r0, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10)
bind$packet(r2, &(0x7f00000000c0)={0x11, 0xfe, 0x0, 0x1, 0xfb, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}}, 0x14)
perf_event_open(&(0x7f0000000100)={0x0, 0x80, 0xff, 0x8, 0x4, 0x1, 0x0, 0x4, 0x684, 0x4, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0xdbc, 0x0, @perf_config_ext={0xd03, 0x80000000}, 0x800, 0x3, 0x3, 0x5, 0x300000000000000, 0x7, 0x7ff, 0x0, 0x0, 0x0, 0x5}, r1, 0x10, 0xffffffffffffffff, 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r3, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
openat(r3, &(0x7f0000000180)='\x00', 0x400040, 0x80)
rt_sigqueueinfo(0x0, 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f0000000240)={'ip6_vti0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x4, 0x0, 0x7f, 0x40, 0xb, @local, @mcast1, 0x88, 0x20, 0x8, 0x2}})

00:13:26 executing program 4:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_mount_image$tmpfs(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 39)

[ 2496.318844] loop3: detected capacity change from 0 to 40
00:13:26 executing program 6:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 43)

[ 2496.409784] FAULT_INJECTION: forcing a failure.
[ 2496.409784] name failslab, interval 1, probability 0, space 0, times 0
[ 2496.410845] CPU: 1 PID: 12839 Comm: syz-executor.4 Not tainted 6.1.0-rc8-next-20221208 #1
[ 2496.411426] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
[ 2496.411997] Call Trace:
[ 2496.412193]  <TASK>
[ 2496.412363]  dump_stack_lvl+0x8f/0xb7
[ 2496.412658]  should_fail_ex.cold+0x5/0xa
[ 2496.412974]  ? jbd2__journal_start+0x194/0x8d0
[ 2496.413326]  should_failslab+0x9/0x20
[ 2496.413604]  kmem_cache_alloc+0x5a/0x410
[ 2496.413903]  ? lock_is_held_type+0xdb/0x130
[ 2496.414228]  jbd2__journal_start+0x194/0x8d0
[ 2496.414556]  __ext4_journal_start_sb+0x4a5/0x6b0
[ 2496.414904]  ? ext4_dirty_inode+0xa5/0x130
[ 2496.415208]  ? __pfx_ext4_dirty_inode+0x10/0x10
[ 2496.415549]  ext4_dirty_inode+0xa5/0x130
[ 2496.415850]  __mark_inode_dirty+0x1aa/0xe70
[ 2496.416173]  generic_update_time+0x21b/0x2b0
[ 2496.416504]  file_modified_flags+0x2d4/0x330
[ 2496.416833]  ? __pfx_file_modified_flags+0x10/0x10
[ 2496.417212]  ? __pfx_down_write+0x10/0x10
[ 2496.417522]  ext4_buffered_write_iter+0xf9/0x460
[ 2496.417879]  ? stack_trace_save+0x90/0xd0
[ 2496.418191]  ext4_file_write_iter+0x3ff/0x1930
[ 2496.418532]  ? iter_file_splice_write+0x169/0xcb0
[ 2496.418878]  ? kasan_save_stack+0x35/0x50
[ 2496.419098] loop6: detected capacity change from 0 to 40
[ 2496.419176]  ? kasan_save_stack+0x22/0x50
[ 2496.419838]  ? kasan_set_track+0x25/0x30
[ 2496.420145]  ? __kasan_kmalloc+0x82/0x90
[ 2496.420449]  ? __kmalloc+0x56/0xc0
[ 2496.420722]  ? __pfx_ext4_file_write_iter+0x10/0x10
[ 2496.421130]  ? do_splice_direct+0x1bc/0x290
[ 2496.421457]  ? do_sendfile+0xb1d/0x1280
[ 2496.421783]  ? __x64_sys_sendfile64+0x248/0x2a0
[ 2496.422126]  ? lock_is_held_type+0xdb/0x130
[ 2496.422464]  do_iter_readv_writev+0x211/0x3c0
[ 2496.422823]  ? __pfx_do_iter_readv_writev+0x10/0x10
[ 2496.423218]  ? avc_policy_seqno+0xd/0x70
[ 2496.423542]  ? security_file_permission+0xb5/0xe0
[ 2496.423927]  do_iter_write+0x18b/0x700
[ 2496.424237]  ? lock_is_held_type+0xdb/0x130
[ 2496.424585]  vfs_iter_write+0x74/0xb0
[ 2496.424890]  iter_file_splice_write+0x73e/0xcb0
[ 2496.425252]  ? __pfx_iter_file_splice_write+0x10/0x10
[ 2496.425620]  ? __pfx_generic_file_splice_read+0x10/0x10
[ 2496.426043]  ? security_file_permission+0xb5/0xe0
[ 2496.426418]  ? __pfx_iter_file_splice_write+0x10/0x10
[ 2496.426819]  direct_splice_actor+0x113/0x180
[ 2496.427161]  splice_direct_to_actor+0x33a/0x8c0
[ 2496.427518]  ? __pfx_direct_splice_actor+0x10/0x10
[ 2496.427884]  ? __pfx_splice_direct_to_actor+0x10/0x10
[ 2496.428280]  ? security_file_permission+0xb5/0xe0
[ 2496.428664]  do_splice_direct+0x1bc/0x290
[ 2496.428966]  ? __pfx_do_splice_direct+0x10/0x10
[ 2496.429343]  ? lock_is_held_type+0xdb/0x130
[ 2496.429684]  do_sendfile+0xb1d/0x1280
[ 2496.430002]  ? __pfx_do_sendfile+0x10/0x10
[ 2496.430324]  ? lock_is_held_type+0xdb/0x130
[ 2496.430659]  __x64_sys_sendfile64+0x248/0x2a0
[ 2496.430978]  ? trace_rcu_dyntick+0x1a7/0x250
[ 2496.431331]  ? __pfx___x64_sys_sendfile64+0x10/0x10
[ 2496.431683]  ? syscall_enter_from_user_mode+0x21/0x50
[ 2496.432065]  ? syscall_enter_from_user_mode+0x21/0x50
[ 2496.432434]  do_syscall_64+0x3f/0x90
[ 2496.432733]  entry_SYSCALL_64_after_hwframe+0x72/0xdc
[ 2496.433110] RIP: 0033:0x7f5dbe2acb19
[ 2496.433393] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
[ 2496.434745] RSP: 002b:00007f5dbb822188 EFLAGS: 00000246 ORIG_RAX: 0000000000000028
[ 2496.435313] RAX: ffffffffffffffda RBX: 00007f5dbe3bff60 RCX: 00007f5dbe2acb19
[ 2496.435844] RDX: 0000000000000000 RSI: 0000000000000003 RDI: 0000000000000004
[ 2496.436375] RBP: 00007f5dbb8221d0 R08: 0000000000000000 R09: 0000000000000000
[ 2496.436907] R10: 00000000fffffdef R11: 0000000000000246 R12: 0000000000000002
[ 2496.437444] R13: 00007ffc7a53101f R14: 00007f5dbb822300 R15: 0000000000022000
[ 2496.438000]  </TASK>
[ 2496.467342] syz-executor.6: attempt to access beyond end of device
[ 2496.467342] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2496.468410] Buffer I/O error on dev loop6, logical block 10, lost async page write
00:13:42 executing program 5:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 45)

00:13:42 executing program 4:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_mount_image$tmpfs(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef)

00:13:42 executing program 7:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684fd2981c8409820000080000000000000000"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x735}], 0x1, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:13:42 executing program 3:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(0xffffffffffffffff, &(0x7f0000001180)=ANY=[], 0x220)

00:13:42 executing program 2:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684f"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x100d}], 0x1, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, 0x0, &(0x7f0000000000))
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:13:42 executing program 6:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 44)

[ 2511.989096] loop5: detected capacity change from 0 to 40
[ 2511.997885] loop3: detected capacity change from 0 to 40
00:13:42 executing program 0:
perf_event_open(&(0x7f0000000080)={0x0, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r1, &(0x7f0000000100), 0x0, 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r0, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r2, 0x3800, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0x0, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r1, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:13:42 executing program 1:
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}}, 0x0, 0x6, 0xffffffffffffffff, 0xb)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
r1 = gettid()
rt_sigqueueinfo(0x0, 0x0, 0x0)
r2 = pidfd_getfd(0xffffffffffffffff, r0, 0x0)
perf_event_open(&(0x7f0000000040)={0x5, 0x80, 0x40, 0x71, 0x2, 0x0, 0x0, 0x8000, 0x20, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, @perf_config_ext={0xff}, 0x0, 0x9b5, 0xfa, 0xd, 0x0, 0x8000, 0x55, 0x0, 0x0, 0x0, 0x3ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000400)={0x2, 0x80, 0x2a, 0x81, 0xe0, 0x40, 0x0, 0x63c5ef1c, 0x80, 0x3, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x7, 0x2, @perf_config_ext={0xf2, 0x6}, 0x0, 0x5, 0xfffffff8, 0x0, 0x1, 0x0, 0x1b6, 0x0, 0x6}, 0x0, 0xd, 0xffffffffffffffff, 0x0)
rt_sigqueueinfo(0x0, 0x0, &(0x7f0000000000))
setsockopt$sock_timeval(r0, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10)
bind$packet(r2, &(0x7f00000000c0)={0x11, 0xfe, 0x0, 0x1, 0xfb, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}}, 0x14)
perf_event_open(&(0x7f0000000100)={0x0, 0x80, 0xff, 0x8, 0x4, 0x1, 0x0, 0x4, 0x684, 0x4, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0xdbc, 0x0, @perf_config_ext={0xd03, 0x80000000}, 0x800, 0x3, 0x3, 0x5, 0x300000000000000, 0x7, 0x7ff, 0x0, 0x0, 0x0, 0x5}, r1, 0x10, 0xffffffffffffffff, 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r3, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
openat(r3, &(0x7f0000000180)='\x00', 0x400040, 0x80)
rt_sigqueueinfo(0x0, 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f0000000240)={'ip6_vti0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x4, 0x0, 0x7f, 0x40, 0xb, @local, @mcast1, 0x88, 0x20, 0x8, 0x2}})

[ 2512.044939] loop6: detected capacity change from 0 to 40
00:13:42 executing program 3:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(0xffffffffffffffff, &(0x7f0000001180)=ANY=[], 0x220)

[ 2512.092855] loop4: detected capacity change from 0 to 40
[ 2512.103081] FAULT_INJECTION: forcing a failure.
[ 2512.103081] name failslab, interval 1, probability 0, space 0, times 0
[ 2512.104662] CPU: 0 PID: 12856 Comm: syz-executor.5 Not tainted 6.1.0-rc8-next-20221208 #1
[ 2512.105767] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
[ 2512.106847] Call Trace:
[ 2512.107206]  <TASK>
[ 2512.107535]  dump_stack_lvl+0x8f/0xb7
[ 2512.108089]  should_fail_ex.cold+0x5/0xa
[ 2512.108686]  should_failslab+0x9/0x20
[ 2512.109256]  __kmem_cache_alloc_node+0x5b/0x400
[ 2512.109915]  ? iter_file_splice_write+0x169/0xcb0
[ 2512.110595]  ? iter_file_splice_write+0x169/0xcb0
[ 2512.111271]  __kmalloc+0x46/0xc0
[ 2512.111774]  iter_file_splice_write+0x169/0xcb0
[ 2512.112426]  ? generic_file_read_iter+0x330/0x550
[ 2512.113126]  ? generic_file_splice_read+0x1bc/0x4d0
[ 2512.113816]  ? __pfx_iter_file_splice_write+0x10/0x10
[ 2512.114531]  ? __pfx_generic_file_splice_read+0x10/0x10
[ 2512.115271]  ? inode_security+0x105/0x140
[ 2512.115883]  ? security_file_permission+0xb5/0xe0
[ 2512.116575]  ? __pfx_iter_file_splice_write+0x10/0x10
[ 2512.117305]  direct_splice_actor+0x113/0x180
[ 2512.117935]  splice_direct_to_actor+0x33a/0x8c0
[ 2512.118599]  ? __pfx_direct_splice_actor+0x10/0x10
[ 2512.119294]  ? __pfx_splice_direct_to_actor+0x10/0x10
[ 2512.119998]  ? security_file_permission+0xb5/0xe0
[ 2512.120685]  do_splice_direct+0x1bc/0x290
[ 2512.121296]  ? __pfx_do_splice_direct+0x10/0x10
[ 2512.121988]  ? lock_is_held_type+0xdb/0x130
[ 2512.122635]  do_sendfile+0xb1d/0x1280
[ 2512.123225]  ? __pfx_do_sendfile+0x10/0x10
[ 2512.123865]  ? lock_is_held_type+0xdb/0x130
[ 2512.124513]  __x64_sys_sendfile64+0x248/0x2a0
[ 2512.125174]  ? trace_rcu_dyntick+0x1a7/0x250
[ 2512.125837]  ? __pfx___x64_sys_sendfile64+0x10/0x10
[ 2512.126522]  ? syscall_enter_from_user_mode+0x21/0x50
[ 2512.127263]  ? syscall_enter_from_user_mode+0x21/0x50
[ 2512.128014]  do_syscall_64+0x3f/0x90
[ 2512.128573]  entry_SYSCALL_64_after_hwframe+0x72/0xdc
[ 2512.129323] RIP: 0033:0x7f5e74c67b19
[ 2512.129864] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
[ 2512.132354] RSP: 002b:00007f5e721dd188 EFLAGS: 00000246 ORIG_RAX: 0000000000000028
[ 2512.133416] RAX: ffffffffffffffda RBX: 00007f5e74d7af60 RCX: 00007f5e74c67b19
[ 2512.134408] RDX: 0000000000000000 RSI: 0000000000000003 RDI: 0000000000000004
00:13:42 executing program 0:
perf_event_open(&(0x7f0000000080)={0x0, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r1, &(0x7f0000000100), 0x0, 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r0, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r2, 0x3f00, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0x0, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r1, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

[ 2512.135403] RBP: 00007f5e721dd1d0 R08: 0000000000000000 R09: 0000000000000000
[ 2512.136560] R10: 00000000fffffdef R11: 0000000000000246 R12: 0000000000000002
[ 2512.137566] R13: 00007ffd3dbd647f R14: 00007f5e721dd300 R15: 0000000000022000
[ 2512.138590]  </TASK>
00:13:42 executing program 1:
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}}, 0x0, 0x6, 0xffffffffffffffff, 0xb)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
r1 = gettid()
rt_sigqueueinfo(0x0, 0x0, 0x0)
r2 = pidfd_getfd(0xffffffffffffffff, r0, 0x0)
perf_event_open(&(0x7f0000000040)={0x5, 0x80, 0x40, 0x71, 0x2, 0x0, 0x0, 0x8000, 0x20, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, @perf_config_ext={0xff}, 0x0, 0x9b5, 0xfa, 0xd, 0x0, 0x8000, 0x55, 0x0, 0x0, 0x0, 0x3ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000400)={0x2, 0x80, 0x2a, 0x81, 0xe0, 0x40, 0x0, 0x63c5ef1c, 0x80, 0x3, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x7, 0x2, @perf_config_ext={0xf2, 0x6}, 0x0, 0x5, 0xfffffff8, 0x0, 0x1, 0x0, 0x1b6, 0x0, 0x6}, 0x0, 0xd, 0xffffffffffffffff, 0x0)
rt_sigqueueinfo(0x0, 0x0, &(0x7f0000000000))
setsockopt$sock_timeval(r0, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10)
bind$packet(r2, &(0x7f00000000c0)={0x11, 0xfe, 0x0, 0x1, 0xfb, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}}, 0x14)
perf_event_open(&(0x7f0000000100)={0x0, 0x80, 0xff, 0x8, 0x4, 0x1, 0x0, 0x4, 0x684, 0x4, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0xdbc, 0x0, @perf_config_ext={0xd03, 0x80000000}, 0x800, 0x3, 0x3, 0x5, 0x300000000000000, 0x7, 0x7ff, 0x0, 0x0, 0x0, 0x5}, r1, 0x10, 0xffffffffffffffff, 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r3, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
openat(r3, &(0x7f0000000180)='\x00', 0x400040, 0x80)
rt_sigqueueinfo(0x0, 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f0000000240)={'ip6_vti0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x4, 0x0, 0x7f, 0x40, 0xb, @local, @mcast1, 0x88, 0x20, 0x8, 0x2}})

[ 2512.156960] loop3: detected capacity change from 0 to 40
[ 2512.176661] syz-executor.6: attempt to access beyond end of device
[ 2512.176661] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2512.177665] Buffer I/O error on dev loop6, logical block 10, lost async page write
[ 2512.241924] syz-executor.4: attempt to access beyond end of device
00:13:42 executing program 3:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(0xffffffffffffffff, &(0x7f0000001180)=ANY=[], 0x220)

[ 2512.241924] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2512.244381] Buffer I/O error on dev loop4, logical block 10, lost async page write
[ 2512.321215] loop3: detected capacity change from 0 to 40
00:13:58 executing program 6:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 45)

00:13:58 executing program 2:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684f"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x100d}], 0x1, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), 0x0)
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:13:58 executing program 5:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 46)

00:13:58 executing program 3:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r0, 0x0, 0x220)

00:13:58 executing program 0:
perf_event_open(&(0x7f0000000080)={0x0, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r1, &(0x7f0000000100), 0x0, 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r0, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r2, 0x3fff, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0x0, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r1, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:13:58 executing program 1:
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}}, 0x0, 0x6, 0xffffffffffffffff, 0xb)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
r1 = gettid()
rt_sigqueueinfo(0x0, 0x0, 0x0)
r2 = pidfd_getfd(0xffffffffffffffff, r0, 0x0)
perf_event_open(&(0x7f0000000040)={0x5, 0x80, 0x40, 0x71, 0x2, 0x0, 0x0, 0x8000, 0x20, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, @perf_config_ext={0xff}, 0x0, 0x9b5, 0xfa, 0xd, 0x0, 0x8000, 0x55, 0x0, 0x0, 0x0, 0x3ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000400)={0x2, 0x80, 0x2a, 0x81, 0xe0, 0x40, 0x0, 0x63c5ef1c, 0x80, 0x3, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x7, 0x2, @perf_config_ext={0xf2, 0x6}, 0x0, 0x5, 0xfffffff8, 0x0, 0x1, 0x0, 0x1b6, 0x0, 0x6}, 0x0, 0xd, 0xffffffffffffffff, 0x0)
rt_sigqueueinfo(0x0, 0x0, &(0x7f0000000000))
setsockopt$sock_timeval(r0, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10)
bind$packet(r2, &(0x7f00000000c0)={0x11, 0xfe, 0x0, 0x1, 0xfb, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}}, 0x14)
perf_event_open(&(0x7f0000000100)={0x0, 0x80, 0xff, 0x8, 0x4, 0x1, 0x0, 0x4, 0x684, 0x4, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0xdbc, 0x0, @perf_config_ext={0xd03, 0x80000000}, 0x800, 0x3, 0x3, 0x5, 0x300000000000000, 0x7, 0x7ff, 0x0, 0x0, 0x0, 0x5}, r1, 0x10, 0xffffffffffffffff, 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r3, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
openat(r3, &(0x7f0000000180)='\x00', 0x400040, 0x80)
rt_sigqueueinfo(0x0, 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f0000000240)={'ip6_vti0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x4, 0x0, 0x7f, 0x40, 0xb, @local, @mcast1, 0x88, 0x20, 0x8, 0x2}})

00:13:58 executing program 4:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_mount_image$tmpfs(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
mount$bind(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0), 0x801, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef)

00:13:58 executing program 7:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684fd2981c8409820000080000000000000000"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x778}], 0x1, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

[ 2527.981403] loop5: detected capacity change from 0 to 40
[ 2527.994367] loop3: detected capacity change from 0 to 40
[ 2528.035719] loop6: detected capacity change from 0 to 40
[ 2528.046431] loop4: detected capacity change from 0 to 40
[ 2528.063881] syz-executor.5: attempt to access beyond end of device
[ 2528.063881] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2528.064955] Buffer I/O error on dev loop5, logical block 10, lost async page write
00:13:58 executing program 0:
perf_event_open(&(0x7f0000000080)={0x0, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r1, &(0x7f0000000100), 0x0, 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r0, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r2, 0x4000, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0x0, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r1, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:13:58 executing program 1:
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}}, 0x0, 0x6, 0xffffffffffffffff, 0xb)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
r1 = gettid()
rt_sigqueueinfo(0x0, 0x0, 0x0)
r2 = pidfd_getfd(0xffffffffffffffff, r0, 0x0)
perf_event_open(&(0x7f0000000040)={0x5, 0x80, 0x40, 0x71, 0x2, 0x0, 0x0, 0x8000, 0x20, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, @perf_config_ext={0xff}, 0x0, 0x9b5, 0xfa, 0xd, 0x0, 0x8000, 0x55, 0x0, 0x0, 0x0, 0x3ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000400)={0x2, 0x80, 0x2a, 0x81, 0xe0, 0x40, 0x0, 0x63c5ef1c, 0x80, 0x3, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x7, 0x2, @perf_config_ext={0xf2, 0x6}, 0x0, 0x5, 0xfffffff8, 0x0, 0x1, 0x0, 0x1b6, 0x0, 0x6}, 0x0, 0xd, 0xffffffffffffffff, 0x0)
rt_sigqueueinfo(0x0, 0x0, &(0x7f0000000000))
setsockopt$sock_timeval(r0, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10)
bind$packet(r2, &(0x7f00000000c0)={0x11, 0xfe, 0x0, 0x1, 0xfb, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}}, 0x14)
perf_event_open(&(0x7f0000000100)={0x0, 0x80, 0xff, 0x8, 0x4, 0x1, 0x0, 0x4, 0x684, 0x4, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0xdbc, 0x0, @perf_config_ext={0xd03, 0x80000000}, 0x800, 0x3, 0x3, 0x5, 0x300000000000000, 0x7, 0x7ff, 0x0, 0x0, 0x0, 0x5}, r1, 0x10, 0xffffffffffffffff, 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r3, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
openat(r3, &(0x7f0000000180)='\x00', 0x400040, 0x80)
rt_sigqueueinfo(0x0, 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f0000000240)={'ip6_vti0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x4, 0x0, 0x7f, 0x40, 0xb, @local, @mcast1, 0x88, 0x20, 0x8, 0x2}})

[ 2528.127941] FAULT_INJECTION: forcing a failure.
[ 2528.127941] name failslab, interval 1, probability 0, space 0, times 0
[ 2528.129604] CPU: 0 PID: 12906 Comm: syz-executor.6 Not tainted 6.1.0-rc8-next-20221208 #1
[ 2528.130646] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
[ 2528.131687] Call Trace:
[ 2528.132030]  <TASK>
[ 2528.132367]  dump_stack_lvl+0x8f/0xb7
[ 2528.132879]  should_fail_ex.cold+0x5/0xa
[ 2528.133509]  should_failslab+0x9/0x20
[ 2528.134022]  __kmem_cache_alloc_node+0x5b/0x400
[ 2528.134635]  ? iter_file_splice_write+0x169/0xcb0
[ 2528.135281]  ? iter_file_splice_write+0x169/0xcb0
[ 2528.135909]  __kmalloc+0x46/0xc0
[ 2528.136390]  iter_file_splice_write+0x169/0xcb0
[ 2528.137009]  ? generic_file_read_iter+0x330/0x550
[ 2528.137711]  ? generic_file_splice_read+0x1bc/0x4d0
[ 2528.138376]  ? __pfx_iter_file_splice_write+0x10/0x10
[ 2528.139040]  ? __pfx_generic_file_splice_read+0x10/0x10
[ 2528.139741]  ? inode_security+0x105/0x140
[ 2528.140314]  ? security_file_permission+0xb5/0xe0
[ 2528.140942]  ? __pfx_iter_file_splice_write+0x10/0x10
[ 2528.141661]  direct_splice_actor+0x113/0x180
[ 2528.142279]  splice_direct_to_actor+0x33a/0x8c0
[ 2528.142900]  ? __pfx_direct_splice_actor+0x10/0x10
[ 2528.143555]  ? __pfx_splice_direct_to_actor+0x10/0x10
[ 2528.144231]  ? security_file_permission+0xb5/0xe0
[ 2528.144866]  do_splice_direct+0x1bc/0x290
[ 2528.145456]  ? __pfx_do_splice_direct+0x10/0x10
[ 2528.146077]  ? lock_is_held_type+0xdb/0x130
[ 2528.146683]  do_sendfile+0xb1d/0x1280
[ 2528.147237]  ? __pfx_do_sendfile+0x10/0x10
[ 2528.147812]  ? lock_is_held_type+0xdb/0x130
[ 2528.148401]  __x64_sys_sendfile64+0x248/0x2a0
[ 2528.148979]  ? trace_rcu_dyntick+0x1a7/0x250
[ 2528.149660]  ? __pfx___x64_sys_sendfile64+0x10/0x10
[ 2528.150330]  ? syscall_enter_from_user_mode+0x21/0x50
[ 2528.150987]  ? syscall_enter_from_user_mode+0x21/0x50
[ 2528.151656]  do_syscall_64+0x3f/0x90
[ 2528.152159]  entry_SYSCALL_64_after_hwframe+0x72/0xdc
[ 2528.152825] RIP: 0033:0x7f3186383b19
[ 2528.153332] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
[ 2528.155585] RSP: 002b:00007f31838f9188 EFLAGS: 00000246 ORIG_RAX: 0000000000000028
[ 2528.156547] RAX: ffffffffffffffda RBX: 00007f3186496f60 RCX: 00007f3186383b19
[ 2528.157466] RDX: 0000000000000000 RSI: 0000000000000003 RDI: 0000000000000004
[ 2528.158395] RBP: 00007f31838f91d0 R08: 0000000000000000 R09: 0000000000000000
[ 2528.159297] R10: 00000000fffffdef R11: 0000000000000246 R12: 0000000000000002
[ 2528.160192] R13: 00007ffc1396bf2f R14: 00007f31838f9300 R15: 0000000000022000
[ 2528.161106]  </TASK>
00:13:58 executing program 5:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 47)

[ 2528.198620] syz-executor.4: attempt to access beyond end of device
[ 2528.198620] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2528.200297] Buffer I/O error on dev loop4, logical block 10, lost async page write
00:13:58 executing program 3:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r0, 0x0, 0x220)

[ 2528.255942] loop5: detected capacity change from 0 to 40
00:13:58 executing program 0:
perf_event_open(&(0x7f0000000080)={0x0, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r1, &(0x7f0000000100), 0x0, 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r0, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r2, 0x47ff, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0x0, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r1, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:13:58 executing program 1:
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}}, 0x0, 0x6, 0xffffffffffffffff, 0xb)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
r1 = gettid()
rt_sigqueueinfo(0x0, 0x0, 0x0)
r2 = pidfd_getfd(0xffffffffffffffff, r0, 0x0)
perf_event_open(&(0x7f0000000040)={0x5, 0x80, 0x40, 0x71, 0x2, 0x0, 0x0, 0x8000, 0x20, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, @perf_config_ext={0xff}, 0x0, 0x9b5, 0xfa, 0xd, 0x0, 0x8000, 0x55, 0x0, 0x0, 0x0, 0x3ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000400)={0x2, 0x80, 0x2a, 0x81, 0xe0, 0x40, 0x0, 0x63c5ef1c, 0x80, 0x3, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x7, 0x2, @perf_config_ext={0xf2, 0x6}, 0x0, 0x5, 0xfffffff8, 0x0, 0x1, 0x0, 0x1b6, 0x0, 0x6}, 0x0, 0xd, 0xffffffffffffffff, 0x0)
rt_sigqueueinfo(0x0, 0x0, &(0x7f0000000000))
setsockopt$sock_timeval(r0, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10)
bind$packet(r2, &(0x7f00000000c0)={0x11, 0xfe, 0x0, 0x1, 0xfb, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}}, 0x14)
perf_event_open(&(0x7f0000000100)={0x0, 0x80, 0xff, 0x8, 0x4, 0x1, 0x0, 0x4, 0x684, 0x4, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0xdbc, 0x0, @perf_config_ext={0xd03, 0x80000000}, 0x800, 0x3, 0x3, 0x5, 0x300000000000000, 0x7, 0x7ff, 0x0, 0x0, 0x0, 0x5}, r1, 0x10, 0xffffffffffffffff, 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r3, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
openat(r3, &(0x7f0000000180)='\x00', 0x400040, 0x80)
rt_sigqueueinfo(0x0, 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f0000000240)={'ip6_vti0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x4, 0x0, 0x7f, 0x40, 0xb, @local, @mcast1, 0x88, 0x20, 0x8, 0x2}})

[ 2528.321226] syz-executor.5: attempt to access beyond end of device
[ 2528.321226] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2528.322135] Buffer I/O error on dev loop5, logical block 10, lost async page write
00:13:58 executing program 7:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684fd2981c8409820000080000000000000000"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x7c5}], 0x1, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

[ 2528.347884] loop3: detected capacity change from 0 to 40
00:13:59 executing program 6:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 46)

00:13:59 executing program 4:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
open$dir(&(0x7f0000000000)='./file1\x00', 0x400000, 0x2b)
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_mount_image$tmpfs(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef)

[ 2528.486267] loop6: detected capacity change from 0 to 40
[ 2528.528289] syz-executor.6: attempt to access beyond end of device
[ 2528.528289] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2528.529176] Buffer I/O error on dev loop6, logical block 10, lost async page write
[ 2528.533327] loop4: detected capacity change from 0 to 40
[ 2528.599204] syz-executor.4: attempt to access beyond end of device
[ 2528.599204] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2528.600888] Buffer I/O error on dev loop4, logical block 10, lost async page write
00:14:15 executing program 5:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 48)

00:14:15 executing program 0:
perf_event_open(&(0x7f0000000080)={0x0, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r1, &(0x7f0000000100), 0x0, 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r0, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r2, 0x4800, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0x0, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r1, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:14:15 executing program 4:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
ioctl$AUTOFS_DEV_IOCTL_SETPIPEFD(r0, 0xc0189378, &(0x7f0000000000)={{0x1, 0x1, 0x18, <r1=>r0, {<r2=>r0}}, './file0\x00'})
openat(r2, &(0x7f0000000040)='./file0\x00', 0x2c000, 0x0)
syz_mount_image$tmpfs(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
ioctl$EXT4_IOC_PRECACHE_EXTENTS(r1, 0x6612)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r3, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r3, r0, 0x0, 0xfffffdef)

00:14:15 executing program 6:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 47)

00:14:15 executing program 1:
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}}, 0x0, 0x6, 0xffffffffffffffff, 0xb)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
r1 = gettid()
rt_sigqueueinfo(0x0, 0x0, 0x0)
r2 = pidfd_getfd(0xffffffffffffffff, r0, 0x0)
perf_event_open(&(0x7f0000000040)={0x5, 0x80, 0x40, 0x71, 0x2, 0x0, 0x0, 0x8000, 0x20, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, @perf_config_ext={0xff}, 0x0, 0x9b5, 0xfa, 0xd, 0x0, 0x8000, 0x55, 0x0, 0x0, 0x0, 0x3ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000400)={0x2, 0x80, 0x2a, 0x81, 0xe0, 0x40, 0x0, 0x63c5ef1c, 0x80, 0x3, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x7, 0x2, @perf_config_ext={0xf2, 0x6}, 0x0, 0x5, 0xfffffff8, 0x0, 0x1, 0x0, 0x1b6, 0x0, 0x6}, 0x0, 0xd, 0xffffffffffffffff, 0x0)
rt_sigqueueinfo(0x0, 0x0, &(0x7f0000000000))
setsockopt$sock_timeval(r0, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10)
bind$packet(r2, &(0x7f00000000c0)={0x11, 0xfe, 0x0, 0x1, 0xfb, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}}, 0x14)
perf_event_open(&(0x7f0000000100)={0x0, 0x80, 0xff, 0x8, 0x4, 0x1, 0x0, 0x4, 0x684, 0x4, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0xdbc, 0x0, @perf_config_ext={0xd03, 0x80000000}, 0x800, 0x3, 0x3, 0x5, 0x300000000000000, 0x7, 0x7ff, 0x0, 0x0, 0x0, 0x5}, r1, 0x10, 0xffffffffffffffff, 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r3, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
openat(r3, &(0x7f0000000180)='\x00', 0x400040, 0x80)
rt_sigqueueinfo(0x0, 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f0000000240)={'ip6_vti0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x4, 0x0, 0x7f, 0x40, 0xb, @local, @mcast1, 0x88, 0x20, 0x8, 0x2}})

00:14:15 executing program 3:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r0, 0x0, 0x220)

00:14:15 executing program 2:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684f"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x100d}], 0x1, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), 0x0)
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:14:15 executing program 7:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684fd2981c8409820000080000000000000000"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x80e}], 0x1, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

[ 2545.329776] loop5: detected capacity change from 0 to 40
[ 2545.334950] loop6: detected capacity change from 0 to 40
[ 2545.355318] loop4: detected capacity change from 0 to 40
[ 2545.386897] loop3: detected capacity change from 0 to 40
[ 2545.423326] syz-executor.4: attempt to access beyond end of device
[ 2545.423326] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2545.424246] Buffer I/O error on dev loop4, logical block 10, lost async page write
[ 2545.462822] syz-executor.6: attempt to access beyond end of device
[ 2545.462822] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2545.464494] Buffer I/O error on dev loop6, logical block 10, lost async page write
[ 2545.477106] syz-executor.5: attempt to access beyond end of device
[ 2545.477106] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2545.479079] Buffer I/O error on dev loop5, logical block 10, lost async page write
00:14:16 executing program 4:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef)

00:14:16 executing program 1:
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}}, 0x0, 0x6, 0xffffffffffffffff, 0xb)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
r1 = gettid()
rt_sigqueueinfo(0x0, 0x0, 0x0)
r2 = pidfd_getfd(0xffffffffffffffff, r0, 0x0)
perf_event_open(&(0x7f0000000040)={0x5, 0x80, 0x40, 0x71, 0x2, 0x0, 0x0, 0x8000, 0x20, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, @perf_config_ext={0xff}, 0x0, 0x9b5, 0xfa, 0xd, 0x0, 0x8000, 0x55, 0x0, 0x0, 0x0, 0x3ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000400)={0x2, 0x80, 0x2a, 0x81, 0xe0, 0x40, 0x0, 0x63c5ef1c, 0x80, 0x3, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x7, 0x2, @perf_config_ext={0xf2, 0x6}, 0x0, 0x5, 0xfffffff8, 0x0, 0x1, 0x0, 0x1b6, 0x0, 0x6}, 0x0, 0xd, 0xffffffffffffffff, 0x0)
rt_sigqueueinfo(0x0, 0x0, &(0x7f0000000000))
setsockopt$sock_timeval(r0, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10)
bind$packet(r2, &(0x7f00000000c0)={0x11, 0xfe, 0x0, 0x1, 0xfb, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}}, 0x14)
perf_event_open(&(0x7f0000000100)={0x0, 0x80, 0xff, 0x8, 0x4, 0x1, 0x0, 0x4, 0x684, 0x4, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0xdbc, 0x0, @perf_config_ext={0xd03, 0x80000000}, 0x800, 0x3, 0x3, 0x5, 0x300000000000000, 0x7, 0x7ff, 0x0, 0x0, 0x0, 0x5}, r1, 0x10, 0xffffffffffffffff, 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r3, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
openat(r3, &(0x7f0000000180)='\x00', 0x400040, 0x80)
rt_sigqueueinfo(0x0, 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f0000000240)={'ip6_vti0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x4, 0x0, 0x7f, 0x40, 0xb, @local, @mcast1, 0x88, 0x20, 0x8, 0x2}})

00:14:16 executing program 6:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 48)

00:14:16 executing program 2:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684f"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x100d}], 0x1, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), 0x0)
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:14:16 executing program 3:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684f"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x100d}], 0x1, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, 0x0, &(0x7f0000000000))
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:14:16 executing program 7:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684fd2981c8409820000080000000000000000"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x856}], 0x1, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:14:16 executing program 0:
perf_event_open(&(0x7f0000000080)={0x0, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r1, &(0x7f0000000100), 0x0, 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r0, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r2, 0x4fff, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0x0, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r1, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

[ 2545.667940] loop6: detected capacity change from 0 to 40
00:14:16 executing program 5:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 49)

[ 2545.716234] loop4: detected capacity change from 0 to 40
[ 2545.725659] loop5: detected capacity change from 0 to 40
[ 2545.737851] syz-executor.6: attempt to access beyond end of device
[ 2545.737851] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2545.738880] Buffer I/O error on dev loop6, logical block 10, lost async page write
[ 2545.791929] syz-executor.5: attempt to access beyond end of device
[ 2545.791929] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2545.792848] Buffer I/O error on dev loop5, logical block 10, lost async page write
[ 2545.834222] syz-executor.4: attempt to access beyond end of device
[ 2545.834222] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2545.835845] Buffer I/O error on dev loop4, logical block 10, lost async page write
00:14:44 executing program 5:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 50)

00:14:44 executing program 1:
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}}, 0x0, 0x6, 0xffffffffffffffff, 0xb)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
r1 = gettid()
rt_sigqueueinfo(0x0, 0x0, 0x0)
r2 = pidfd_getfd(0xffffffffffffffff, r0, 0x0)
perf_event_open(&(0x7f0000000040)={0x5, 0x80, 0x40, 0x71, 0x2, 0x0, 0x0, 0x8000, 0x20, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, @perf_config_ext={0xff}, 0x0, 0x9b5, 0xfa, 0xd, 0x0, 0x8000, 0x55, 0x0, 0x0, 0x0, 0x3ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000400)={0x2, 0x80, 0x2a, 0x81, 0xe0, 0x40, 0x0, 0x63c5ef1c, 0x80, 0x3, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x7, 0x2, @perf_config_ext={0xf2, 0x6}, 0x0, 0x5, 0xfffffff8, 0x0, 0x1, 0x0, 0x1b6, 0x0, 0x6}, 0x0, 0xd, 0xffffffffffffffff, 0x0)
rt_sigqueueinfo(0x0, 0x0, &(0x7f0000000000))
setsockopt$sock_timeval(r0, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10)
bind$packet(r2, &(0x7f00000000c0)={0x11, 0xfe, 0x0, 0x1, 0xfb, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}}, 0x14)
perf_event_open(&(0x7f0000000100)={0x0, 0x80, 0xff, 0x8, 0x4, 0x1, 0x0, 0x4, 0x684, 0x4, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0xdbc, 0x0, @perf_config_ext={0xd03, 0x80000000}, 0x800, 0x3, 0x3, 0x5, 0x300000000000000, 0x7, 0x7ff, 0x0, 0x0, 0x0, 0x5}, r1, 0x10, 0xffffffffffffffff, 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r3, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
openat(r3, &(0x7f0000000180)='\x00', 0x400040, 0x80)
rt_sigqueueinfo(0x0, 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f0000000240)={'ip6_vti0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x4, 0x0, 0x7f, 0x40, 0xb, @local, @mcast1, 0x88, 0x20, 0x8, 0x2}})

00:14:44 executing program 3:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684f"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x100d}], 0x1, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), 0x0)
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:14:44 executing program 2:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684f"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x100d}], 0x1, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(0xffffffffffffffff, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:14:44 executing program 7:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684fd2981c8409820000080000000000000000"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x8ae}], 0x1, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:14:44 executing program 4:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
r1 = openat$sr(0xffffffffffffff9c, &(0x7f0000000000), 0x4040c0, 0x0)
ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000040)={{0x1, 0x1, 0x18, <r2=>r0}, './file1\x00'})
r3 = syz_mount_image$ext4(&(0x7f00000000c0)='ext2\x00', &(0x7f0000000180)='./file0\x00', 0x0, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000240)="64a6263f7e3038bd761c1b69bd137a1bd914b5cd21c05549e403ff1d796747101d6a499c691e4b555704e6e2dec62c10cc551d914fb496adf73fe1a2049994d57da41060bcb4d488f1fdf6df525cb0", 0x4f, 0xab48}], 0xa100c8, &(0x7f00000002c0)={[{@oldalloc}, {@mblk_io_submit}, {@grpjquota}], [{@fscontext={'fscontext', 0x3d, 'system_u'}}, {@appraise_type}]})
io_uring_register$IORING_REGISTER_FILES_UPDATE(r1, 0x6, &(0x7f0000000380)={0x1, 0x0, &(0x7f0000000340)=[r2, r0, 0xffffffffffffffff, r3, r0]}, 0x5)
chdir(&(0x7f0000000140)='./file0\x00')
r4 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r4, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
r5 = openat(r4, &(0x7f0000000100)='./file0\x00', 0x0, 0x0)
syz_mount_image$tmpfs(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
r6 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r6, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r6, r5, 0x0, 0xfffffdef)

00:14:44 executing program 0:
perf_event_open(&(0x7f0000000080)={0x0, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r1, &(0x7f0000000100), 0x0, 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r0, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r2, 0x5000, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0x0, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r1, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:14:44 executing program 6:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 49)

[ 2573.752547] loop6: detected capacity change from 0 to 40
[ 2573.767592] syz-executor.6: attempt to access beyond end of device
[ 2573.767592] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2573.768556] Buffer I/O error on dev loop6, logical block 10, lost async page write
00:14:44 executing program 6:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 50)

[ 2573.840147] loop4: detected capacity change from 0 to 40
[ 2573.850967] loop5: detected capacity change from 0 to 40
00:14:44 executing program 0:
perf_event_open(&(0x7f0000000080)={0x0, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r1, &(0x7f0000000100), 0x0, 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r0, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r2, 0x57ff, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0x0, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r1, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:14:44 executing program 3:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684f"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x100d}], 0x1, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), 0x0)
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

[ 2573.963522] loop6: detected capacity change from 0 to 40
[ 2573.982422] syz-executor.5: attempt to access beyond end of device
[ 2573.982422] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2573.986825] Buffer I/O error on dev loop5, logical block 10, lost async page write
00:14:44 executing program 1:
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}}, 0x0, 0x6, 0xffffffffffffffff, 0xb)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
r1 = gettid()
rt_sigqueueinfo(0x0, 0x0, 0x0)
r2 = pidfd_getfd(0xffffffffffffffff, r0, 0x0)
perf_event_open(&(0x7f0000000040)={0x5, 0x80, 0x40, 0x71, 0x2, 0x0, 0x0, 0x8000, 0x20, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, @perf_config_ext={0xff}, 0x0, 0x9b5, 0xfa, 0xd, 0x0, 0x8000, 0x55, 0x0, 0x0, 0x0, 0x3ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000400)={0x2, 0x80, 0x2a, 0x81, 0xe0, 0x40, 0x0, 0x63c5ef1c, 0x80, 0x3, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x7, 0x2, @perf_config_ext={0xf2, 0x6}, 0x0, 0x5, 0xfffffff8, 0x0, 0x1, 0x0, 0x1b6, 0x0, 0x6}, 0x0, 0xd, 0xffffffffffffffff, 0x0)
rt_sigqueueinfo(0x0, 0x0, &(0x7f0000000000))
setsockopt$sock_timeval(r0, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10)
bind$packet(r2, &(0x7f00000000c0)={0x11, 0xfe, 0x0, 0x1, 0xfb, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}}, 0x14)
perf_event_open(&(0x7f0000000100)={0x0, 0x80, 0xff, 0x8, 0x4, 0x1, 0x0, 0x4, 0x684, 0x4, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0xdbc, 0x0, @perf_config_ext={0xd03, 0x80000000}, 0x800, 0x3, 0x3, 0x5, 0x300000000000000, 0x7, 0x7ff, 0x0, 0x0, 0x0, 0x5}, r1, 0x10, 0xffffffffffffffff, 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r3, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
openat(r3, &(0x7f0000000180)='\x00', 0x400040, 0x80)
rt_sigqueueinfo(0x0, 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f0000000240)={'ip6_vti0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x4, 0x0, 0x7f, 0x40, 0xb, @local, @mcast1, 0x88, 0x20, 0x8, 0x2}})

[ 2574.103502] syz-executor.6: attempt to access beyond end of device
[ 2574.103502] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2574.105301] Buffer I/O error on dev loop6, logical block 10, lost async page write
00:14:44 executing program 5:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 51)

00:14:44 executing program 4:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
ioctl$EXT4_IOC_SWAP_BOOT(r0, 0x6611)
r1 = openat$loop_ctrl(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$LOOP_CTL_REMOVE(r1, 0x4c81, 0x0)
r2 = perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x2}, 0x0, 0x2, 0xffffffffffffffff, 0x0)
ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000500)=ANY=[@ANYBLOB="010000000100000018000000", @ANYRES32=<r3=>r2, @ANYBLOB="00000000000000002ed9aeaff9b7f1164083cb1f9bed3f8f5e3000000000c100"])
ioctl$AUTOFS_DEV_IOCTL_READY(r3, 0xc0189376, &(0x7f0000000040)={{0x1, 0x1, 0x18, <r4=>r1, {0x4f95}}, './file0\x00'})
ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r0, 0xc0189372, &(0x7f0000000000)={{0x1, 0x1, 0x18, r1, {0x20}}, './file0\x00'})
r5 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
ioctl$EXT4_IOC_SWAP_BOOT(r5, 0x6611)
r6 = openat$cgroup_ro(r4, &(0x7f00000001c0)='memory.swap.events\x00', 0x0, 0x0)
fsconfig$FSCONFIG_SET_PATH(r5, 0x3, &(0x7f00000000c0)='vfat\x00', &(0x7f0000000180)='./file0\x00', r6)
r7 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_mount_image$tmpfs(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
r8 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r8, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r8, r7, 0x0, 0xfffffdef)

00:14:44 executing program 7:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684fd2981c8409820000080000000000000000"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x8f1}], 0x1, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

[ 2574.322295] loop4: detected capacity change from 0 to 40
[ 2574.367431] loop5: detected capacity change from 0 to 40
[ 2574.423296] syz-executor.4: attempt to access beyond end of device
[ 2574.423296] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2574.424912] Buffer I/O error on dev loop4, logical block 10, lost async page write
[ 2574.429658] FAULT_INJECTION: forcing a failure.
[ 2574.429658] name failslab, interval 1, probability 0, space 0, times 0
[ 2574.431174] CPU: 0 PID: 13042 Comm: syz-executor.5 Not tainted 6.1.0-rc8-next-20221208 #1
[ 2574.432219] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
[ 2574.433249] Call Trace:
[ 2574.433589]  <TASK>
[ 2574.433922]  dump_stack_lvl+0x8f/0xb7
[ 2574.434443]  should_fail_ex.cold+0x5/0xa
[ 2574.435002]  should_failslab+0x9/0x20
[ 2574.435520]  __kmem_cache_alloc_node+0x5b/0x400
[ 2574.436126]  ? iter_file_splice_write+0x169/0xcb0
[ 2574.436799]  ? iter_file_splice_write+0x169/0xcb0
[ 2574.437445]  __kmalloc+0x46/0xc0
[ 2574.437939]  iter_file_splice_write+0x169/0xcb0
[ 2574.438564]  ? generic_file_read_iter+0x330/0x550
[ 2574.439232]  ? generic_file_splice_read+0x1bc/0x4d0
[ 2574.439902]  ? __pfx_iter_file_splice_write+0x10/0x10
[ 2574.440584]  ? __pfx_generic_file_splice_read+0x10/0x10
[ 2574.441299]  ? inode_security+0x105/0x140
[ 2574.441892]  ? security_file_permission+0xb5/0xe0
[ 2574.442530]  ? __pfx_iter_file_splice_write+0x10/0x10
[ 2574.443201]  direct_splice_actor+0x113/0x180
[ 2574.443786]  splice_direct_to_actor+0x33a/0x8c0
[ 2574.444419]  ? __pfx_direct_splice_actor+0x10/0x10
[ 2574.445095]  ? __pfx_splice_direct_to_actor+0x10/0x10
[ 2574.445761]  ? security_file_permission+0xb5/0xe0
[ 2574.446472]  do_splice_direct+0x1bc/0x290
[ 2574.447041]  ? __pfx_do_splice_direct+0x10/0x10
[ 2574.447690]  ? lock_is_held_type+0xdb/0x130
[ 2574.448300]  do_sendfile+0xb1d/0x1280
[ 2574.448848]  ? __pfx_do_sendfile+0x10/0x10
[ 2574.449437]  ? lock_is_held_type+0xdb/0x130
[ 2574.450052]  __x64_sys_sendfile64+0x248/0x2a0
[ 2574.450652]  ? trace_rcu_dyntick+0x1a7/0x250
[ 2574.451259]  ? __pfx___x64_sys_sendfile64+0x10/0x10
[ 2574.451901]  ? syscall_enter_from_user_mode+0x21/0x50
[ 2574.452599]  ? syscall_enter_from_user_mode+0x21/0x50
[ 2574.453295]  do_syscall_64+0x3f/0x90
[ 2574.453817]  entry_SYSCALL_64_after_hwframe+0x72/0xdc
[ 2574.454545] RIP: 0033:0x7f5e74c67b19
[ 2574.455052] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
[ 2574.457365] RSP: 002b:00007f5e721dd188 EFLAGS: 00000246 ORIG_RAX: 0000000000000028
[ 2574.458354] RAX: ffffffffffffffda RBX: 00007f5e74d7af60 RCX: 00007f5e74c67b19
[ 2574.459271] RDX: 0000000000000000 RSI: 0000000000000003 RDI: 0000000000000004
[ 2574.460183] RBP: 00007f5e721dd1d0 R08: 0000000000000000 R09: 0000000000000000
[ 2574.461116] R10: 00000000fffffdef R11: 0000000000000246 R12: 0000000000000002
[ 2574.462079] R13: 00007ffd3dbd647f R14: 00007f5e721dd300 R15: 0000000000022000
[ 2574.463059]  </TASK>
00:15:02 executing program 2:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684f"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x100d}], 0x1, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(0xffffffffffffffff, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:15:02 executing program 0:
perf_event_open(&(0x7f0000000080)={0x0, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r1, &(0x7f0000000100), 0x0, 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r0, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r2, 0x5800, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0x0, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r1, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:15:02 executing program 6:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 51)

00:15:02 executing program 3:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
r1 = openat$sr(0xffffffffffffff9c, &(0x7f0000000000), 0x4040c0, 0x0)
ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000040)={{0x1, 0x1, 0x18, <r2=>r0}, './file1\x00'})
r3 = syz_mount_image$ext4(&(0x7f00000000c0)='ext2\x00', &(0x7f0000000180)='./file0\x00', 0x0, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000240)="64a6263f7e3038bd761c1b69bd137a1bd914b5cd21c05549e403ff1d796747101d6a499c691e4b555704e6e2dec62c10cc551d914fb496adf73fe1a2049994d57da41060bcb4d488f1fdf6df525cb0", 0x4f, 0xab48}], 0xa100c8, &(0x7f00000002c0)={[{@oldalloc}, {@mblk_io_submit}, {@grpjquota}], [{@fscontext={'fscontext', 0x3d, 'system_u'}}, {@appraise_type}]})
io_uring_register$IORING_REGISTER_FILES_UPDATE(r1, 0x6, &(0x7f0000000380)={0x1, 0x0, &(0x7f0000000340)=[r2, r0, 0xffffffffffffffff, r3, r0]}, 0x5)
chdir(&(0x7f0000000140)='./file0\x00')
r4 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r4, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
r5 = openat(r4, &(0x7f0000000100)='./file0\x00', 0x0, 0x0)
syz_mount_image$tmpfs(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
r6 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r6, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r6, r5, 0x0, 0xfffffdef)

00:15:02 executing program 1:
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}}, 0x0, 0x6, 0xffffffffffffffff, 0xb)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
r1 = gettid()
rt_sigqueueinfo(0x0, 0x0, 0x0)
r2 = pidfd_getfd(0xffffffffffffffff, r0, 0x0)
perf_event_open(&(0x7f0000000040)={0x5, 0x80, 0x40, 0x71, 0x2, 0x0, 0x0, 0x8000, 0x20, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, @perf_config_ext={0xff}, 0x0, 0x9b5, 0xfa, 0xd, 0x0, 0x8000, 0x55, 0x0, 0x0, 0x0, 0x3ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000400)={0x2, 0x80, 0x2a, 0x81, 0xe0, 0x40, 0x0, 0x63c5ef1c, 0x80, 0x3, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x7, 0x2, @perf_config_ext={0xf2, 0x6}, 0x0, 0x5, 0xfffffff8, 0x0, 0x1, 0x0, 0x1b6, 0x0, 0x6}, 0x0, 0xd, 0xffffffffffffffff, 0x0)
rt_sigqueueinfo(0x0, 0x0, &(0x7f0000000000))
setsockopt$sock_timeval(r0, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10)
bind$packet(r2, &(0x7f00000000c0)={0x11, 0xfe, 0x0, 0x1, 0xfb, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}}, 0x14)
perf_event_open(&(0x7f0000000100)={0x0, 0x80, 0xff, 0x8, 0x4, 0x1, 0x0, 0x4, 0x684, 0x4, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0xdbc, 0x0, @perf_config_ext={0xd03, 0x80000000}, 0x800, 0x3, 0x3, 0x5, 0x300000000000000, 0x7, 0x7ff, 0x0, 0x0, 0x0, 0x5}, r1, 0x10, 0xffffffffffffffff, 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r3, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
openat(r3, &(0x7f0000000180)='\x00', 0x400040, 0x80)
rt_sigqueueinfo(0x0, 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f0000000240)={'ip6_vti0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x4, 0x0, 0x7f, 0x40, 0xb, @local, @mcast1, 0x88, 0x20, 0x8, 0x2}})

00:15:02 executing program 4:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file1\x00', 0x0, 0x2, &(0x7f00000001c0)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x2400, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_mount_image$tmpfs(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef)
syz_mount_image$msdos(&(0x7f0000000000), &(0x7f0000000040)='./file1\x00', 0x6, 0x5, &(0x7f00000004c0)=[{&(0x7f0000000240)="e05554b2c0f99baceddd1c82f4a4d3f5568096b535bfb5f88cf49d18e877098e76e4485889c46a3f10bfa56d2185aaf3f9271da486f1074d4c950196a4a3b51b7d9cfb03d895cbdd5b11e934dbde5a0483924cab172f857e08c98e03d3f8ff48bc583ddb267d330295b0b500f59cb7b48de7d1fcba7f8ad9565deb0ae36d2b1ddd52e4bb83af2801f6e5b18ca59baa63a77f3a4a6d54aab355f79a3691c0ca1388ee87c2082ad56c6ed2e3bc9bb6add9154753457f4533b2be8cdca58ecfa06a50237cd0746d07a417ac92e09ab9732ba0c4a1668d6fdc8376a163c45db477adb560", 0xe2, 0x4}, {&(0x7f0000000340)="8728881652f24f28c600b7cf25c8819fda93bb83fa9719ef1239fb1e2b5c61f47377f10dc756155c13336fb68a3331773278e4a3bf7f62c9adbf9b53594ca4b9118e46a278973a5f26aafa1cb4e8b93a1d9f53ead9108f266c632365a67a0382af27ba2d786a1d6f117a7da5ea6f90a7445919c288c2af189b6e1d610dfa455bf2f3b3e4fcae9be0779b1c74c95f4317a213e6f961f437f54c310d6f8024787124eefca65315699826a5dbffcf302462e7a33e94760327ea7889d540a538", 0xbe, 0x8001}, {&(0x7f0000000400)="14b4e7ac24047416f2fefa5436232ef7b2b282d934a6b4578341df883fbf89813514256e1588caa54c9393138d82859f7a1d2f8f15e710e3f314190869ae7a146f7663fbd3461273452e3466f7007195017029a5c1dbb52d98a36632383387d23896472eaa81a63789ad1dd03dd394b943342038dc5cfe3472b917b7402b7b91272b7a7411705500ca07fc757237a2c25641e4c7e76e763d395f7e8daf7e8fa8990c96", 0xa3, 0xa33}, {&(0x7f00000000c0)="715b4a72c3c33b7741965d6dc4c64ebd957d1830af50a4dd1705873af80bdc2bee8a248028d025e1df097003bd10356ca455ed5f12f1b8fe77cd", 0x3a, 0x3dd}, {&(0x7f0000000180)="94297e70ca", 0x5}], 0x1005cac, &(0x7f0000000540)={[{@nodots}, {@nodots}, {@dots}, {@nodots}, {@dots}], [{@euid_eq={'euid', 0x3d, 0xee00}}, {@obj_user}]})

00:15:02 executing program 5:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 52)

00:15:02 executing program 7:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684fd2981c8409820000080000000000000000"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x93e}], 0x1, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

[ 2591.728229] loop4: detected capacity change from 0 to 40
[ 2591.756748] loop4: detected capacity change from 0 to 128
[ 2591.759203] loop3: detected capacity change from 0 to 40
[ 2591.766629] loop4: detected capacity change from 0 to 40
[ 2591.794176] loop6: detected capacity change from 0 to 40
[ 2591.804445] loop5: detected capacity change from 0 to 40
00:15:02 executing program 1:
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}}, 0x0, 0x6, 0xffffffffffffffff, 0xb)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
r1 = gettid()
rt_sigqueueinfo(0x0, 0x0, 0x0)
r2 = pidfd_getfd(0xffffffffffffffff, r0, 0x0)
perf_event_open(&(0x7f0000000040)={0x5, 0x80, 0x40, 0x71, 0x2, 0x0, 0x0, 0x8000, 0x20, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, @perf_config_ext={0xff}, 0x0, 0x9b5, 0xfa, 0xd, 0x0, 0x8000, 0x55, 0x0, 0x0, 0x0, 0x3ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000400)={0x2, 0x80, 0x2a, 0x81, 0xe0, 0x40, 0x0, 0x63c5ef1c, 0x80, 0x3, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x7, 0x2, @perf_config_ext={0xf2, 0x6}, 0x0, 0x5, 0xfffffff8, 0x0, 0x1, 0x0, 0x1b6, 0x0, 0x6}, 0x0, 0xd, 0xffffffffffffffff, 0x0)
rt_sigqueueinfo(0x0, 0x0, &(0x7f0000000000))
setsockopt$sock_timeval(r0, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10)
bind$packet(r2, &(0x7f00000000c0)={0x11, 0xfe, 0x0, 0x1, 0xfb, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}}, 0x14)
perf_event_open(&(0x7f0000000100)={0x0, 0x80, 0xff, 0x8, 0x4, 0x1, 0x0, 0x4, 0x684, 0x4, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0xdbc, 0x0, @perf_config_ext={0xd03, 0x80000000}, 0x800, 0x3, 0x3, 0x5, 0x300000000000000, 0x7, 0x7ff, 0x0, 0x0, 0x0, 0x5}, r1, 0x10, 0xffffffffffffffff, 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r3, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
openat(r3, &(0x7f0000000180)='\x00', 0x400040, 0x80)
rt_sigqueueinfo(0x0, 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f0000000240)={'ip6_vti0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x4, 0x0, 0x7f, 0x40, 0xb, @local, @mcast1, 0x88, 0x20, 0x8, 0x2}})

[ 2591.865786] FAULT_INJECTION: forcing a failure.
[ 2591.865786] name failslab, interval 1, probability 0, space 0, times 0
[ 2591.867400] CPU: 0 PID: 13068 Comm: syz-executor.6 Not tainted 6.1.0-rc8-next-20221208 #1
[ 2591.868739] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
[ 2591.869780] Call Trace:
[ 2591.870141]  <TASK>
[ 2591.870534]  dump_stack_lvl+0x8f/0xb7
[ 2591.871216]  should_fail_ex.cold+0x5/0xa
[ 2591.871765]  should_failslab+0x9/0x20
[ 2591.872419]  __kmem_cache_alloc_node+0x5b/0x400
[ 2591.873086]  ? iter_file_splice_write+0x169/0xcb0
[ 2591.873904]  ? iter_file_splice_write+0x169/0xcb0
[ 2591.874579]  __kmalloc+0x46/0xc0
[ 2591.875184]  iter_file_splice_write+0x169/0xcb0
[ 2591.875806]  ? generic_file_read_iter+0x330/0x550
[ 2591.876636]  ? generic_file_splice_read+0x1bc/0x4d0
[ 2591.877294]  ? __pfx_iter_file_splice_write+0x10/0x10
[ 2591.877969]  ? __pfx_generic_file_splice_read+0x10/0x10
[ 2591.878896]  ? inode_security+0x105/0x140
[ 2591.879512]  ? security_file_permission+0xb5/0xe0
[ 2591.880185]  ? __pfx_iter_file_splice_write+0x10/0x10
[ 2591.881048]  direct_splice_actor+0x113/0x180
[ 2591.881656]  splice_direct_to_actor+0x33a/0x8c0
[ 2591.882299]  ? __pfx_direct_splice_actor+0x10/0x10
[ 2591.882982]  ? __pfx_splice_direct_to_actor+0x10/0x10
[ 2591.883702]  ? security_file_permission+0xb5/0xe0
[ 2591.884360]  do_splice_direct+0x1bc/0x290
[ 2591.884928]  ? __pfx_do_splice_direct+0x10/0x10
[ 2591.885576]  ? lock_is_held_type+0xdb/0x130
[ 2591.886212]  do_sendfile+0xb1d/0x1280
[ 2591.886807]  ? __pfx_do_sendfile+0x10/0x10
[ 2591.887543]  ? lock_is_held_type+0xdb/0x130
[ 2591.888140]  __x64_sys_sendfile64+0x248/0x2a0
[ 2591.888906]  ? trace_rcu_dyntick+0x1a7/0x250
[ 2591.889506]  ? __pfx___x64_sys_sendfile64+0x10/0x10
[ 2591.890361]  ? syscall_enter_from_user_mode+0x21/0x50
[ 2591.891039]  ? syscall_enter_from_user_mode+0x21/0x50
[ 2591.891912]  do_syscall_64+0x3f/0x90
[ 2591.892429]  entry_SYSCALL_64_after_hwframe+0x72/0xdc
[ 2591.893100] RIP: 0033:0x7f3186383b19
[ 2591.893726] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
[ 2591.895992] RSP: 002b:00007f31838f9188 EFLAGS: 00000246 ORIG_RAX: 0000000000000028
[ 2591.897232] RAX: ffffffffffffffda RBX: 00007f3186496f60 RCX: 00007f3186383b19
[ 2591.898166] RDX: 0000000000000000 RSI: 0000000000000003 RDI: 0000000000000004
[ 2591.899367] RBP: 00007f31838f91d0 R08: 0000000000000000 R09: 0000000000000000
[ 2591.900291] R10: 00000000fffffdef R11: 0000000000000246 R12: 0000000000000002
[ 2591.901244] R13: 00007ffc1396bf2f R14: 00007f31838f9300 R15: 0000000000022000
[ 2591.902224]  </TASK>
00:15:02 executing program 3:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
r1 = openat$sr(0xffffffffffffff9c, &(0x7f0000000000), 0x4040c0, 0x0)
ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000040)={{0x1, 0x1, 0x18, <r2=>r0}, './file1\x00'})
r3 = syz_mount_image$ext4(&(0x7f00000000c0)='ext2\x00', &(0x7f0000000180)='./file0\x00', 0x0, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000240)="64a6263f7e3038bd761c1b69bd137a1bd914b5cd21c05549e403ff1d796747101d6a499c691e4b555704e6e2dec62c10cc551d914fb496adf73fe1a2049994d57da41060bcb4d488f1fdf6df525cb0", 0x4f, 0xab48}], 0xa100c8, &(0x7f00000002c0)={[{@oldalloc}, {@mblk_io_submit}, {@grpjquota}], [{@fscontext={'fscontext', 0x3d, 'system_u'}}, {@appraise_type}]})
io_uring_register$IORING_REGISTER_FILES_UPDATE(r1, 0x6, &(0x7f0000000380)={0x1, 0x0, &(0x7f0000000340)=[r2, r0, 0xffffffffffffffff, r3, r0]}, 0x5)
chdir(&(0x7f0000000140)='./file0\x00')
r4 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r4, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
r5 = openat(r4, &(0x7f0000000100)='./file0\x00', 0x0, 0x0)
syz_mount_image$tmpfs(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
r6 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r6, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r6, r5, 0x0, 0xfffffdef)

[ 2591.948735] syz-executor.5: attempt to access beyond end of device
[ 2591.948735] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2591.950973] Buffer I/O error on dev loop5, logical block 10, lost async page write
00:15:02 executing program 4:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_mount_image$tmpfs(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
ioctl$BTRFS_IOC_GET_FEATURES(r1, 0x80189439, &(0x7f0000000000))
sendfile(r1, r0, 0x0, 0xfffffdef)

[ 2591.990462] loop3: detected capacity change from 0 to 40
00:15:02 executing program 7:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684fd2981c8409820000080000000000000000"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x98b}], 0x1, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:15:02 executing program 0:
perf_event_open(&(0x7f0000000080)={0x0, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r1, &(0x7f0000000100), 0x0, 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r0, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r2, 0x5fff, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0x0, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r1, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

[ 2592.053375] loop4: detected capacity change from 0 to 40
00:15:02 executing program 1:
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}}, 0x0, 0x6, 0xffffffffffffffff, 0xb)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
r1 = gettid()
rt_sigqueueinfo(0x0, 0x0, 0x0)
r2 = pidfd_getfd(0xffffffffffffffff, r0, 0x0)
perf_event_open(&(0x7f0000000040)={0x5, 0x80, 0x40, 0x71, 0x2, 0x0, 0x0, 0x8000, 0x20, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, @perf_config_ext={0xff}, 0x0, 0x9b5, 0xfa, 0xd, 0x0, 0x8000, 0x55, 0x0, 0x0, 0x0, 0x3ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000400)={0x2, 0x80, 0x2a, 0x81, 0xe0, 0x40, 0x0, 0x63c5ef1c, 0x80, 0x3, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x7, 0x2, @perf_config_ext={0xf2, 0x6}, 0x0, 0x5, 0xfffffff8, 0x0, 0x1, 0x0, 0x1b6, 0x0, 0x6}, 0x0, 0xd, 0xffffffffffffffff, 0x0)
rt_sigqueueinfo(0x0, 0x0, &(0x7f0000000000))
setsockopt$sock_timeval(r0, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10)
bind$packet(r2, &(0x7f00000000c0)={0x11, 0xfe, 0x0, 0x1, 0xfb, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}}, 0x14)
perf_event_open(&(0x7f0000000100)={0x0, 0x80, 0xff, 0x8, 0x4, 0x1, 0x0, 0x4, 0x684, 0x4, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0xdbc, 0x0, @perf_config_ext={0xd03, 0x80000000}, 0x800, 0x3, 0x3, 0x5, 0x300000000000000, 0x7, 0x7ff, 0x0, 0x0, 0x0, 0x5}, r1, 0x10, 0xffffffffffffffff, 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r3, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
openat(r3, &(0x7f0000000180)='\x00', 0x400040, 0x80)
rt_sigqueueinfo(0x0, 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f0000000240)={'ip6_vti0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x4, 0x0, 0x7f, 0x40, 0xb, @local, @mcast1, 0x88, 0x20, 0x8, 0x2}})

00:15:02 executing program 5:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 53)

00:15:02 executing program 2:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684f"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x100d}], 0x1, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(0xffffffffffffffff, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

[ 2592.131972] syz-executor.4: attempt to access beyond end of device
[ 2592.131972] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2592.133177] Buffer I/O error on dev loop4, logical block 10, lost async page write
00:15:02 executing program 6:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 52)

[ 2592.197156] loop5: detected capacity change from 0 to 40
[ 2592.279556] syz-executor.5: attempt to access beyond end of device
[ 2592.279556] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2592.280573] Buffer I/O error on dev loop5, logical block 10, lost async page write
[ 2592.306463] loop6: detected capacity change from 0 to 40
[ 2592.392786] syz-executor.6: attempt to access beyond end of device
[ 2592.392786] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2592.393795] Buffer I/O error on dev loop6, logical block 10, lost async page write
00:15:20 executing program 6:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 53)

00:15:20 executing program 7:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684fd2981c8409820000080000000000000000"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x9d8}], 0x1, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:15:20 executing program 4:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = syz_mount_image$tmpfs(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000000240)={{0x108, 0x7f, 0x80, 0x369, 0x167, 0x7, 0x3e3, 0xb2a9}, "6486ca8956f9b3ecb0ef1618cc1a028746977fbad208b4bf33e4dd7e0df12b1c9187b85ea6337ac5aa720d8fe6a86a0d3df846c6ef4aa4fd29bbbf98c83fad55c328ea4b2a23eddaca99438da311fa0f7d337b5ac235565e787a5021362de80b0a7adea47f11cf68df5a54d08f65de06de9f9323285585adff0c7f34a9a6c9ed264496ef976e05d7899b1eacda8ef852e526cd080f911ebd7d37f130a26bf3160cd4758d79f5cf784e62eca82d3cb3b0b25ed0a5a889a8431cac0046f80df41885d7d6b7eaa35d", ['\x00', '\x00', '\x00', '\x00']}, 0x4e7)
write$binfmt_aout(r3, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r3, r1, 0x0, 0xfffffdef)
renameat(r0, &(0x7f0000000000)='./file1\x00', r2, &(0x7f0000000040)='./file1\x00')

00:15:20 executing program 5:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 54)

00:15:20 executing program 3:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
r1 = openat$sr(0xffffffffffffff9c, &(0x7f0000000000), 0x4040c0, 0x0)
ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000040)={{0x1, 0x1, 0x18, <r2=>r0}, './file1\x00'})
r3 = syz_mount_image$ext4(&(0x7f00000000c0)='ext2\x00', &(0x7f0000000180)='./file0\x00', 0x0, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000240)="64a6263f7e3038bd761c1b69bd137a1bd914b5cd21c05549e403ff1d796747101d6a499c691e4b555704e6e2dec62c10cc551d914fb496adf73fe1a2049994d57da41060bcb4d488f1fdf6df525cb0", 0x4f, 0xab48}], 0xa100c8, &(0x7f00000002c0)={[{@oldalloc}, {@mblk_io_submit}, {@grpjquota}], [{@fscontext={'fscontext', 0x3d, 'system_u'}}, {@appraise_type}]})
io_uring_register$IORING_REGISTER_FILES_UPDATE(r1, 0x6, &(0x7f0000000380)={0x1, 0x0, &(0x7f0000000340)=[r2, r0, 0xffffffffffffffff, r3, r0]}, 0x5)
chdir(&(0x7f0000000140)='./file0\x00')
r4 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r4, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
r5 = openat(r4, &(0x7f0000000100)='./file0\x00', 0x0, 0x0)
syz_mount_image$tmpfs(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
r6 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r6, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r6, r5, 0x0, 0xfffffdef)

00:15:20 executing program 1:
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}}, 0x0, 0x6, 0xffffffffffffffff, 0xb)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
r1 = gettid()
rt_sigqueueinfo(0x0, 0x0, 0x0)
r2 = pidfd_getfd(0xffffffffffffffff, r0, 0x0)
perf_event_open(&(0x7f0000000040)={0x5, 0x80, 0x40, 0x71, 0x2, 0x0, 0x0, 0x8000, 0x20, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, @perf_config_ext={0xff}, 0x0, 0x9b5, 0xfa, 0xd, 0x0, 0x8000, 0x55, 0x0, 0x0, 0x0, 0x3ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000400)={0x2, 0x80, 0x2a, 0x81, 0xe0, 0x40, 0x0, 0x63c5ef1c, 0x80, 0x3, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x7, 0x2, @perf_config_ext={0xf2, 0x6}, 0x0, 0x5, 0xfffffff8, 0x0, 0x1, 0x0, 0x1b6, 0x0, 0x6}, 0x0, 0xd, 0xffffffffffffffff, 0x0)
rt_sigqueueinfo(0x0, 0x0, &(0x7f0000000000))
setsockopt$sock_timeval(r0, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10)
bind$packet(r2, &(0x7f00000000c0)={0x11, 0xfe, 0x0, 0x1, 0xfb, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}}, 0x14)
perf_event_open(&(0x7f0000000100)={0x0, 0x80, 0xff, 0x8, 0x4, 0x1, 0x0, 0x4, 0x684, 0x4, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0xdbc, 0x0, @perf_config_ext={0xd03, 0x80000000}, 0x800, 0x3, 0x3, 0x5, 0x300000000000000, 0x7, 0x7ff, 0x0, 0x0, 0x0, 0x5}, r1, 0x10, 0xffffffffffffffff, 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r3, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
openat(r3, &(0x7f0000000180)='\x00', 0x400040, 0x80)
rt_sigqueueinfo(0x0, 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f0000000240)={'ip6_vti0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x4, 0x0, 0x7f, 0x40, 0xb, @local, @mcast1, 0x88, 0x20, 0x8, 0x2}})

00:15:20 executing program 2:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684f"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x100d}], 0x1, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r2, 0x0, 0x0, 0x800)

00:15:20 executing program 0:
perf_event_open(&(0x7f0000000080)={0x0, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r1, &(0x7f0000000100), 0x0, 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r0, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r2, 0x6000, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0x0, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r1, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

[ 2610.363668] loop5: detected capacity change from 0 to 40
[ 2610.365916] loop4: detected capacity change from 0 to 40
[ 2610.391323] loop6: detected capacity change from 0 to 40
[ 2610.397424] loop3: detected capacity change from 0 to 40
[ 2610.407933] syz-executor.5: attempt to access beyond end of device
[ 2610.407933] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2610.409129] Buffer I/O error on dev loop5, logical block 10, lost async page write
00:15:21 executing program 2:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684f"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x100d}], 0x1, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r2, 0x0, 0x0, 0x800)

00:15:21 executing program 5:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 55)

00:15:21 executing program 4:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
chdir(&(0x7f0000000000)='./file1\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = syz_mount_image$nfs(&(0x7f0000000040), &(0x7f00000000c0)='./file0/file0\x00', 0x1, 0x3, &(0x7f0000000500)=[{&(0x7f0000000380)="d9ff2d8d772bedc0d8ddf05ae7ae1c1598fe0273012bd4e80e867cbd9d635c234f8a195467e0fde5c8b0872c86c9b539b4bb441b0a9f6eb9c11c9da6847aa468b27756a805166bc10ed625e2debb4b67209ebd0eb807111de09f90a6143fbd24021e426ba8f9e01eb393d5e28034830cccaec101ec616ccbbec08d18ca5c57721f0eb7ecdb95e06396efe2ad971b7e248742edb81e79d0222e471550260811db107c92d44016c96445591b865f45f579ab279ea2", 0xb4, 0x1aec}, {&(0x7f0000000180)="e7910c9af3d7abe165ed6a974dcf5650955161dc788355369a1089a1075905e0c1dba3ebf47302c60580a7e38d3c911cbcd00ead236191b2f0e118b7618e751e32646f6ec8b32df1bba0b9e23e30b76704341a7d4e81c3c679fa370bdaaa87fa2dca32fc8a278e86a8d62aaaf90204bace73c7b9358e7631763676", 0x7b, 0x100000001}, {&(0x7f0000000440)="2a3ff06cb76017139b53b60d79ab6fd1ddbb3e11f3fcc0d2df718099d3219f9e1044c820e133e2a042dc7aab2baf9efc716a5945ab0a3271e5b8451368d3734daa9775308d3dff24e82d1e86dc38b54c69d1d31a5f8fc5e1ee09e82350c79373ae31bd9f9daa1f9d22296d8c212b5008fb2ea66bb606ad14a4975e82bd924306c11636301302d10d8feaaa15c15fd1926caa4ff5a625ae27e7", 0x99, 0x4}], 0x0, &(0x7f0000000580)={[{'*/^*)$!{]#'}, {'\xf7]!\',{'}, {}], [{@uid_lt}, {@audit}, {@defcontext={'defcontext', 0x3d, 'staff_u'}}]})
openat(r2, &(0x7f0000000600)='./file1\x00', 0x109100, 0x100)
r3 = syz_mount_image$tmpfs(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r4, &(0x7f0000000240)=ANY=[@ANYBLOB="d389efdee623e6ca48a755f6e4ac3292d543bd59871339fa873ab2fcba8ea1dd88ba7eff52350f19d0150101b236656b6d8b9cde2fffb14bcaec7ede10d6c4dee5c6a69ee89589cf207241645b15532a0f0f0ca27910e89c88a8cfab0080015df5b2e4f7857f2c2ff10b5b5108d2a30c30c0799e25cc88f1550cd9478310503f8b68596655eca268bb8910fe3cc81897de237384f7d04373cc329cb3", @ANYRESHEX=r3, @ANYRESDEC=r3, @ANYRESOCT=r4, @ANYRES64=r0, @ANYRESOCT=r1, @ANYRESDEC, @ANYRES64=r3], 0x220)

[ 2610.543770] syz-executor.6: attempt to access beyond end of device
[ 2610.543770] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2610.545398] Buffer I/O error on dev loop6, logical block 10, lost async page write
[ 2610.581321] loop5: detected capacity change from 0 to 40
[ 2610.589572] loop4: detected capacity change from 0 to 40
00:15:21 executing program 1:
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}}, 0x0, 0x6, 0xffffffffffffffff, 0xb)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
r1 = gettid()
rt_sigqueueinfo(0x0, 0x0, 0x0)
r2 = pidfd_getfd(0xffffffffffffffff, r0, 0x0)
perf_event_open(&(0x7f0000000040)={0x5, 0x80, 0x40, 0x71, 0x2, 0x0, 0x0, 0x8000, 0x20, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, @perf_config_ext={0xff}, 0x0, 0x9b5, 0xfa, 0xd, 0x0, 0x8000, 0x55, 0x0, 0x0, 0x0, 0x3ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000400)={0x2, 0x80, 0x2a, 0x81, 0xe0, 0x40, 0x0, 0x63c5ef1c, 0x80, 0x3, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x7, 0x2, @perf_config_ext={0xf2, 0x6}, 0x0, 0x5, 0xfffffff8, 0x0, 0x1, 0x0, 0x1b6, 0x0, 0x6}, 0x0, 0xd, 0xffffffffffffffff, 0x0)
rt_sigqueueinfo(0x0, 0x0, &(0x7f0000000000))
setsockopt$sock_timeval(r0, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10)
bind$packet(r2, &(0x7f00000000c0)={0x11, 0xfe, 0x0, 0x1, 0xfb, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}}, 0x14)
perf_event_open(&(0x7f0000000100)={0x0, 0x80, 0xff, 0x8, 0x4, 0x1, 0x0, 0x4, 0x684, 0x4, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0xdbc, 0x0, @perf_config_ext={0xd03, 0x80000000}, 0x800, 0x3, 0x3, 0x5, 0x300000000000000, 0x7, 0x7ff, 0x0, 0x0, 0x0, 0x5}, r1, 0x10, 0xffffffffffffffff, 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r3, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
openat(r3, &(0x7f0000000180)='\x00', 0x400040, 0x80)
rt_sigqueueinfo(0x0, 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f0000000240)={'ip6_vti0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x4, 0x0, 0x7f, 0x40, 0xb, @local, @mcast1, 0x88, 0x20, 0x8, 0x2}})

00:15:21 executing program 7:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684fd2981c8409820000080000000000000000"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0xa25}], 0x1, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

[ 2610.638589] syz-executor.5: attempt to access beyond end of device
[ 2610.638589] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2610.639575] Buffer I/O error on dev loop5, logical block 10, lost async page write
00:15:21 executing program 3:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
r1 = openat$sr(0xffffffffffffff9c, &(0x7f0000000000), 0x4040c0, 0x0)
ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000040)={{0x1, 0x1, 0x18, <r2=>r0}, './file1\x00'})
r3 = syz_mount_image$ext4(&(0x7f00000000c0)='ext2\x00', &(0x7f0000000180)='./file0\x00', 0x0, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000240)="64a6263f7e3038bd761c1b69bd137a1bd914b5cd21c05549e403ff1d796747101d6a499c691e4b555704e6e2dec62c10cc551d914fb496adf73fe1a2049994d57da41060bcb4d488f1fdf6df525cb0", 0x4f, 0xab48}], 0xa100c8, &(0x7f00000002c0)={[{@oldalloc}, {@mblk_io_submit}, {@grpjquota}], [{@fscontext={'fscontext', 0x3d, 'system_u'}}, {@appraise_type}]})
io_uring_register$IORING_REGISTER_FILES_UPDATE(r1, 0x6, &(0x7f0000000380)={0x1, 0x0, &(0x7f0000000340)=[r2, r0, 0xffffffffffffffff, r3, r0]}, 0x5)
chdir(&(0x7f0000000140)='./file0\x00')
r4 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r4, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
openat(r4, &(0x7f0000000100)='./file0\x00', 0x0, 0x0)
syz_mount_image$tmpfs(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r5, &(0x7f0000001180)=ANY=[], 0x220)

00:15:21 executing program 0:
perf_event_open(&(0x7f0000000080)={0x0, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r1, &(0x7f0000000100), 0x0, 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r0, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r2, 0x6400, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0x0, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r1, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:15:21 executing program 6:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 54)

[ 2610.797068] loop3: detected capacity change from 0 to 40
[ 2610.844305] loop6: detected capacity change from 0 to 40
[ 2610.982656] syz-executor.6: attempt to access beyond end of device
[ 2610.982656] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2610.984482] Buffer I/O error on dev loop6, logical block 10, lost async page write
[ 2627.154538] loop4: detected capacity change from 0 to 40
00:15:37 executing program 5:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 56)

00:15:37 executing program 7:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684fd2981c8409820000080000000000000000"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0xa68}], 0x1, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:15:37 executing program 6:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 55)

00:15:37 executing program 1:
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}}, 0x0, 0x6, 0xffffffffffffffff, 0xb)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
r1 = gettid()
rt_sigqueueinfo(0x0, 0x0, 0x0)
r2 = pidfd_getfd(0xffffffffffffffff, r0, 0x0)
perf_event_open(&(0x7f0000000040)={0x5, 0x80, 0x40, 0x71, 0x2, 0x0, 0x0, 0x8000, 0x20, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, @perf_config_ext={0xff}, 0x0, 0x9b5, 0xfa, 0xd, 0x0, 0x8000, 0x55, 0x0, 0x0, 0x0, 0x3ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000400)={0x2, 0x80, 0x2a, 0x81, 0xe0, 0x40, 0x0, 0x63c5ef1c, 0x80, 0x3, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x7, 0x2, @perf_config_ext={0xf2, 0x6}, 0x0, 0x5, 0xfffffff8, 0x0, 0x1, 0x0, 0x1b6, 0x0, 0x6}, 0x0, 0xd, 0xffffffffffffffff, 0x0)
rt_sigqueueinfo(0x0, 0x0, &(0x7f0000000000))
setsockopt$sock_timeval(r0, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10)
bind$packet(r2, &(0x7f00000000c0)={0x11, 0xfe, 0x0, 0x1, 0xfb, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}}, 0x14)
perf_event_open(&(0x7f0000000100)={0x0, 0x80, 0xff, 0x8, 0x4, 0x1, 0x0, 0x4, 0x684, 0x4, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0xdbc, 0x0, @perf_config_ext={0xd03, 0x80000000}, 0x800, 0x3, 0x3, 0x5, 0x300000000000000, 0x7, 0x7ff, 0x0, 0x0, 0x0, 0x5}, r1, 0x10, 0xffffffffffffffff, 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r3, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
openat(r3, &(0x7f0000000180)='\x00', 0x400040, 0x80)
rt_sigqueueinfo(0x0, 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f0000000240)={'ip6_vti0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x4, 0x0, 0x7f, 0x40, 0xb, @local, @mcast1, 0x88, 0x20, 0x8, 0x2}})

00:15:37 executing program 4:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_mount_image$tmpfs(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = dup2(r2, r0)
openat(r3, &(0x7f0000000000)='./file0\x00', 0x101900, 0xa0)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r2, r1, 0x0, 0xfffffdef)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r4, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
setsockopt$netlink_NETLINK_NO_ENOBUFS(r4, 0x10e, 0x5, &(0x7f0000000040)=0x1d703a3a, 0x4)

00:15:37 executing program 2:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684f"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x100d}], 0x1, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r2, 0x0, 0x0, 0x800)

00:15:37 executing program 3:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
r1 = openat$sr(0xffffffffffffff9c, &(0x7f0000000000), 0x4040c0, 0x0)
ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000040)={{0x1, 0x1, 0x18, <r2=>r0}, './file1\x00'})
r3 = syz_mount_image$ext4(&(0x7f00000000c0)='ext2\x00', &(0x7f0000000180)='./file0\x00', 0x0, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000240)="64a6263f7e3038bd761c1b69bd137a1bd914b5cd21c05549e403ff1d796747101d6a499c691e4b555704e6e2dec62c10cc551d914fb496adf73fe1a2049994d57da41060bcb4d488f1fdf6df525cb0", 0x4f, 0xab48}], 0xa100c8, &(0x7f00000002c0)={[{@oldalloc}, {@mblk_io_submit}, {@grpjquota}], [{@fscontext={'fscontext', 0x3d, 'system_u'}}, {@appraise_type}]})
io_uring_register$IORING_REGISTER_FILES_UPDATE(r1, 0x6, &(0x7f0000000380)={0x1, 0x0, &(0x7f0000000340)=[r2, r0, 0xffffffffffffffff, r3, r0]}, 0x5)
chdir(&(0x7f0000000140)='./file0\x00')
r4 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r4, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
openat(r4, &(0x7f0000000100)='./file0\x00', 0x0, 0x0)
syz_mount_image$tmpfs(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)

00:15:37 executing program 0:
perf_event_open(&(0x7f0000000080)={0x0, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r1, &(0x7f0000000100), 0x0, 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r0, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r2, 0x67ff, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0x0, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r1, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

[ 2627.174670] loop5: detected capacity change from 0 to 40
[ 2627.180708] loop3: detected capacity change from 0 to 40
[ 2627.183838] loop6: detected capacity change from 0 to 40
[ 2627.235739] syz-executor.6: attempt to access beyond end of device
[ 2627.235739] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2627.236654] Buffer I/O error on dev loop6, logical block 10, lost async page write
[ 2627.240671] syz-executor.5: attempt to access beyond end of device
[ 2627.240671] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2627.241574] Buffer I/O error on dev loop5, logical block 10, lost async page write
[ 2627.242633] syz-executor.4: attempt to access beyond end of device
[ 2627.242633] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2627.243502] Buffer I/O error on dev loop4, logical block 10, lost async page write
[ 2627.270430] syz-executor.4: attempt to access beyond end of device
[ 2627.270430] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2627.271407] Buffer I/O error on dev loop4, logical block 10, lost async page write
00:15:37 executing program 0:
perf_event_open(&(0x7f0000000080)={0x0, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r1, &(0x7f0000000100), 0x0, 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r0, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r2, 0x6800, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0x0, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r1, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:15:37 executing program 3:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
r1 = openat$sr(0xffffffffffffff9c, &(0x7f0000000000), 0x4040c0, 0x0)
ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000040)={{0x1, 0x1, 0x18, <r2=>r0}, './file1\x00'})
r3 = syz_mount_image$ext4(&(0x7f00000000c0)='ext2\x00', &(0x7f0000000180)='./file0\x00', 0x0, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000240)="64a6263f7e3038bd761c1b69bd137a1bd914b5cd21c05549e403ff1d796747101d6a499c691e4b555704e6e2dec62c10cc551d914fb496adf73fe1a2049994d57da41060bcb4d488f1fdf6df525cb0", 0x4f, 0xab48}], 0xa100c8, &(0x7f00000002c0)={[{@oldalloc}, {@mblk_io_submit}, {@grpjquota}], [{@fscontext={'fscontext', 0x3d, 'system_u'}}, {@appraise_type}]})
io_uring_register$IORING_REGISTER_FILES_UPDATE(r1, 0x6, &(0x7f0000000380)={0x1, 0x0, &(0x7f0000000340)=[r2, r0, 0xffffffffffffffff, r3, r0]}, 0x5)
chdir(&(0x7f0000000140)='./file0\x00')
r4 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r4, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
openat(r4, &(0x7f0000000100)='./file0\x00', 0x0, 0x0)
syz_mount_image$tmpfs(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0)

00:15:37 executing program 1:
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}}, 0x0, 0x6, 0xffffffffffffffff, 0xb)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
r1 = gettid()
rt_sigqueueinfo(0x0, 0x0, 0x0)
r2 = pidfd_getfd(0xffffffffffffffff, r0, 0x0)
perf_event_open(&(0x7f0000000040)={0x5, 0x80, 0x40, 0x71, 0x2, 0x0, 0x0, 0x8000, 0x20, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, @perf_config_ext={0xff}, 0x0, 0x9b5, 0xfa, 0xd, 0x0, 0x8000, 0x55, 0x0, 0x0, 0x0, 0x3ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000400)={0x2, 0x80, 0x2a, 0x81, 0xe0, 0x40, 0x0, 0x63c5ef1c, 0x80, 0x3, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x7, 0x2, @perf_config_ext={0xf2, 0x6}, 0x0, 0x5, 0xfffffff8, 0x0, 0x1, 0x0, 0x1b6, 0x0, 0x6}, 0x0, 0xd, 0xffffffffffffffff, 0x0)
rt_sigqueueinfo(0x0, 0x0, &(0x7f0000000000))
setsockopt$sock_timeval(r0, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10)
bind$packet(r2, &(0x7f00000000c0)={0x11, 0xfe, 0x0, 0x1, 0xfb, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}}, 0x14)
perf_event_open(&(0x7f0000000100)={0x0, 0x80, 0xff, 0x8, 0x4, 0x1, 0x0, 0x4, 0x684, 0x4, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0xdbc, 0x0, @perf_config_ext={0xd03, 0x80000000}, 0x800, 0x3, 0x3, 0x5, 0x300000000000000, 0x7, 0x7ff, 0x0, 0x0, 0x0, 0x5}, r1, 0x10, 0xffffffffffffffff, 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r3, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
openat(r3, &(0x7f0000000180)='\x00', 0x400040, 0x80)
rt_sigqueueinfo(0x0, 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f0000000240)={'ip6_vti0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x4, 0x0, 0x7f, 0x40, 0xb, @local, @mcast1, 0x88, 0x20, 0x8, 0x2}})

00:15:37 executing program 6:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 56)

00:15:37 executing program 5:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 57)

00:15:37 executing program 4:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
inotify_add_watch(0xffffffffffffffff, &(0x7f0000000000)='.\x00', 0x4000000)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_mount_image$tmpfs(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
write$binfmt_aout(0xffffffffffffffff, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(0xffffffffffffffff, r1, 0x0, 0xfffffdef)
r2 = perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000500)=ANY=[@ANYBLOB="010000000100000018000000", @ANYRES32=r2, @ANYBLOB="00000000000000002ed9aeaff9b7f1164083cb1f9bed3f8f5e3000000000c100"])
r3 = syz_open_dev$char_usb(0xc, 0xb4, 0x4)
sendfile(r3, r0, &(0x7f00000000c0)=0x4, 0x6)
ioctl$FAT_IOCTL_GET_VOLUME_ID(r2, 0x80047213, &(0x7f0000000040))

[ 2627.377358] loop3: detected capacity change from 0 to 40
00:15:38 executing program 2:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684f"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x100d}], 0x1, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r2, &(0x7f0000000140), 0x8, 0x800)

[ 2627.401461] loop5: detected capacity change from 0 to 40
[ 2627.411519] loop6: detected capacity change from 0 to 40
[ 2627.418679] loop4: detected capacity change from 0 to 40
[ 2627.458268] syz-executor.5: attempt to access beyond end of device
[ 2627.458268] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2627.459209] Buffer I/O error on dev loop5, logical block 10, lost async page write
00:15:38 executing program 7:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684fd2981c8409820000080000000000000000"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x1004}], 0x1, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

[ 2627.481429] syz-executor.6: attempt to access beyond end of device
[ 2627.481429] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2627.482337] Buffer I/O error on dev loop6, logical block 10, lost async page write
00:15:56 executing program 7:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684fd2981c8409820000080000000000000000"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x1006}], 0x1, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:15:56 executing program 2:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684f"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x100d}], 0x1, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r2, &(0x7f0000000140), 0x8, 0x800)

00:15:56 executing program 3:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
r1 = openat$sr(0xffffffffffffff9c, &(0x7f0000000000), 0x4040c0, 0x0)
ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000040)={{0x1, 0x1, 0x18, <r2=>r0}, './file1\x00'})
r3 = syz_mount_image$ext4(&(0x7f00000000c0)='ext2\x00', &(0x7f0000000180)='./file0\x00', 0x0, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000240)="64a6263f7e3038bd761c1b69bd137a1bd914b5cd21c05549e403ff1d796747101d6a499c691e4b555704e6e2dec62c10cc551d914fb496adf73fe1a2049994d57da41060bcb4d488f1fdf6df525cb0", 0x4f, 0xab48}], 0xa100c8, &(0x7f00000002c0)={[{@oldalloc}, {@mblk_io_submit}, {@grpjquota}], [{@fscontext={'fscontext', 0x3d, 'system_u'}}, {@appraise_type}]})
io_uring_register$IORING_REGISTER_FILES_UPDATE(r1, 0x6, &(0x7f0000000380)={0x1, 0x0, &(0x7f0000000340)=[r2, r0, 0xffffffffffffffff, r3, r0]}, 0x5)
chdir(&(0x7f0000000140)='./file0\x00')
r4 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r4, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
openat(r4, &(0x7f0000000100)='./file0\x00', 0x0, 0x0)

00:15:56 executing program 6:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 57)

00:15:56 executing program 0:
perf_event_open(&(0x7f0000000080)={0x0, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r1, &(0x7f0000000100), 0x0, 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r0, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r2, 0x7000, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0x0, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r1, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:15:56 executing program 1:
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}}, 0x0, 0x6, 0xffffffffffffffff, 0xb)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
r1 = gettid()
rt_sigqueueinfo(0x0, 0x0, 0x0)
r2 = pidfd_getfd(0xffffffffffffffff, r0, 0x0)
perf_event_open(&(0x7f0000000040)={0x5, 0x80, 0x40, 0x71, 0x2, 0x0, 0x0, 0x8000, 0x20, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, @perf_config_ext={0xff}, 0x0, 0x9b5, 0xfa, 0xd, 0x0, 0x8000, 0x55, 0x0, 0x0, 0x0, 0x3ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000400)={0x2, 0x80, 0x2a, 0x81, 0xe0, 0x40, 0x0, 0x63c5ef1c, 0x80, 0x3, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x7, 0x2, @perf_config_ext={0xf2, 0x6}, 0x0, 0x5, 0xfffffff8, 0x0, 0x1, 0x0, 0x1b6, 0x0, 0x6}, 0x0, 0xd, 0xffffffffffffffff, 0x0)
rt_sigqueueinfo(0x0, 0x0, &(0x7f0000000000))
setsockopt$sock_timeval(r0, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10)
bind$packet(r2, &(0x7f00000000c0)={0x11, 0xfe, 0x0, 0x1, 0xfb, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}}, 0x14)
perf_event_open(&(0x7f0000000100)={0x0, 0x80, 0xff, 0x8, 0x4, 0x1, 0x0, 0x4, 0x684, 0x4, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0xdbc, 0x0, @perf_config_ext={0xd03, 0x80000000}, 0x800, 0x3, 0x3, 0x5, 0x300000000000000, 0x7, 0x7ff, 0x0, 0x0, 0x0, 0x5}, r1, 0x10, 0xffffffffffffffff, 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r3, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
openat(r3, &(0x7f0000000180)='\x00', 0x400040, 0x80)
rt_sigqueueinfo(0x0, 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f0000000240)={'ip6_vti0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x4, 0x0, 0x7f, 0x40, 0xb, @local, @mcast1, 0x88, 0x20, 0x8, 0x2}})

[ 2645.682860] loop3: detected capacity change from 0 to 40
00:15:56 executing program 5:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 58)

00:15:56 executing program 4:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x3, &(0x7f0000000000)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}, {&(0x7f0000000240)="8ef7970b37ddcba91b1bbaa10eb0fe6793a0a29857f3915020d220761feb9397b8e9866c69f759f2a1c37396d8857196aaa1e1d7ea2af15f093ba8d984adb6afce01e7794d6f78e34e4010ad37310e0c90a6d4f10d65c5fa5553020ddef1e82798e8bb1cc359b758f70824c4de15cec10364b4ffe44bda09871ce5e1cc06f7ea1a307cbe5c6bb20f3f307131c9be6731250ac939f7a1bac85312b36cbf2b8aaf207c2ecc44bff730f96f1e168d15882a28f10cb7d54400fadf8ca941555f7d5e99", 0xc1, 0x1}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_mount_image$tmpfs(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef)

[ 2645.712805] loop6: detected capacity change from 0 to 40
[ 2645.757469] loop5: detected capacity change from 0 to 40
[ 2645.762776] loop4: detected capacity change from 0 to 40
[ 2645.784152] FAT-fs (loop4): invalid media value (0x57)
[ 2645.784910] FAT-fs (loop4): Can't find a valid FAT filesystem
00:15:56 executing program 3:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
r1 = openat$sr(0xffffffffffffff9c, &(0x7f0000000000), 0x4040c0, 0x0)
ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000040)={{0x1, 0x1, 0x18, <r2=>r0}, './file1\x00'})
r3 = syz_mount_image$ext4(&(0x7f00000000c0)='ext2\x00', &(0x7f0000000180)='./file0\x00', 0x0, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000240)="64a6263f7e3038bd761c1b69bd137a1bd914b5cd21c05549e403ff1d796747101d6a499c691e4b555704e6e2dec62c10cc551d914fb496adf73fe1a2049994d57da41060bcb4d488f1fdf6df525cb0", 0x4f, 0xab48}], 0xa100c8, &(0x7f00000002c0)={[{@oldalloc}, {@mblk_io_submit}, {@grpjquota}], [{@fscontext={'fscontext', 0x3d, 'system_u'}}, {@appraise_type}]})
io_uring_register$IORING_REGISTER_FILES_UPDATE(r1, 0x6, &(0x7f0000000380)={0x1, 0x0, &(0x7f0000000340)=[r2, r0, 0xffffffffffffffff, r3, r0]}, 0x5)
chdir(&(0x7f0000000140)='./file0\x00')
r4 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r4, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)

00:15:56 executing program 1:
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}}, 0x0, 0x6, 0xffffffffffffffff, 0xb)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
r1 = gettid()
rt_sigqueueinfo(0x0, 0x0, 0x0)
r2 = pidfd_getfd(0xffffffffffffffff, r0, 0x0)
perf_event_open(&(0x7f0000000040)={0x5, 0x80, 0x40, 0x71, 0x2, 0x0, 0x0, 0x8000, 0x20, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, @perf_config_ext={0xff}, 0x0, 0x9b5, 0xfa, 0xd, 0x0, 0x8000, 0x55, 0x0, 0x0, 0x0, 0x3ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000400)={0x2, 0x80, 0x2a, 0x81, 0xe0, 0x40, 0x0, 0x63c5ef1c, 0x80, 0x3, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x7, 0x2, @perf_config_ext={0xf2, 0x6}, 0x0, 0x5, 0xfffffff8, 0x0, 0x1, 0x0, 0x1b6, 0x0, 0x6}, 0x0, 0xd, 0xffffffffffffffff, 0x0)
rt_sigqueueinfo(0x0, 0x0, &(0x7f0000000000))
setsockopt$sock_timeval(r0, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10)
bind$packet(r2, &(0x7f00000000c0)={0x11, 0xfe, 0x0, 0x1, 0xfb, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}}, 0x14)
perf_event_open(&(0x7f0000000100)={0x0, 0x80, 0xff, 0x8, 0x4, 0x1, 0x0, 0x4, 0x684, 0x4, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0xdbc, 0x0, @perf_config_ext={0xd03, 0x80000000}, 0x800, 0x3, 0x3, 0x5, 0x300000000000000, 0x7, 0x7ff, 0x0, 0x0, 0x0, 0x5}, r1, 0x10, 0xffffffffffffffff, 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r3, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
openat(r3, &(0x7f0000000180)='\x00', 0x400040, 0x80)
rt_sigqueueinfo(0x0, 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f0000000240)={'ip6_vti0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x4, 0x0, 0x7f, 0x40, 0xb, @local, @mcast1, 0x88, 0x20, 0x8, 0x2}})

[ 2645.832964] FAULT_INJECTION: forcing a failure.
[ 2645.832964] name failslab, interval 1, probability 0, space 0, times 0
[ 2645.834818] CPU: 0 PID: 13214 Comm: syz-executor.6 Not tainted 6.1.0-rc8-next-20221208 #1
[ 2645.835798] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
[ 2645.836758] Call Trace:
[ 2645.837082]  <TASK>
[ 2645.837373]  dump_stack_lvl+0x8f/0xb7
[ 2645.837865]  should_fail_ex.cold+0x5/0xa
[ 2645.838394]  should_failslab+0x9/0x20
[ 2645.838886]  __kmem_cache_alloc_node+0x5b/0x400
[ 2645.839465]  ? iter_file_splice_write+0x169/0xcb0
[ 2645.840082]  ? iter_file_splice_write+0x169/0xcb0
[ 2645.840687]  __kmalloc+0x46/0xc0
[ 2645.841135]  iter_file_splice_write+0x169/0xcb0
[ 2645.841714]  ? generic_file_read_iter+0x330/0x550
[ 2645.842339]  ? generic_file_splice_read+0x1bc/0x4d0
[ 2645.842968]  ? __pfx_iter_file_splice_write+0x10/0x10
[ 2645.843616]  ? __pfx_generic_file_splice_read+0x10/0x10
[ 2645.844271]  ? inode_security+0x105/0x140
[ 2645.844847]  ? security_file_permission+0xb5/0xe0
[ 2645.845454]  ? __pfx_iter_file_splice_write+0x10/0x10
[ 2645.846153]  direct_splice_actor+0x113/0x180
[ 2645.846796]  splice_direct_to_actor+0x33a/0x8c0
[ 2645.847413]  ? __pfx_direct_splice_actor+0x10/0x10
[ 2645.848075]  ? __pfx_splice_direct_to_actor+0x10/0x10
[ 2645.848785]  ? security_file_permission+0xb5/0xe0
[ 2645.849468]  do_splice_direct+0x1bc/0x290
[ 2645.850009]  ? __pfx_do_splice_direct+0x10/0x10
[ 2645.850623]  ? lock_is_held_type+0xdb/0x130
[ 2645.851217]  do_sendfile+0xb1d/0x1280
[ 2645.851750]  ? __pfx_do_sendfile+0x10/0x10
[ 2645.852341]  ? lock_is_held_type+0xdb/0x130
[ 2645.852917]  __x64_sys_sendfile64+0x248/0x2a0
[ 2645.853540]  ? trace_rcu_dyntick+0x1a7/0x250
[ 2645.854160]  ? __pfx___x64_sys_sendfile64+0x10/0x10
[ 2645.854815]  ? syscall_enter_from_user_mode+0x21/0x50
00:15:56 executing program 0:
perf_event_open(&(0x7f0000000080)={0x0, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r1, &(0x7f0000000100), 0x0, 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r0, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r2, 0x7800, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0x0, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r1, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

[ 2645.855471]  ? syscall_enter_from_user_mode+0x21/0x50
[ 2645.856250]  do_syscall_64+0x3f/0x90
[ 2645.856757]  entry_SYSCALL_64_after_hwframe+0x72/0xdc
[ 2645.857415] RIP: 0033:0x7f3186383b19
[ 2645.857915] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
[ 2645.860166] RSP: 002b:00007f31838f9188 EFLAGS: 00000246 ORIG_RAX: 0000000000000028
[ 2645.861106] RAX: ffffffffffffffda RBX: 00007f3186496f60 RCX: 00007f3186383b19
[ 2645.861999] RDX: 0000000000000000 RSI: 0000000000000003 RDI: 0000000000000004
[ 2645.862923] RBP: 00007f31838f91d0 R08: 0000000000000000 R09: 0000000000000000
[ 2645.863805] R10: 00000000fffffdef R11: 0000000000000246 R12: 0000000000000002
[ 2645.864686] R13: 00007ffc1396bf2f R14: 00007f31838f9300 R15: 0000000000022000
[ 2645.865596]  </TASK>
[ 2645.920411] syz-executor.5: attempt to access beyond end of device
[ 2645.920411] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2645.922172] Buffer I/O error on dev loop5, logical block 10, lost async page write
[ 2646.015961] loop3: detected capacity change from 0 to 40
00:15:56 executing program 2:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684f"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x100d}], 0x1, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r2, &(0x7f0000000140), 0x8, 0x800)

00:15:56 executing program 6:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 58)

00:15:56 executing program 5:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 59)

[ 2646.214347] loop6: detected capacity change from 0 to 40
[ 2646.264280] syz-executor.6: attempt to access beyond end of device
[ 2646.264280] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2646.265878] Buffer I/O error on dev loop6, logical block 10, lost async page write
00:15:57 executing program 3:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
r1 = openat$sr(0xffffffffffffff9c, &(0x7f0000000000), 0x4040c0, 0x0)
ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000040)={{0x1, 0x1, 0x18, <r2=>r0}, './file1\x00'})
r3 = syz_mount_image$ext4(&(0x7f00000000c0)='ext2\x00', &(0x7f0000000180)='./file0\x00', 0x0, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000240)="64a6263f7e3038bd761c1b69bd137a1bd914b5cd21c05549e403ff1d796747101d6a499c691e4b555704e6e2dec62c10cc551d914fb496adf73fe1a2049994d57da41060bcb4d488f1fdf6df525cb0", 0x4f, 0xab48}], 0xa100c8, &(0x7f00000002c0)={[{@oldalloc}, {@mblk_io_submit}, {@grpjquota}], [{@fscontext={'fscontext', 0x3d, 'system_u'}}, {@appraise_type}]})
io_uring_register$IORING_REGISTER_FILES_UPDATE(r1, 0x6, &(0x7f0000000380)={0x1, 0x0, &(0x7f0000000340)=[r2, r0, 0xffffffffffffffff, r3, r0]}, 0x5)
chdir(&(0x7f0000000140)='./file0\x00')
pwritev(0xffffffffffffffff, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)

[ 2646.496400] loop5: detected capacity change from 0 to 40
[ 2646.603167] loop4: detected capacity change from 0 to 40
[ 2646.606696] FAT-fs (loop4): Unrecognized mount option "./file0" or missing value
[ 2646.609897] FAULT_INJECTION: forcing a failure.
[ 2646.609897] name fail_page_alloc, interval 1, probability 0, space 0, times 0
[ 2646.611662] CPU: 1 PID: 13242 Comm: syz-executor.5 Not tainted 6.1.0-rc8-next-20221208 #1
[ 2646.612743] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
[ 2646.613861] Call Trace:
[ 2646.614222]  <TASK>
[ 2646.614555]  dump_stack_lvl+0x8f/0xb7
[ 2646.615111]  should_fail_ex.cold+0x5/0xa
[ 2646.615692]  prepare_alloc_pages+0x178/0x500
[ 2646.616472]  __alloc_pages+0x149/0x500
[ 2646.617025]  ? __pfx___alloc_pages+0x10/0x10
[ 2646.617708]  ? __pfx___lock_acquire+0x10/0x10
[ 2646.618395]  ? __pfx_mark_lock.part.0+0x10/0x10
[ 2646.619194]  alloc_pages+0x1a0/0x260
[ 2646.619790]  filemap_alloc_folio+0x32a/0x410
[ 2646.620371]  ? __filemap_get_folio+0x254/0xc90
[ 2646.621156]  ? __pfx_lock_release+0x10/0x10
[ 2646.621815]  ? __pfx_filemap_alloc_folio+0x10/0x10
[ 2646.622516]  ? xas_start+0x157/0x6a0
[ 2646.623110]  ? xas_load+0x6a/0x140
[ 2646.623738]  __filemap_get_folio+0x32c/0xc90
[ 2646.624432]  ? __pfx___filemap_get_folio+0x10/0x10
[ 2646.625119]  ? __mark_inode_dirty+0x68c/0xe70
[ 2646.625784]  pagecache_get_page+0x2e/0x130
[ 2646.626387]  ? __pfx_fat_get_block+0x10/0x10
[ 2646.627055]  block_write_begin+0x35/0x450
[ 2646.627638]  ? lock_release+0x3b6/0x750
[ 2646.628224]  cont_write_begin+0x4fe/0x700
[ 2646.628829]  ? __pfx_fat_get_block+0x10/0x10
[ 2646.629461]  ? __pfx_cont_write_begin+0x10/0x10
[ 2646.630107]  ? __mark_inode_dirty+0x68c/0xe70
[ 2646.630792]  fat_write_begin+0x89/0x180
[ 2646.631339]  ? __pfx_fat_get_block+0x10/0x10
[ 2646.631965]  generic_perform_write+0x25a/0x580
[ 2646.632641]  ? __pfx_generic_perform_write+0x10/0x10
[ 2646.633358]  ? __pfx_fat_update_time+0x10/0x10
[ 2646.634035]  ? __pfx_file_update_time+0x10/0x10
[ 2646.634775]  ? generic_write_checks+0x2c0/0x400
[ 2646.635568]  __generic_file_write_iter+0x308/0x4b0
[ 2646.636375]  ? do_sendfile+0xb1d/0x1280
[ 2646.636986]  ? __x64_sys_sendfile64+0x248/0x2a0
[ 2646.637661]  generic_file_write_iter+0xe7/0x350
[ 2646.638316]  do_iter_readv_writev+0x211/0x3c0
[ 2646.638975]  ? __pfx_do_iter_readv_writev+0x10/0x10
[ 2646.639764]  ? avc_policy_seqno+0xd/0x70
[ 2646.640341]  ? security_file_permission+0xb5/0xe0
[ 2646.641139]  do_iter_write+0x18b/0x700
[ 2646.641720]  ? lock_is_held_type+0xdb/0x130
[ 2646.642369]  vfs_iter_write+0x74/0xb0
[ 2646.643081]  iter_file_splice_write+0x73e/0xcb0
[ 2646.643838]  ? __pfx_iter_file_splice_write+0x10/0x10
[ 2646.644600]  ? __pfx_generic_file_splice_read+0x10/0x10
[ 2646.645602]  ? inode_security+0x105/0x140
[ 2646.646464]  ? security_file_permission+0xb5/0xe0
[ 2646.647285]  ? __pfx_iter_file_splice_write+0x10/0x10
[ 2646.648200]  direct_splice_actor+0x113/0x180
[ 2646.649052]  splice_direct_to_actor+0x33a/0x8c0
[ 2646.649900]  ? __pfx_direct_splice_actor+0x10/0x10
[ 2646.650702]  ? __pfx_splice_direct_to_actor+0x10/0x10
[ 2646.651548]  ? security_file_permission+0xb5/0xe0
[ 2646.652348]  do_splice_direct+0x1bc/0x290
[ 2646.653027]  ? __pfx_do_splice_direct+0x10/0x10
[ 2646.653926]  ? lock_is_held_type+0xdb/0x130
[ 2646.654514]  do_sendfile+0xb1d/0x1280
[ 2646.655249]  ? __pfx_do_sendfile+0x10/0x10
[ 2646.655918]  ? lock_is_held_type+0xdb/0x130
[ 2646.656672]  __x64_sys_sendfile64+0x248/0x2a0
[ 2646.657381]  ? trace_rcu_dyntick+0x1a7/0x250
[ 2646.658026]  ? __pfx___x64_sys_sendfile64+0x10/0x10
[ 2646.658823]  ? syscall_enter_from_user_mode+0x21/0x50
[ 2646.659558]  ? syscall_enter_from_user_mode+0x21/0x50
[ 2646.660340]  do_syscall_64+0x3f/0x90
[ 2646.660975]  entry_SYSCALL_64_after_hwframe+0x72/0xdc
[ 2646.661790] RIP: 0033:0x7f5e74c67b19
[ 2646.662299] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
[ 2646.664854] RSP: 002b:00007f5e721dd188 EFLAGS: 00000246 ORIG_RAX: 0000000000000028
[ 2646.665990] RAX: ffffffffffffffda RBX: 00007f5e74d7af60 RCX: 00007f5e74c67b19
[ 2646.667076] RDX: 0000000000000000 RSI: 0000000000000003 RDI: 0000000000000004
[ 2646.668119] RBP: 00007f5e721dd1d0 R08: 0000000000000000 R09: 0000000000000000
[ 2646.669066] R10: 00000000fffffdef R11: 0000000000000246 R12: 0000000000000002
[ 2646.670062] R13: 00007ffd3dbd647f R14: 00007f5e721dd300 R15: 0000000000022000
[ 2646.671119]  </TASK>
[ 2646.850775] syz-executor.5: attempt to access beyond end of device
[ 2646.850775] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2646.852522] Buffer I/O error on dev loop5, logical block 10, lost async page write
00:16:16 executing program 1:
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}}, 0x0, 0x6, 0xffffffffffffffff, 0xb)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
r1 = gettid()
rt_sigqueueinfo(0x0, 0x0, 0x0)
r2 = pidfd_getfd(0xffffffffffffffff, r0, 0x0)
perf_event_open(&(0x7f0000000040)={0x5, 0x80, 0x40, 0x71, 0x2, 0x0, 0x0, 0x8000, 0x20, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, @perf_config_ext={0xff}, 0x0, 0x9b5, 0xfa, 0xd, 0x0, 0x8000, 0x55, 0x0, 0x0, 0x0, 0x3ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000400)={0x2, 0x80, 0x2a, 0x81, 0xe0, 0x40, 0x0, 0x63c5ef1c, 0x80, 0x3, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x7, 0x2, @perf_config_ext={0xf2, 0x6}, 0x0, 0x5, 0xfffffff8, 0x0, 0x1, 0x0, 0x1b6, 0x0, 0x6}, 0x0, 0xd, 0xffffffffffffffff, 0x0)
rt_sigqueueinfo(0x0, 0x0, &(0x7f0000000000))
setsockopt$sock_timeval(r0, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10)
bind$packet(r2, &(0x7f00000000c0)={0x11, 0xfe, 0x0, 0x1, 0xfb, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}}, 0x14)
perf_event_open(&(0x7f0000000100)={0x0, 0x80, 0xff, 0x8, 0x4, 0x1, 0x0, 0x4, 0x684, 0x4, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0xdbc, 0x0, @perf_config_ext={0xd03, 0x80000000}, 0x800, 0x3, 0x3, 0x5, 0x300000000000000, 0x7, 0x7ff, 0x0, 0x0, 0x0, 0x5}, r1, 0x10, 0xffffffffffffffff, 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r3, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
openat(r3, &(0x7f0000000180)='\x00', 0x400040, 0x80)
rt_sigqueueinfo(0x0, 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f0000000240)={'ip6_vti0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x4, 0x0, 0x7f, 0x40, 0xb, @local, @mcast1, 0x88, 0x20, 0x8, 0x2}})

00:16:16 executing program 5:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 60)

00:16:16 executing program 4:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f00000000c0)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000180)='./file1\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x101042, 0x0)
syz_mount_image$tmpfs(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
r2 = memfd_secret(0x0)
linkat(r2, &(0x7f0000000000)='./file0\x00', r1, &(0x7f0000000040)='./file1\x00', 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef)

[ 2665.710718] FAT-fs (loop4): bogus number of reserved sectors
[ 2665.711230] FAT-fs (loop4): Can't find a valid FAT filesystem
[ 2665.725856] FAT-fs (loop4): bogus number of reserved sectors
[ 2665.726381] FAT-fs (loop4): Can't find a valid FAT filesystem
00:16:16 executing program 7:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684fd2981c8409820000080000000000000000"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x100f}], 0x1, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:16:16 executing program 0:
perf_event_open(&(0x7f0000000080)={0x0, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r1, &(0x7f0000000100), 0x0, 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r0, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r2, 0x8102, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0x0, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r1, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:16:16 executing program 6:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 59)

00:16:16 executing program 3:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
r1 = openat$sr(0xffffffffffffff9c, &(0x7f0000000000), 0x4040c0, 0x0)
ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000040)={{0x1, 0x1, 0x18, <r2=>r0}, './file1\x00'})
r3 = syz_mount_image$ext4(&(0x7f00000000c0)='ext2\x00', &(0x7f0000000180)='./file0\x00', 0x0, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000240)="64a6263f7e3038bd761c1b69bd137a1bd914b5cd21c05549e403ff1d796747101d6a499c691e4b555704e6e2dec62c10cc551d914fb496adf73fe1a2049994d57da41060bcb4d488f1fdf6df525cb0", 0x4f, 0xab48}], 0xa100c8, &(0x7f00000002c0)={[{@oldalloc}, {@mblk_io_submit}, {@grpjquota}], [{@fscontext={'fscontext', 0x3d, 'system_u'}}, {@appraise_type}]})
io_uring_register$IORING_REGISTER_FILES_UPDATE(r1, 0x6, &(0x7f0000000380)={0x1, 0x0, &(0x7f0000000340)=[r2, r0, 0xffffffffffffffff, r3, r0]}, 0x5)
chdir(&(0x7f0000000140)='./file0\x00')
pwritev(0xffffffffffffffff, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)

00:16:16 executing program 2:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684f"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x100d}], 0x1, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x0)

[ 2665.740098] loop6: detected capacity change from 0 to 40
[ 2665.773366] loop5: detected capacity change from 0 to 40
[ 2665.802497] loop3: detected capacity change from 0 to 40
[ 2665.840303] FAULT_INJECTION: forcing a failure.
[ 2665.840303] name fail_page_alloc, interval 1, probability 0, space 0, times 0
[ 2665.841919] CPU: 1 PID: 13260 Comm: syz-executor.6 Not tainted 6.1.0-rc8-next-20221208 #1
[ 2665.842935] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
[ 2665.843968] Call Trace:
[ 2665.844301]  <TASK>
[ 2665.844601]  dump_stack_lvl+0x8f/0xb7
[ 2665.845079] syz-executor.5: attempt to access beyond end of device
[ 2665.845079] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2665.845110] Buffer I/O error on dev loop5, logical block 10, lost async page write
[ 2665.846513]  should_fail_ex.cold+0x5/0xa
[ 2665.847610]  prepare_alloc_pages+0x178/0x500
[ 2665.848209]  __alloc_pages+0x149/0x500
[ 2665.848728]  ? __pfx___alloc_pages+0x10/0x10
[ 2665.849313]  ? __pfx___lock_acquire+0x10/0x10
[ 2665.849911]  ? __pfx_mark_lock.part.0+0x10/0x10
[ 2665.850536]  alloc_pages+0x1a0/0x260
[ 2665.851057]  filemap_alloc_folio+0x32a/0x410
[ 2665.851720]  ? __filemap_get_folio+0x254/0xc90
[ 2665.852429]  ? __pfx_lock_release+0x10/0x10
[ 2665.853117]  ? __pfx_filemap_alloc_folio+0x10/0x10
[ 2665.853858]  ? xas_start+0x157/0x6a0
[ 2665.854456]  ? xas_load+0x6a/0x140
[ 2665.855031]  __filemap_get_folio+0x32c/0xc90
[ 2665.855736]  ? __pfx___filemap_get_folio+0x10/0x10
[ 2665.856500]  ? __mark_inode_dirty+0x68c/0xe70
[ 2665.857232]  pagecache_get_page+0x2e/0x130
[ 2665.857887]  ? __pfx_fat_get_block+0x10/0x10
[ 2665.858576]  block_write_begin+0x35/0x450
[ 2665.859220]  ? lock_release+0x3b6/0x750
[ 2665.859772]  cont_write_begin+0x4fe/0x700
[ 2665.860349]  ? __pfx_fat_get_block+0x10/0x10
[ 2665.860943]  ? __pfx_cont_write_begin+0x10/0x10
[ 2665.861570]  ? __mark_inode_dirty+0x68c/0xe70
[ 2665.862219]  fat_write_begin+0x89/0x180
[ 2665.862755]  ? __pfx_fat_get_block+0x10/0x10
[ 2665.863364]  generic_perform_write+0x25a/0x580
[ 2665.863998]  ? __pfx_generic_perform_write+0x10/0x10
[ 2665.864669]  ? __pfx_fat_update_time+0x10/0x10
[ 2665.865286]  ? __pfx_file_update_time+0x10/0x10
[ 2665.865921]  ? generic_write_checks+0x2c0/0x400
[ 2665.866551]  __generic_file_write_iter+0x308/0x4b0
[ 2665.867229]  ? __x64_sys_sendfile64+0x248/0x2a0
[ 2665.867852]  generic_file_write_iter+0xe7/0x350
[ 2665.868496]  do_iter_readv_writev+0x211/0x3c0
[ 2665.869116]  ? __pfx_do_iter_readv_writev+0x10/0x10
[ 2665.869789]  ? avc_policy_seqno+0xd/0x70
[ 2665.870356]  ? security_file_permission+0xb5/0xe0
[ 2665.871034]  do_iter_write+0x18b/0x700
[ 2665.871585]  ? lock_is_held_type+0xdb/0x130
[ 2665.872186]  vfs_iter_write+0x74/0xb0
[ 2665.872721]  iter_file_splice_write+0x73e/0xcb0
[ 2665.873373]  ? __pfx_iter_file_splice_write+0x10/0x10
[ 2665.874067]  ? __pfx_generic_file_splice_read+0x10/0x10
[ 2665.874780]  ? inode_security+0x105/0x140
[ 2665.875372]  ? security_file_permission+0xb5/0xe0
[ 2665.876024]  ? __pfx_iter_file_splice_write+0x10/0x10
[ 2665.876716]  direct_splice_actor+0x113/0x180
[ 2665.877319]  splice_direct_to_actor+0x33a/0x8c0
[ 2665.877951]  ? __pfx_direct_splice_actor+0x10/0x10
[ 2665.878616]  ? __pfx_splice_direct_to_actor+0x10/0x10
[ 2665.879319]  ? security_file_permission+0xb5/0xe0
[ 2665.879983]  do_splice_direct+0x1bc/0x290
[ 2665.880544]  ? __pfx_do_splice_direct+0x10/0x10
[ 2665.881195]  ? lock_is_held_type+0xdb/0x130
00:16:16 executing program 1:
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}}, 0x0, 0x6, 0xffffffffffffffff, 0xb)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
r1 = gettid()
rt_sigqueueinfo(0x0, 0x0, 0x0)
r2 = pidfd_getfd(0xffffffffffffffff, r0, 0x0)
perf_event_open(&(0x7f0000000040)={0x5, 0x80, 0x40, 0x71, 0x2, 0x0, 0x0, 0x8000, 0x20, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, @perf_config_ext={0xff}, 0x0, 0x9b5, 0xfa, 0xd, 0x0, 0x8000, 0x55, 0x0, 0x0, 0x0, 0x3ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000400)={0x2, 0x80, 0x2a, 0x81, 0xe0, 0x40, 0x0, 0x63c5ef1c, 0x80, 0x3, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x7, 0x2, @perf_config_ext={0xf2, 0x6}, 0x0, 0x5, 0xfffffff8, 0x0, 0x1, 0x0, 0x1b6, 0x0, 0x6}, 0x0, 0xd, 0xffffffffffffffff, 0x0)
rt_sigqueueinfo(0x0, 0x0, &(0x7f0000000000))
setsockopt$sock_timeval(r0, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10)
bind$packet(r2, &(0x7f00000000c0)={0x11, 0xfe, 0x0, 0x1, 0xfb, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}}, 0x14)
perf_event_open(&(0x7f0000000100)={0x0, 0x80, 0xff, 0x8, 0x4, 0x1, 0x0, 0x4, 0x684, 0x4, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0xdbc, 0x0, @perf_config_ext={0xd03, 0x80000000}, 0x800, 0x3, 0x3, 0x5, 0x300000000000000, 0x7, 0x7ff, 0x0, 0x0, 0x0, 0x5}, r1, 0x10, 0xffffffffffffffff, 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r3, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
openat(r3, &(0x7f0000000180)='\x00', 0x400040, 0x80)
rt_sigqueueinfo(0x0, 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f0000000240)={'ip6_vti0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x4, 0x0, 0x7f, 0x40, 0xb, @local, @mcast1, 0x88, 0x20, 0x8, 0x2}})

[ 2665.881792]  do_sendfile+0xb1d/0x1280
[ 2665.882479]  ? __pfx_do_sendfile+0x10/0x10
[ 2665.883099]  ? lock_is_held_type+0xdb/0x130
[ 2665.883703]  __x64_sys_sendfile64+0x248/0x2a0
[ 2665.884306]  ? trace_rcu_dyntick+0x1a7/0x250
[ 2665.884909]  ? __pfx___x64_sys_sendfile64+0x10/0x10
[ 2665.885581]  ? syscall_enter_from_user_mode+0x21/0x50
[ 2665.886256]  ? syscall_enter_from_user_mode+0x21/0x50
[ 2665.886942]  do_syscall_64+0x3f/0x90
[ 2665.887473]  entry_SYSCALL_64_after_hwframe+0x72/0xdc
[ 2665.888152] RIP: 0033:0x7f3186383b19
[ 2665.888647] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
[ 2665.890946] RSP: 002b:00007f31838f9188 EFLAGS: 00000246 ORIG_RAX: 0000000000000028
[ 2665.891962] RAX: ffffffffffffffda RBX: 00007f3186496f60 RCX: 00007f3186383b19
[ 2665.892883] RDX: 0000000000000000 RSI: 0000000000000003 RDI: 0000000000000004
[ 2665.893802] RBP: 00007f31838f91d0 R08: 0000000000000000 R09: 0000000000000000
[ 2665.894728] R10: 00000000fffffdef R11: 0000000000000246 R12: 0000000000000002
[ 2665.895663] R13: 00007ffc1396bf2f R14: 00007f31838f9300 R15: 0000000000022000
[ 2665.896606]  </TASK>
00:16:16 executing program 4:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x8035, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x800471, &(0x7f0000000600)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r1 = syz_mount_image$tmpfs(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
ioctl$EXT4_IOC_SWAP_BOOT(r2, 0x6611)
fsconfig$FSCONFIG_SET_PATH_EMPTY(r2, 0x4, &(0x7f0000000500)='\x1c\x00', &(0x7f0000000540)='./file0\x00', r0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/slabinfo\x00', 0x0, 0x0)
r4 = fspick(r1, &(0x7f00000000c0)='./file1\x00', 0x1)
r5 = syz_open_dev$tty1(0xc, 0x4, 0x1)
writev(r5, &(0x7f0000000000)=[{&(0x7f0000000140)="02b2dccad213e1e6cf54b7a797f8f22a47f25b7658fb110b2e76f95b0f318b8fa745e6ffba4414d29a42bfab524bc5bffb17decc4540a6f00b9772f5f9789a9525790df8d989b23530d0a1398f2ad734c7ff47961be476ffeec81efa3d3aa64b8ea329261dfc2e1047a68670f0e5950d6a5414956bddd09e101b5b66e5742fe843413e065e3b86a242b37bc58c68153a45015f6f1ea67762c302e461e0c84bbb7f8d464f5a72d9fad56dac0c5028a4012a93dbc7da640786e3c9898cdd8fe091b166bfcd66e6257abc923ceaf90e994deded3fe8a59c2105f5caf366d32170ef51299dbf441bc3cddda352a2e07375fb44e75fed8082f3e960015d9bcddb0c834feda68d113a9a9fc0d1c30153685caf43b176219b666d74e67b6192cfd8a561c6c4aadcc80ed8c469bc41b028f1db515d699e45ad3379f9b1edb8de4bb2f8615d6716297baac7e45073fcecf31e51ec78c40edd78f245bced04414f849fb961fbbe79ff2ed7c48ec1b5331f9755d7094986fc8da198ce4a12f9ddfb43e565bc4fed618da9a693d03c3e7ec4b3014dfc022103e277c1b12efb03ef8b197f3a931f6cbe238cf8a4e7639b409b4586f66da41b94eed69d52ba9fde5aa1ee774d4e626932dc3511b10ae3bc3e8688a7a83b0467dfbf92951747396735c9f47ad4552e7bdf4f8e7998a1266a360beb2ec1527390452139f9ab91ee250efcf3413e72a6b2688d8b6a4748ccc165bbf886573ccdd03bd93f32a866cd878ec246e06f31d4d7f7ec9836b7305ee0c1b9fa75cd6e4ca5cc2f107b654f15a2442cd9c8eaf581d093639fe35e0da49394c5ed66ad29bc2b863649e16c1951d0d3dd6f1048539e558ee1f059d91510a5acd84777ca01545635d2fb40e2f205bb11435023e47e4e2f85b6d1b56b688dd1a4304708a561d32dbaa6cd4f969e67af33773d4e9772751019dc6c2af7e2fe9d3c7eb6f1b401926603d90802f792b081957dd5ebd18410cd42b2ea05ae9a61254e4b878384b8a376fe9eba06afc1253f2224fab88feb7c426e3dfb19385afbb42cc13209b419568eeafdf505dc5ca30acc17d337e941e0badf9f9413f381fe9a315e2597426805827943f193f02a12554d434bd91708a28d9da1bf64ad64f80a7287d1e02d5d1f14bf9d89ba3badfa524694db6a651e97ea64104ad34942f36745259f4ec32fdce0bd13e693ccbe0e012e61a1fae9fc1662b99871e3812cea14d12646ccc08b0514762a475ecdbf9071377bb1ecd891c6fe32fde1d3044caf466b3a342b7541e8ed7432e94baf1d5546aff0e23f6a03c9ea5635519533e712639c27958e3a0f3684ed91cfb2e6e4", 0x3b8}], 0x1)
write$binfmt_aout(r4, &(0x7f0000000040)=ANY=[@ANYRESHEX=r5], 0x220)
sendfile(r3, r0, 0x0, 0xfffffdef)

00:16:16 executing program 5:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 61)

[ 2665.966445] loop4: detected capacity change from 0 to 64
[ 2665.969932] syz-executor.6: attempt to access beyond end of device
[ 2665.969932] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2665.971229] Buffer I/O error on dev loop6, logical block 10, lost async page write
00:16:16 executing program 0:
perf_event_open(&(0x7f0000000080)={0x0, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r1, &(0x7f0000000100), 0x0, 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r0, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r2, 0xff01, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0x0, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r1, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:16:16 executing program 3:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
r1 = openat$sr(0xffffffffffffff9c, &(0x7f0000000000), 0x4040c0, 0x0)
ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000040)={{0x1, 0x1, 0x18, <r2=>r0}, './file1\x00'})
r3 = syz_mount_image$ext4(&(0x7f00000000c0)='ext2\x00', &(0x7f0000000180)='./file0\x00', 0x0, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000240)="64a6263f7e3038bd761c1b69bd137a1bd914b5cd21c05549e403ff1d796747101d6a499c691e4b555704e6e2dec62c10cc551d914fb496adf73fe1a2049994d57da41060bcb4d488f1fdf6df525cb0", 0x4f, 0xab48}], 0xa100c8, &(0x7f00000002c0)={[{@oldalloc}, {@mblk_io_submit}, {@grpjquota}], [{@fscontext={'fscontext', 0x3d, 'system_u'}}, {@appraise_type}]})
io_uring_register$IORING_REGISTER_FILES_UPDATE(r1, 0x6, &(0x7f0000000380)={0x1, 0x0, &(0x7f0000000340)=[r2, r0, 0xffffffffffffffff, r3, r0]}, 0x5)
chdir(&(0x7f0000000140)='./file0\x00')
pwritev(0xffffffffffffffff, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)

00:16:16 executing program 7:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684fd2981c8409820000080000000000000000"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x1010}], 0x1, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

[ 2666.022703] loop5: detected capacity change from 0 to 40
00:16:16 executing program 1:
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}}, 0x0, 0x6, 0xffffffffffffffff, 0xb)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
r1 = gettid()
rt_sigqueueinfo(0x0, 0x0, 0x0)
r2 = pidfd_getfd(0xffffffffffffffff, r0, 0x0)
perf_event_open(&(0x7f0000000040)={0x5, 0x80, 0x40, 0x71, 0x2, 0x0, 0x0, 0x8000, 0x20, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, @perf_config_ext={0xff}, 0x0, 0x9b5, 0xfa, 0xd, 0x0, 0x8000, 0x55, 0x0, 0x0, 0x0, 0x3ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000400)={0x2, 0x80, 0x2a, 0x81, 0xe0, 0x40, 0x0, 0x63c5ef1c, 0x80, 0x3, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x7, 0x2, @perf_config_ext={0xf2, 0x6}, 0x0, 0x5, 0xfffffff8, 0x0, 0x1, 0x0, 0x1b6, 0x0, 0x6}, 0x0, 0xd, 0xffffffffffffffff, 0x0)
rt_sigqueueinfo(0x0, 0x0, &(0x7f0000000000))
setsockopt$sock_timeval(r0, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10)
bind$packet(r2, &(0x7f00000000c0)={0x11, 0xfe, 0x0, 0x1, 0xfb, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}}, 0x14)
perf_event_open(&(0x7f0000000100)={0x0, 0x80, 0xff, 0x8, 0x4, 0x1, 0x0, 0x4, 0x684, 0x4, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0xdbc, 0x0, @perf_config_ext={0xd03, 0x80000000}, 0x800, 0x3, 0x3, 0x5, 0x300000000000000, 0x7, 0x7ff, 0x0, 0x0, 0x0, 0x5}, r1, 0x10, 0xffffffffffffffff, 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r3, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
openat(r3, &(0x7f0000000180)='\x00', 0x400040, 0x80)
rt_sigqueueinfo(0x0, 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f0000000240)={'ip6_vti0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x4, 0x0, 0x7f, 0x40, 0xb, @local, @mcast1, 0x88, 0x20, 0x8, 0x2}})

[ 2666.064816] syz-executor.5: attempt to access beyond end of device
[ 2666.064816] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2666.064844] Buffer I/O error on dev loop5, logical block 10, lost async page write
[ 2666.124817] loop3: detected capacity change from 0 to 40
00:16:16 executing program 6:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 60)

[ 2666.208020] loop6: detected capacity change from 0 to 40
[ 2666.279104] syz-executor.6: attempt to access beyond end of device
[ 2666.279104] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2666.280250] Buffer I/O error on dev loop6, logical block 10, lost async page write
00:16:33 executing program 6:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 61)

00:16:33 executing program 7:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684fd2981c8409820000080000000000000000"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x1012}], 0x1, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:16:33 executing program 5:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 62)

00:16:33 executing program 2:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684f"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x100d}], 0x1, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x0)

00:16:33 executing program 0:
perf_event_open(&(0x7f0000000080)={0x0, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r1, &(0x7f0000000100), 0x0, 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r0, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r2, 0xff07, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0x0, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r1, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:16:33 executing program 4:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_mount_image$tmpfs(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000040)='./file1\x00', 0x80, 0x5, &(0x7f0000000580)=[{&(0x7f0000000600)="af2a3cbc10c99fa9f38c195d3da03cda6bba07113f0f9f29ce3eb71cfeed12d824c22a99a7d957914474e6ec86c489bbaaa29d29417c5ff1e861b5949468fffcc5a95137851fa214666c00e98ea00714ed57b4cdf8166364620100000061118fe5ace0bbf4c3bfff1802de053071", 0x6e, 0x9}, {&(0x7f0000000240)="472e1d9cc2a2d59145656a5ea05092bba8aef1e230302137efcc63e5bad1f42db13a2cfb9f2dfc2d92e4a8a7a94b9ba74b82e9054def7dbaf540ce2e4bd7d1fc5bb0423f448e0a9d723b3362327fa6e3aadc63188f2c95b35f7e7fbd8595e5a464303d6dce8f7ca5f534db5ef77ed56c2874cd1b899215b947a9e7fc39617e69dcd9da67d3a785796ec53c8831a6c096f4665f579c1b8f3cc32aac078893d3ef0f0c4ee423fe4cd224af2bf2cb29813ae21465ed8310b817640784a01c207d40e9fcab67b057d1e2677a1ae42392be3a5385e9f48f2a405b2fdaf740fec9f0a0", 0xe0, 0x40}, {&(0x7f0000000340)="62d236e141a34116da403a7214214e3f3d3c5224149689b6b32a8854c56ccbd2f557c475f7b9094bfef70aaf233e1bb492a770e6193464bc6acedd2096952f6013571da73f43005a298bf1ca85f50c793acef3050b95f21ea89655d01fdb967f389193c93d677185c13f2e49cf27a195d60c4ccdbd54db117038be1b09ff7d862af53ea2ee2a4d834238d5dc81dc2647ef645c04d20b61c8e2b250e6690b1aba0e1e8fd7ceb3e5b1086b0833a09aef701712", 0xffffffffffffffbe, 0x845}, {&(0x7f0000000400)="1e54fd1d3bf3378cd3e54820472e01d29d66509c9b738f4c2c4f979f24781b7e307b30ef210d28d84ae2810d988dee5fda194b83beb962b85febf71df58128144e4cfdea9e8a217dbbdaba3fafde6dc9200128438dce8c3df381b3e13fa97ff28f130f601862ff", 0x67, 0x4}, {&(0x7f0000000480)="9e6e414b30548e9ffa619e3835683de758bf43b8a71bb15850c21e9f5407d1d03add092436377501afd274375a64bf8b7ba7b6e5571d091f7ad3c10059b11ec19933d6504cdab679f031421eafa0a35d02d11e606c066634ad9c6078fd8a025369ee3c40ee49e910af0f971bdb88b03ed703d8af6e0bef970ea79f7a57e4b2e8ff406324015b883c6a67a9ca0e96f347b0963e3d0d2ba47a45aadda2f57885ad25fafdd2b37c9cf878cd717849785db4fd914e425c8478fa6a0e2298bf0b6d4002ad94e9c3d9d61d468956b3bf5be7006096e5538711bf47ea0979f5e05e7c4d1e43a38a102897a612b551aae9c78d94016b16f225d86e", 0xf7, 0x44}], 0x20a2010, &(0x7f0000000680)={[{@shortname_winnt}, {@shortname_mixed}], [{@appraise_type}, {@euid_lt={'euid<', 0xee00}}, {@pcr={'pcr', 0x3d, 0x12}}]})
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef)

00:16:33 executing program 3:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
r1 = openat$sr(0xffffffffffffff9c, &(0x7f0000000000), 0x4040c0, 0x0)
ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000040)={{0x1, 0x1, 0x18, <r2=>r0}, './file1\x00'})
r3 = syz_mount_image$ext4(&(0x7f00000000c0)='ext2\x00', &(0x7f0000000180)='./file0\x00', 0x0, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000240)="64a6263f7e3038bd761c1b69bd137a1bd914b5cd21c05549e403ff1d796747101d6a499c691e4b555704e6e2dec62c10cc551d914fb496adf73fe1a2049994d57da41060bcb4d488f1fdf6df525cb0", 0x4f, 0xab48}], 0xa100c8, &(0x7f00000002c0)={[{@oldalloc}, {@mblk_io_submit}, {@grpjquota}], [{@fscontext={'fscontext', 0x3d, 'system_u'}}, {@appraise_type}]})
io_uring_register$IORING_REGISTER_FILES_UPDATE(r1, 0x6, &(0x7f0000000380)={0x1, 0x0, &(0x7f0000000340)=[r2, r0, 0xffffffffffffffff, r3, r0]}, 0x5)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r4, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)

00:16:33 executing program 1:
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}}, 0x0, 0x6, 0xffffffffffffffff, 0xb)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
r1 = gettid()
rt_sigqueueinfo(0x0, 0x0, 0x0)
r2 = pidfd_getfd(0xffffffffffffffff, r0, 0x0)
perf_event_open(&(0x7f0000000040)={0x5, 0x80, 0x40, 0x71, 0x2, 0x0, 0x0, 0x8000, 0x20, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, @perf_config_ext={0xff}, 0x0, 0x9b5, 0xfa, 0xd, 0x0, 0x8000, 0x55, 0x0, 0x0, 0x0, 0x3ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000400)={0x2, 0x80, 0x2a, 0x81, 0xe0, 0x40, 0x0, 0x63c5ef1c, 0x80, 0x3, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x7, 0x2, @perf_config_ext={0xf2, 0x6}, 0x0, 0x5, 0xfffffff8, 0x0, 0x1, 0x0, 0x1b6, 0x0, 0x6}, 0x0, 0xd, 0xffffffffffffffff, 0x0)
rt_sigqueueinfo(0x0, 0x0, &(0x7f0000000000))
setsockopt$sock_timeval(r0, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10)
bind$packet(r2, &(0x7f00000000c0)={0x11, 0xfe, 0x0, 0x1, 0xfb, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}}, 0x14)
perf_event_open(&(0x7f0000000100)={0x0, 0x80, 0xff, 0x8, 0x4, 0x1, 0x0, 0x4, 0x684, 0x4, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0xdbc, 0x0, @perf_config_ext={0xd03, 0x80000000}, 0x800, 0x3, 0x3, 0x5, 0x300000000000000, 0x7, 0x7ff, 0x0, 0x0, 0x0, 0x5}, r1, 0x10, 0xffffffffffffffff, 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r3, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
openat(r3, &(0x7f0000000180)='\x00', 0x400040, 0x80)
rt_sigqueueinfo(0x0, 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f0000000240)={'ip6_vti0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x4, 0x0, 0x7f, 0x40, 0xb, @local, @mcast1, 0x88, 0x20, 0x8, 0x2}})

[ 2682.563087] loop3: detected capacity change from 0 to 40
[ 2682.600162] loop6: detected capacity change from 0 to 40
[ 2682.605909] loop5: detected capacity change from 0 to 40
[ 2682.607959] loop4: detected capacity change from 0 to 40
00:16:33 executing program 3:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
r1 = openat$sr(0xffffffffffffff9c, &(0x7f0000000000), 0x4040c0, 0x0)
ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000040)={{0x1, 0x1, 0x18, <r2=>r0}, './file1\x00'})
r3 = syz_mount_image$ext4(&(0x7f00000000c0)='ext2\x00', &(0x7f0000000180)='./file0\x00', 0x0, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000240)="64a6263f7e3038bd761c1b69bd137a1bd914b5cd21c05549e403ff1d796747101d6a499c691e4b555704e6e2dec62c10cc551d914fb496adf73fe1a2049994d57da41060bcb4d488f1fdf6df525cb0", 0x4f, 0xab48}], 0xa100c8, &(0x7f00000002c0)={[{@oldalloc}, {@mblk_io_submit}, {@grpjquota}], [{@fscontext={'fscontext', 0x3d, 'system_u'}}, {@appraise_type}]})
io_uring_register$IORING_REGISTER_FILES_UPDATE(r1, 0x6, &(0x7f0000000380)={0x1, 0x0, &(0x7f0000000340)=[r2, r0, 0xffffffffffffffff, r3, r0]}, 0x5)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r4, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)

[ 2682.701688] loop3: detected capacity change from 0 to 40
[ 2682.747697] syz-executor.5: attempt to access beyond end of device
[ 2682.747697] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2682.750054] Buffer I/O error on dev loop5, logical block 10, lost async page write
00:16:33 executing program 2:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684f"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x100d}], 0x1, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x0)

[ 2682.778564] syz-executor.6: attempt to access beyond end of device
[ 2682.778564] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2682.780626] Buffer I/O error on dev loop6, logical block 10, lost async page write
00:16:33 executing program 0:
perf_event_open(&(0x7f0000000080)={0x0, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r1, &(0x7f0000000100), 0x0, 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r0, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r2, 0xff0f, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0x0, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r1, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:16:33 executing program 5:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 63)

00:16:33 executing program 1:
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}}, 0x0, 0x6, 0xffffffffffffffff, 0xb)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
r1 = gettid()
rt_sigqueueinfo(0x0, 0x0, 0x0)
r2 = pidfd_getfd(0xffffffffffffffff, r0, 0x0)
perf_event_open(&(0x7f0000000040)={0x5, 0x80, 0x40, 0x71, 0x2, 0x0, 0x0, 0x8000, 0x20, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, @perf_config_ext={0xff}, 0x0, 0x9b5, 0xfa, 0xd, 0x0, 0x8000, 0x55, 0x0, 0x0, 0x0, 0x3ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000400)={0x2, 0x80, 0x2a, 0x81, 0xe0, 0x40, 0x0, 0x63c5ef1c, 0x80, 0x3, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x7, 0x2, @perf_config_ext={0xf2, 0x6}, 0x0, 0x5, 0xfffffff8, 0x0, 0x1, 0x0, 0x1b6, 0x0, 0x6}, 0x0, 0xd, 0xffffffffffffffff, 0x0)
rt_sigqueueinfo(0x0, 0x0, &(0x7f0000000000))
setsockopt$sock_timeval(r0, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10)
bind$packet(r2, &(0x7f00000000c0)={0x11, 0xfe, 0x0, 0x1, 0xfb, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}}, 0x14)
perf_event_open(&(0x7f0000000100)={0x0, 0x80, 0xff, 0x8, 0x4, 0x1, 0x0, 0x4, 0x684, 0x4, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0xdbc, 0x0, @perf_config_ext={0xd03, 0x80000000}, 0x800, 0x3, 0x3, 0x5, 0x300000000000000, 0x7, 0x7ff, 0x0, 0x0, 0x0, 0x5}, r1, 0x10, 0xffffffffffffffff, 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r3, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
openat(r3, &(0x7f0000000180)='\x00', 0x400040, 0x80)
rt_sigqueueinfo(0x0, 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f0000000240)={'ip6_vti0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x4, 0x0, 0x7f, 0x40, 0xb, @local, @mcast1, 0x88, 0x20, 0x8, 0x2}})

00:16:33 executing program 3:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
r1 = openat$sr(0xffffffffffffff9c, &(0x7f0000000000), 0x4040c0, 0x0)
ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000040)={{0x1, 0x1, 0x18, <r2=>r0}, './file1\x00'})
r3 = syz_mount_image$ext4(&(0x7f00000000c0)='ext2\x00', &(0x7f0000000180)='./file0\x00', 0x0, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000240)="64a6263f7e3038bd761c1b69bd137a1bd914b5cd21c05549e403ff1d796747101d6a499c691e4b555704e6e2dec62c10cc551d914fb496adf73fe1a2049994d57da41060bcb4d488f1fdf6df525cb0", 0x4f, 0xab48}], 0xa100c8, &(0x7f00000002c0)={[{@oldalloc}, {@mblk_io_submit}, {@grpjquota}], [{@fscontext={'fscontext', 0x3d, 'system_u'}}, {@appraise_type}]})
io_uring_register$IORING_REGISTER_FILES_UPDATE(r1, 0x6, &(0x7f0000000380)={0x1, 0x0, &(0x7f0000000340)=[r2, r0, 0xffffffffffffffff, r3, r0]}, 0x5)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r4, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)

[ 2682.879285] syz-executor.4: attempt to access beyond end of device
[ 2682.879285] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2682.880267] Buffer I/O error on dev loop4, logical block 10, lost async page write
00:16:33 executing program 6:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 62)

[ 2682.941867] loop3: detected capacity change from 0 to 40
[ 2682.942821] loop5: detected capacity change from 0 to 40
[ 2682.997737] syz-executor.5: attempt to access beyond end of device
[ 2682.997737] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2682.998621] Buffer I/O error on dev loop5, logical block 10, lost async page write
[ 2683.000841] loop6: detected capacity change from 0 to 40
00:16:33 executing program 3:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
openat$sr(0xffffffffffffff9c, &(0x7f0000000000), 0x4040c0, 0x0)
ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000040)={{0x1, 0x1, 0x18, r0}, './file1\x00'})
syz_mount_image$ext4(&(0x7f00000000c0)='ext2\x00', &(0x7f0000000180)='./file0\x00', 0x0, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000240)="64a6263f7e3038bd761c1b69bd137a1bd914b5cd21c05549e403ff1d796747101d6a499c691e4b555704e6e2dec62c10cc551d914fb496adf73fe1a2049994d57da41060bcb4d488f1fdf6df525cb0", 0x4f, 0xab48}], 0xa100c8, &(0x7f00000002c0)={[{@oldalloc}, {@mblk_io_submit}, {@grpjquota}], [{@fscontext={'fscontext', 0x3d, 'system_u'}}, {@appraise_type}]})
chdir(&(0x7f0000000140)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r1, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)

00:16:33 executing program 1:
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}}, 0x0, 0x6, 0xffffffffffffffff, 0xb)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
r1 = gettid()
rt_sigqueueinfo(0x0, 0x0, 0x0)
r2 = pidfd_getfd(0xffffffffffffffff, r0, 0x0)
perf_event_open(&(0x7f0000000040)={0x5, 0x80, 0x40, 0x71, 0x2, 0x0, 0x0, 0x8000, 0x20, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, @perf_config_ext={0xff}, 0x0, 0x9b5, 0xfa, 0xd, 0x0, 0x8000, 0x55, 0x0, 0x0, 0x0, 0x3ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000400)={0x2, 0x80, 0x2a, 0x81, 0xe0, 0x40, 0x0, 0x63c5ef1c, 0x80, 0x3, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x7, 0x2, @perf_config_ext={0xf2, 0x6}, 0x0, 0x5, 0xfffffff8, 0x0, 0x1, 0x0, 0x1b6, 0x0, 0x6}, 0x0, 0xd, 0xffffffffffffffff, 0x0)
rt_sigqueueinfo(0x0, 0x0, &(0x7f0000000000))
setsockopt$sock_timeval(r0, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10)
bind$packet(r2, &(0x7f00000000c0)={0x11, 0xfe, 0x0, 0x1, 0xfb, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}}, 0x14)
perf_event_open(&(0x7f0000000100)={0x0, 0x80, 0xff, 0x8, 0x4, 0x1, 0x0, 0x4, 0x684, 0x4, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, @perf_config_ext={0xd03, 0x80000000}, 0x800, 0x3, 0x3, 0x5, 0x300000000000000, 0x7, 0x7ff, 0x0, 0x0, 0x0, 0x5}, r1, 0x10, 0xffffffffffffffff, 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r3, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
openat(r3, &(0x7f0000000180)='\x00', 0x400040, 0x80)
rt_sigqueueinfo(0x0, 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f0000000240)={'ip6_vti0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x4, 0x0, 0x7f, 0x40, 0xb, @local, @mcast1, 0x88, 0x20, 0x8, 0x2}})

00:16:33 executing program 7:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684fd2981c8409820000080000000000000000"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x7ffff000}], 0x1, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

[ 2683.075928] syz-executor.6: attempt to access beyond end of device
[ 2683.075928] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2683.076820] Buffer I/O error on dev loop6, logical block 10, lost async page write
00:16:33 executing program 5:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 64)

00:16:33 executing program 6:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 63)

[ 2683.176579] loop5: detected capacity change from 0 to 40
[ 2683.241785] syz-executor.5: attempt to access beyond end of device
[ 2683.241785] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2683.242749] Buffer I/O error on dev loop5, logical block 10, lost async page write
[ 2683.271889] loop6: detected capacity change from 0 to 40
[ 2683.350878] syz-executor.6: attempt to access beyond end of device
[ 2683.350878] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2683.352775] Buffer I/O error on dev loop6, logical block 10, lost async page write
[ 2683.467960] syz-executor.4: attempt to access beyond end of device
[ 2683.467960] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2683.469081] Buffer I/O error on dev loop4, logical block 10, lost async page write
00:16:52 executing program 0:
perf_event_open(&(0x7f0000000080)={0x0, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r1, &(0x7f0000000100), 0x0, 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r0, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r2, 0xff17, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0x0, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r1, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:16:52 executing program 4:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_mount_image$tmpfs(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
ioctl$EXT4_IOC_SWAP_BOOT(r2, 0x6611)
r3 = openat$loop_ctrl(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$LOOP_CTL_REMOVE(r3, 0x4c81, 0x0)
r4 = perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000500)=ANY=[@ANYBLOB="010000000100000018000000", @ANYRES32=<r5=>r4, @ANYBLOB="00000000000000002ed9aeaff9b7f1164083cb1f9bed3f8f5e3000000000c100"])
ioctl$AUTOFS_DEV_IOCTL_READY(r5, 0xc0189376, &(0x7f0000000040)={{0x1, 0x1, 0x18, r3, {0x4f95}}, './file0\x00'})
ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r2, 0xc0189372, &(0x7f0000000000)={{0x1, 0x1, 0x18, r3, {0x6a}}, './file0\x00'})

00:16:52 executing program 2:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
openat$sr(0xffffffffffffff9c, &(0x7f0000000000), 0x4040c0, 0x0)
ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000040)={{0x1, 0x1, 0x18, r0}, './file1\x00'})
syz_mount_image$ext4(&(0x7f00000000c0)='ext2\x00', &(0x7f0000000180)='./file0\x00', 0x0, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000240)="64a6263f7e3038bd761c1b69bd137a1bd914b5cd21c05549e403ff1d796747101d6a499c691e4b555704e6e2dec62c10cc551d914fb496adf73fe1a2049994d57da41060bcb4d488f1fdf6df525cb0", 0x4f, 0xab48}], 0xa100c8, &(0x7f00000002c0)={[{@oldalloc}, {@mblk_io_submit}, {@grpjquota}], [{@fscontext={'fscontext', 0x3d, 'system_u'}}, {@appraise_type}]})
chdir(&(0x7f0000000140)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r1, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)

00:16:52 executing program 5:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 65)

00:16:52 executing program 3:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
openat$sr(0xffffffffffffff9c, &(0x7f0000000000), 0x4040c0, 0x0)
ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000040)={{0x1, 0x1, 0x18, r0}, './file1\x00'})
syz_mount_image$ext4(&(0x7f00000000c0)='ext2\x00', &(0x7f0000000180)='./file0\x00', 0x0, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000240)="64a6263f7e3038bd761c1b69bd137a1bd914b5cd21c05549e403ff1d796747101d6a499c691e4b555704e6e2dec62c10cc551d914fb496adf73fe1a2049994d57da41060bcb4d488f1fdf6df525cb0", 0x4f, 0xab48}], 0xa100c8, &(0x7f00000002c0)={[{@oldalloc}, {@mblk_io_submit}, {@grpjquota}], [{@fscontext={'fscontext', 0x3d, 'system_u'}}, {@appraise_type}]})
chdir(&(0x7f0000000140)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r1, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)

00:16:52 executing program 1:
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}}, 0x0, 0x6, 0xffffffffffffffff, 0xb)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
r1 = gettid()
rt_sigqueueinfo(0x0, 0x0, 0x0)
r2 = pidfd_getfd(0xffffffffffffffff, r0, 0x0)
perf_event_open(&(0x7f0000000040)={0x5, 0x80, 0x40, 0x71, 0x2, 0x0, 0x0, 0x8000, 0x20, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, @perf_config_ext={0xff}, 0x0, 0x9b5, 0xfa, 0xd, 0x0, 0x8000, 0x55, 0x0, 0x0, 0x0, 0x3ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000400)={0x2, 0x80, 0x2a, 0x81, 0xe0, 0x40, 0x0, 0x63c5ef1c, 0x80, 0x3, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x7, 0x2, @perf_config_ext={0xf2, 0x6}, 0x0, 0x5, 0xfffffff8, 0x0, 0x1, 0x0, 0x1b6, 0x0, 0x6}, 0x0, 0xd, 0xffffffffffffffff, 0x0)
rt_sigqueueinfo(0x0, 0x0, &(0x7f0000000000))
setsockopt$sock_timeval(r0, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10)
bind$packet(r2, &(0x7f00000000c0)={0x11, 0xfe, 0x0, 0x1, 0xfb, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}}, 0x14)
perf_event_open(&(0x7f0000000100)={0x0, 0x80, 0xff, 0x8, 0x4, 0x1, 0x0, 0x4, 0x684, 0x4, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, @perf_config_ext={0xd03, 0x80000000}, 0x800, 0x3, 0x3, 0x5, 0x300000000000000, 0x7, 0x7ff, 0x0, 0x0, 0x0, 0x5}, r1, 0x10, 0xffffffffffffffff, 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r3, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
openat(r3, &(0x7f0000000180)='\x00', 0x400040, 0x80)
rt_sigqueueinfo(0x0, 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f0000000240)={'ip6_vti0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x4, 0x0, 0x7f, 0x40, 0xb, @local, @mcast1, 0x88, 0x20, 0x8, 0x2}})

00:16:52 executing program 6:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 64)

00:16:52 executing program 7:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684fd2981c8409820000080000000000000000"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x7ffffffff000}], 0x1, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

[ 2701.521601] loop2: detected capacity change from 0 to 40
[ 2701.543207] loop6: detected capacity change from 0 to 40
[ 2701.566437] loop3: detected capacity change from 0 to 40
[ 2701.596263] loop5: detected capacity change from 0 to 40
00:16:52 executing program 1:
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}}, 0x0, 0x6, 0xffffffffffffffff, 0xb)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
r1 = gettid()
rt_sigqueueinfo(0x0, 0x0, 0x0)
r2 = pidfd_getfd(0xffffffffffffffff, r0, 0x0)
perf_event_open(&(0x7f0000000040)={0x5, 0x80, 0x40, 0x71, 0x2, 0x0, 0x0, 0x8000, 0x20, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, @perf_config_ext={0xff}, 0x0, 0x9b5, 0xfa, 0xd, 0x0, 0x8000, 0x55, 0x0, 0x0, 0x0, 0x3ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000400)={0x2, 0x80, 0x2a, 0x81, 0xe0, 0x40, 0x0, 0x63c5ef1c, 0x80, 0x3, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x7, 0x2, @perf_config_ext={0xf2, 0x6}, 0x0, 0x5, 0xfffffff8, 0x0, 0x1, 0x0, 0x1b6, 0x0, 0x6}, 0x0, 0xd, 0xffffffffffffffff, 0x0)
rt_sigqueueinfo(0x0, 0x0, &(0x7f0000000000))
setsockopt$sock_timeval(r0, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10)
bind$packet(r2, &(0x7f00000000c0)={0x11, 0xfe, 0x0, 0x1, 0xfb, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}}, 0x14)
perf_event_open(&(0x7f0000000100)={0x0, 0x80, 0xff, 0x8, 0x4, 0x1, 0x0, 0x4, 0x684, 0x4, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, @perf_config_ext={0xd03, 0x80000000}, 0x800, 0x3, 0x3, 0x5, 0x300000000000000, 0x7, 0x7ff, 0x0, 0x0, 0x0, 0x5}, r1, 0x10, 0xffffffffffffffff, 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r3, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
openat(r3, &(0x7f0000000180)='\x00', 0x400040, 0x80)
rt_sigqueueinfo(0x0, 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f0000000240)={'ip6_vti0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x4, 0x0, 0x7f, 0x40, 0xb, @local, @mcast1, 0x88, 0x20, 0x8, 0x2}})

[ 2701.616904] loop4: detected capacity change from 0 to 40
00:16:52 executing program 2:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_mount_image$tmpfs(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000040)='./file1\x00', 0x80, 0x5, &(0x7f0000000580)=[{&(0x7f0000000600)="af2a3cbc10c99fa9f38c195d3da03cda6bba07113f0f9f29ce3eb71cfeed12d824c22a99a7d957914474e6ec86c489bbaaa29d29417c5ff1e861b5949468fffcc5a95137851fa214666c00e98ea00714ed57b4cdf8166364620100000061118fe5ace0bbf4c3bfff1802de053071", 0x6e, 0x9}, {&(0x7f0000000240)="472e1d9cc2a2d59145656a5ea05092bba8aef1e230302137efcc63e5bad1f42db13a2cfb9f2dfc2d92e4a8a7a94b9ba74b82e9054def7dbaf540ce2e4bd7d1fc5bb0423f448e0a9d723b3362327fa6e3aadc63188f2c95b35f7e7fbd8595e5a464303d6dce8f7ca5f534db5ef77ed56c2874cd1b899215b947a9e7fc39617e69dcd9da67d3a785796ec53c8831a6c096f4665f579c1b8f3cc32aac078893d3ef0f0c4ee423fe4cd224af2bf2cb29813ae21465ed8310b817640784a01c207d40e9fcab67b057d1e2677a1ae42392be3a5385e9f48f2a405b2fdaf740fec9f0a0", 0xe0, 0x40}, {&(0x7f0000000340)="62d236e141a34116da403a7214214e3f3d3c5224149689b6b32a8854c56ccbd2f557c475f7b9094bfef70aaf233e1bb492a770e6193464bc6acedd2096952f6013571da73f43005a298bf1ca85f50c793acef3050b95f21ea89655d01fdb967f389193c93d677185c13f2e49cf27a195d60c4ccdbd54db117038be1b09ff7d862af53ea2ee2a4d834238d5dc81dc2647ef645c04d20b61c8e2b250e6690b1aba0e1e8fd7ceb3e5b1086b0833a09aef701712", 0xffffffffffffffbe, 0x845}, {&(0x7f0000000400)="1e54fd1d3bf3378cd3e54820472e01d29d66509c9b738f4c2c4f979f24781b7e307b30ef210d28d84ae2810d988dee5fda194b83beb962b85febf71df58128144e4cfdea9e8a217dbbdaba3fafde6dc9200128438dce8c3df381b3e13fa97ff28f130f601862ff", 0x67, 0x4}, {&(0x7f0000000480)="9e6e414b30548e9ffa619e3835683de758bf43b8a71bb15850c21e9f5407d1d03add092436377501afd274375a64bf8b7ba7b6e5571d091f7ad3c10059b11ec19933d6504cdab679f031421eafa0a35d02d11e606c066634ad9c6078fd8a025369ee3c40ee49e910af0f971bdb88b03ed703d8af6e0bef970ea79f7a57e4b2e8ff406324015b883c6a67a9ca0e96f347b0963e3d0d2ba47a45aadda2f57885ad25fafdd2b37c9cf878cd717849785db4fd914e425c8478fa6a0e2298bf0b6d4002ad94e9c3d9d61d468956b3bf5be7006096e5538711bf47ea0979f5e05e7c4d1e43a38a102897a612b551aae9c78d94016b16f225d86e", 0xf7, 0x44}], 0x20a2010, &(0x7f0000000680)={[{@shortname_winnt}, {@shortname_mixed}], [{@appraise_type}, {@euid_lt={'euid<', 0xee00}}, {@pcr={'pcr', 0x3d, 0x12}}]})
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef)

[ 2701.664730] syz-executor.5: attempt to access beyond end of device
[ 2701.664730] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2701.665736] Buffer I/O error on dev loop5, logical block 10, lost async page write
00:16:52 executing program 7:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684fd2981c8409820000080000000000000000"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x100d}], 0x2, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:16:52 executing program 3:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
openat$sr(0xffffffffffffff9c, &(0x7f0000000000), 0x4040c0, 0x0)
ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000040)={{0x1, 0x1, 0x18, r0}, './file1\x00'})
chdir(&(0x7f0000000140)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r1, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)

[ 2701.692762] syz-executor.6: attempt to access beyond end of device
[ 2701.692762] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2701.694556] Buffer I/O error on dev loop6, logical block 10, lost async page write
[ 2701.706778] loop2: detected capacity change from 0 to 40
00:16:52 executing program 5:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 66)

[ 2701.784314] syz-executor.4: attempt to access beyond end of device
[ 2701.784314] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2701.786206] Buffer I/O error on dev loop4, logical block 10, lost async page write
00:16:52 executing program 1:
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}}, 0x0, 0x6, 0xffffffffffffffff, 0xb)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
r1 = gettid()
rt_sigqueueinfo(0x0, 0x0, 0x0)
r2 = pidfd_getfd(0xffffffffffffffff, r0, 0x0)
perf_event_open(&(0x7f0000000040)={0x5, 0x80, 0x40, 0x71, 0x2, 0x0, 0x0, 0x8000, 0x20, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, @perf_config_ext={0xff}, 0x0, 0x9b5, 0xfa, 0xd, 0x0, 0x8000, 0x55, 0x0, 0x0, 0x0, 0x3ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000400)={0x2, 0x80, 0x2a, 0x81, 0xe0, 0x40, 0x0, 0x63c5ef1c, 0x80, 0x3, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x7, 0x2, @perf_config_ext={0xf2, 0x6}, 0x0, 0x5, 0xfffffff8, 0x0, 0x1, 0x0, 0x1b6, 0x0, 0x6}, 0x0, 0xd, 0xffffffffffffffff, 0x0)
rt_sigqueueinfo(0x0, 0x0, &(0x7f0000000000))
setsockopt$sock_timeval(r0, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10)
bind$packet(r2, &(0x7f00000000c0)={0x11, 0xfe, 0x0, 0x1, 0xfb, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}}, 0x14)
perf_event_open(&(0x7f0000000100)={0x0, 0x80, 0xff, 0x8, 0x4, 0x1, 0x0, 0x4, 0x684, 0x4, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0xdbc, 0x0, @perf_config_ext={0x0, 0x80000000}, 0x800, 0x3, 0x3, 0x5, 0x300000000000000, 0x7, 0x7ff, 0x0, 0x0, 0x0, 0x5}, r1, 0x10, 0xffffffffffffffff, 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r3, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
openat(r3, &(0x7f0000000180)='\x00', 0x400040, 0x80)
rt_sigqueueinfo(0x0, 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f0000000240)={'ip6_vti0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x4, 0x0, 0x7f, 0x40, 0xb, @local, @mcast1, 0x88, 0x20, 0x8, 0x2}})

[ 2701.839857] syz-executor.4: attempt to access beyond end of device
[ 2701.839857] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2701.841278] loop5: detected capacity change from 0 to 40
[ 2701.841945] Buffer I/O error on dev loop4, logical block 10, lost async page write
[ 2701.870816] loop3: detected capacity change from 0 to 40
[ 2701.941391] syz-executor.5: attempt to access beyond end of device
[ 2701.941391] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2701.943189] Buffer I/O error on dev loop5, logical block 10, lost async page write
[ 2701.969302] syz-executor.2: attempt to access beyond end of device
[ 2701.969302] loop2: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2701.971050] Buffer I/O error on dev loop2, logical block 10, lost async page write
00:17:09 executing program 6:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 65)

00:17:09 executing program 5:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 67)

00:17:09 executing program 2:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_mount_image$tmpfs(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
ioctl$EXT4_IOC_SWAP_BOOT(r2, 0x6611)
r3 = openat$loop_ctrl(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$LOOP_CTL_REMOVE(r3, 0x4c81, 0x0)
r4 = perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000500)=ANY=[@ANYBLOB="010000000100000018000000", @ANYRES32=<r5=>r4, @ANYBLOB="00000000000000002ed9aeaff9b7f1164083cb1f9bed3f8f5e3000000000c100"])
ioctl$AUTOFS_DEV_IOCTL_READY(r5, 0xc0189376, &(0x7f0000000040)={{0x1, 0x1, 0x18, r3, {0x4f95}}, './file0\x00'})
ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r2, 0xc0189372, &(0x7f0000000000)={{0x1, 0x1, 0x18, r3, {0x6a}}, './file0\x00'})

00:17:09 executing program 1:
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}}, 0x0, 0x6, 0xffffffffffffffff, 0xb)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
r1 = gettid()
rt_sigqueueinfo(0x0, 0x0, 0x0)
r2 = pidfd_getfd(0xffffffffffffffff, r0, 0x0)
perf_event_open(&(0x7f0000000040)={0x5, 0x80, 0x40, 0x71, 0x2, 0x0, 0x0, 0x8000, 0x20, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, @perf_config_ext={0xff}, 0x0, 0x9b5, 0xfa, 0xd, 0x0, 0x8000, 0x55, 0x0, 0x0, 0x0, 0x3ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000400)={0x2, 0x80, 0x2a, 0x81, 0xe0, 0x40, 0x0, 0x63c5ef1c, 0x80, 0x3, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x7, 0x2, @perf_config_ext={0xf2, 0x6}, 0x0, 0x5, 0xfffffff8, 0x0, 0x1, 0x0, 0x1b6, 0x0, 0x6}, 0x0, 0xd, 0xffffffffffffffff, 0x0)
rt_sigqueueinfo(0x0, 0x0, &(0x7f0000000000))
setsockopt$sock_timeval(r0, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10)
bind$packet(r2, &(0x7f00000000c0)={0x11, 0xfe, 0x0, 0x1, 0xfb, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}}, 0x14)
perf_event_open(&(0x7f0000000100)={0x0, 0x80, 0xff, 0x8, 0x4, 0x1, 0x0, 0x4, 0x684, 0x4, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0xdbc, 0x0, @perf_config_ext={0x0, 0x80000000}, 0x800, 0x3, 0x3, 0x5, 0x300000000000000, 0x7, 0x7ff, 0x0, 0x0, 0x0, 0x5}, r1, 0x10, 0xffffffffffffffff, 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r3, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
openat(r3, &(0x7f0000000180)='\x00', 0x400040, 0x80)
rt_sigqueueinfo(0x0, 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f0000000240)={'ip6_vti0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x4, 0x0, 0x7f, 0x40, 0xb, @local, @mcast1, 0x88, 0x20, 0x8, 0x2}})

[ 2718.499748] loop2: detected capacity change from 0 to 40
00:17:09 executing program 4:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_mount_image$tmpfs(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef)
chdir(&(0x7f0000000000)='./file2\x00')

00:17:09 executing program 3:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
openat$sr(0xffffffffffffff9c, &(0x7f0000000000), 0x4040c0, 0x0)
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r0, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)

00:17:09 executing program 7:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684fd2981c8409820000080000000000000000"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x100d}], 0x3, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:17:09 executing program 0:
perf_event_open(&(0x7f0000000080)={0x0, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r1, &(0x7f0000000100), 0x0, 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r0, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r2, 0xff1f, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0x0, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r1, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

[ 2718.514030] loop6: detected capacity change from 0 to 40
[ 2718.529653] loop5: detected capacity change from 0 to 40
[ 2718.530395] syz-executor.2: attempt to access beyond end of device
[ 2718.530395] loop2: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2718.530436] Buffer I/O error on dev loop2, logical block 10, lost async page write
[ 2718.541641] loop3: detected capacity change from 0 to 40
00:17:09 executing program 1:
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}}, 0x0, 0x6, 0xffffffffffffffff, 0xb)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
r1 = gettid()
rt_sigqueueinfo(0x0, 0x0, 0x0)
r2 = pidfd_getfd(0xffffffffffffffff, r0, 0x0)
perf_event_open(&(0x7f0000000040)={0x5, 0x80, 0x40, 0x71, 0x2, 0x0, 0x0, 0x8000, 0x20, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, @perf_config_ext={0xff}, 0x0, 0x9b5, 0xfa, 0xd, 0x0, 0x8000, 0x55, 0x0, 0x0, 0x0, 0x3ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000400)={0x2, 0x80, 0x2a, 0x81, 0xe0, 0x40, 0x0, 0x63c5ef1c, 0x80, 0x3, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x7, 0x2, @perf_config_ext={0xf2, 0x6}, 0x0, 0x5, 0xfffffff8, 0x0, 0x1, 0x0, 0x1b6, 0x0, 0x6}, 0x0, 0xd, 0xffffffffffffffff, 0x0)
rt_sigqueueinfo(0x0, 0x0, &(0x7f0000000000))
setsockopt$sock_timeval(r0, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10)
bind$packet(r2, &(0x7f00000000c0)={0x11, 0xfe, 0x0, 0x1, 0xfb, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}}, 0x14)
perf_event_open(&(0x7f0000000100)={0x0, 0x80, 0xff, 0x8, 0x4, 0x1, 0x0, 0x4, 0x684, 0x4, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0xdbc, 0x0, @perf_config_ext={0x0, 0x80000000}, 0x800, 0x3, 0x3, 0x5, 0x300000000000000, 0x7, 0x7ff, 0x0, 0x0, 0x0, 0x5}, r1, 0x10, 0xffffffffffffffff, 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r3, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
openat(r3, &(0x7f0000000180)='\x00', 0x400040, 0x80)
rt_sigqueueinfo(0x0, 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f0000000240)={'ip6_vti0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x4, 0x0, 0x7f, 0x40, 0xb, @local, @mcast1, 0x88, 0x20, 0x8, 0x2}})

[ 2718.586553] loop4: detected capacity change from 0 to 40
00:17:09 executing program 2:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
openat$sr(0xffffffffffffff9c, &(0x7f0000000000), 0x4040c0, 0x0)
ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000040)={{0x1, 0x1, 0x18, r0}, './file1\x00'})
syz_mount_image$ext4(&(0x7f00000000c0)='ext2\x00', &(0x7f0000000180)='./file0\x00', 0x0, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000240)="64a6263f7e3038bd761c1b69bd137a1bd914b5cd21c05549e403ff1d796747101d6a499c691e4b555704e6e2dec62c10cc551d914fb496adf73fe1a2049994d57da41060bcb4d488f1fdf6df525cb0", 0x4f, 0xab48}], 0xa100c8, &(0x7f00000002c0)={[{@oldalloc}, {@mblk_io_submit}, {@grpjquota}], [{@fscontext={'fscontext', 0x3d, 'system_u'}}, {@appraise_type}]})
chdir(&(0x7f0000000140)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r1, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)

00:17:09 executing program 3:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r0, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)

[ 2718.669811] syz-executor.6: attempt to access beyond end of device
[ 2718.669811] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2718.671693] Buffer I/O error on dev loop6, logical block 10, lost async page write
[ 2718.684015] syz-executor.4: attempt to access beyond end of device
[ 2718.684015] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2718.684920] Buffer I/O error on dev loop4, logical block 10, lost async page write
[ 2718.692837] syz-executor.5: attempt to access beyond end of device
[ 2718.692837] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2718.694520] Buffer I/O error on dev loop5, logical block 10, lost async page write
00:17:09 executing program 0:
perf_event_open(&(0x7f0000000080)={0x0, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r1, &(0x7f0000000100), 0x0, 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r0, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r2, 0xff27, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0x0, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r1, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

[ 2718.730755] loop2: detected capacity change from 0 to 40
[ 2718.781309] loop3: detected capacity change from 0 to 40
00:17:24 executing program 0:
perf_event_open(&(0x7f0000000080)={0x0, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r1, &(0x7f0000000100), 0x0, 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r0, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r2, 0xff2f, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0x0, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r1, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:17:24 executing program 2:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x8035, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x800471, &(0x7f0000000600)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r1 = syz_mount_image$tmpfs(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
ioctl$EXT4_IOC_SWAP_BOOT(r2, 0x6611)
fsconfig$FSCONFIG_SET_PATH_EMPTY(r2, 0x4, &(0x7f0000000500)='\x1c\x00', &(0x7f0000000540)='./file0\x00', r0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/slabinfo\x00', 0x0, 0x0)
r4 = fspick(r1, &(0x7f00000000c0)='./file1\x00', 0x1)
r5 = syz_open_dev$tty1(0xc, 0x4, 0x1)
writev(r5, &(0x7f0000000000)=[{&(0x7f0000000140)="02b2dccad213e1e6cf54b7a797f8f22a47f25b7658fb110b2e76f95b0f318b8fa745e6ffba4414d29a42bfab524bc5bffb17decc4540a6f00b9772f5f9789a9525790df8d989b23530d0a1398f2ad734c7ff47961be476ffeec81efa3d3aa64b8ea329261dfc2e1047a68670f0e5950d6a5414956bddd09e101b5b66e5742fe843413e065e3b86a242b37bc58c68153a45015f6f1ea67762c302e461e0c84bbb7f8d464f5a72d9fad56dac0c5028a4012a93dbc7da640786e3c9898cdd8fe091b166bfcd66e6257abc923ceaf90e994deded3fe8a59c2105f5caf366d32170ef51299dbf441bc3cddda352a2e07375fb44e75fed8082f3e960015d9bcddb0c834feda68d113a9a9fc0d1c30153685caf43b176219b666d74e67b6192cfd8a561c6c4aadcc80ed8c469bc41b028f1db515d699e45ad3379f9b1edb8de4bb2f8615d6716297baac7e45073fcecf31e51ec78c40edd78f245bced04414f849fb961fbbe79ff2ed7c48ec1b5331f9755d7094986fc8da198ce4a12f9ddfb43e565bc4fed618da9a693d03c3e7ec4b3014dfc022103e277c1b12efb03ef8b197f3a931f6cbe238cf8a4e7639b409b4586f66da41b94eed69d52ba9fde5aa1ee774d4e626932dc3511b10ae3bc3e8688a7a83b0467dfbf92951747396735c9f47ad4552e7bdf4f8e7998a1266a360beb2ec1527390452139f9ab91ee250efcf3413e72a6b2688d8b6a4748ccc165bbf886573ccdd03bd93f32a866cd878ec246e06f31d4d7f7ec9836b7305ee0c1b9fa75cd6e4ca5cc2f107b654f15a2442cd9c8eaf581d093639fe35e0da49394c5ed66ad29bc2b863649e16c1951d0d3dd6f1048539e558ee1f059d91510a5acd84777ca01545635d2fb40e2f205bb11435023e47e4e2f85b6d1b56b688dd1a4304708a561d32dbaa6cd4f969e67af33773d4e9772751019dc6c2af7e2fe9d3c7eb6f1b401926603d90802f792b081957dd5ebd18410cd42b2ea05ae9a61254e4b878384b8a376fe9eba06afc1253f2224fab88feb7c426e3dfb19385afbb42cc13209b419568eeafdf505dc5ca30acc17d337e941e0badf9f9413f381fe9a315e2597426805827943f193f02a12554d434bd91708a28d9da1bf64ad64f80a7287d1e02d5d1f14bf9d89ba3badfa524694db6a651e97ea64104ad34942f36745259f4ec32fdce0bd13e693ccbe0e012e61a1fae9fc1662b99871e3812cea14d12646ccc08b0514762a475ecdbf9071377bb1ecd891c6fe32fde1d3044caf466b3a342b7541e8ed7432e94baf1d5546aff0e23f6a03c9ea5635519533e712639c27958e3a0f3684ed91cfb2e6e4", 0x3b8}], 0x1)
write$binfmt_aout(r4, &(0x7f0000000040)=ANY=[@ANYRESHEX=r5], 0x220)
sendfile(r3, r0, 0x0, 0xfffffdef)

00:17:24 executing program 1:
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}}, 0x0, 0x6, 0xffffffffffffffff, 0xb)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
r1 = gettid()
rt_sigqueueinfo(0x0, 0x0, 0x0)
r2 = pidfd_getfd(0xffffffffffffffff, r0, 0x0)
perf_event_open(&(0x7f0000000040)={0x5, 0x80, 0x40, 0x71, 0x2, 0x0, 0x0, 0x8000, 0x20, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, @perf_config_ext={0xff}, 0x0, 0x9b5, 0xfa, 0xd, 0x0, 0x8000, 0x55, 0x0, 0x0, 0x0, 0x3ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000400)={0x2, 0x80, 0x2a, 0x81, 0xe0, 0x40, 0x0, 0x63c5ef1c, 0x80, 0x3, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x7, 0x2, @perf_config_ext={0xf2, 0x6}, 0x0, 0x5, 0xfffffff8, 0x0, 0x1, 0x0, 0x1b6, 0x0, 0x6}, 0x0, 0xd, 0xffffffffffffffff, 0x0)
rt_sigqueueinfo(0x0, 0x0, &(0x7f0000000000))
setsockopt$sock_timeval(r0, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10)
bind$packet(r2, &(0x7f00000000c0)={0x11, 0xfe, 0x0, 0x1, 0xfb, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}}, 0x14)
perf_event_open(&(0x7f0000000100)={0x0, 0x80, 0xff, 0x8, 0x4, 0x1, 0x0, 0x4, 0x684, 0x4, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0xdbc, 0x0, @perf_config_ext={0xd03}, 0x800, 0x3, 0x3, 0x5, 0x300000000000000, 0x7, 0x7ff, 0x0, 0x0, 0x0, 0x5}, r1, 0x10, 0xffffffffffffffff, 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r3, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
openat(r3, &(0x7f0000000180)='\x00', 0x400040, 0x80)
rt_sigqueueinfo(0x0, 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f0000000240)={'ip6_vti0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x4, 0x0, 0x7f, 0x40, 0xb, @local, @mcast1, 0x88, 0x20, 0x8, 0x2}})

00:17:24 executing program 6:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 66)

00:17:24 executing program 7:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684fd2981c8409820000080000000000000000"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x100d}], 0x4, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:17:24 executing program 4:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r1, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
r2 = openat(r1, &(0x7f0000000040)='./file1\x00', 0x3a35c2, 0x17c)
syz_mount_image$tmpfs(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r3, &(0x7f0000001180)=ANY=[], 0x220)
r4 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendfile(r4, r2, 0x0, 0xfffffdef)
ioctl$AUTOFS_DEV_IOCTL_EXPIRE(r2, 0xc018937c, &(0x7f00000000c0)={{0x1, 0x1, 0x18, <r5=>r0, {0x4}}, './file0\x00'})
openat(r5, &(0x7f0000000180)='./file0\x00', 0x100, 0x52)

00:17:24 executing program 5:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 68)

00:17:24 executing program 3:
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r0, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)

[ 2734.094016] loop6: detected capacity change from 0 to 40
[ 2734.094058] loop5: detected capacity change from 0 to 40
[ 2734.109406] loop4: detected capacity change from 0 to 40
00:17:24 executing program 3:
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r0, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)

[ 2734.158888] syz-executor.5: attempt to access beyond end of device
[ 2734.158888] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2734.159991] Buffer I/O error on dev loop5, logical block 10, lost async page write
[ 2734.177914] loop2: detected capacity change from 0 to 64
00:17:24 executing program 5:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 69)

00:17:24 executing program 4:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
lsetxattr$trusted_overlay_upper(&(0x7f0000000040)='./file1\x00', &(0x7f00000000c0), &(0x7f0000000180)={0x0, 0xfb, 0x3a, 0x6, 0xad, "e1530b8db389758d552cec18e2049ab1", "3f9d2df2a380ccaacd79cde303186eef62405672e894b33a365483616c53c47bf5da10ef92"}, 0x3a, 0x2)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_mount_image$tmpfs(0x0, 0x0, 0x0, 0x0, 0x0, 0x2000, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
openat(r1, &(0x7f0000000000)='./file0\x00', 0x400400, 0x106)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef)

[ 2734.238404] syz-executor.6: attempt to access beyond end of device
[ 2734.238404] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2734.238457] Buffer I/O error on dev loop6, logical block 10, lost async page write
00:17:24 executing program 0:
perf_event_open(&(0x7f0000000080)={0x0, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r1, &(0x7f0000000100), 0x0, 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r0, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r2, 0xff37, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0x0, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r1, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

[ 2734.325772] loop4: detected capacity change from 0 to 40
[ 2734.335678] loop5: detected capacity change from 0 to 40
00:17:24 executing program 3:
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r0, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)

00:17:25 executing program 6:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 67)

00:17:25 executing program 1:
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}}, 0x0, 0x6, 0xffffffffffffffff, 0xb)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
r1 = gettid()
rt_sigqueueinfo(0x0, 0x0, 0x0)
r2 = pidfd_getfd(0xffffffffffffffff, r0, 0x0)
perf_event_open(&(0x7f0000000040)={0x5, 0x80, 0x40, 0x71, 0x2, 0x0, 0x0, 0x8000, 0x20, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, @perf_config_ext={0xff}, 0x0, 0x9b5, 0xfa, 0xd, 0x0, 0x8000, 0x55, 0x0, 0x0, 0x0, 0x3ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000400)={0x2, 0x80, 0x2a, 0x81, 0xe0, 0x40, 0x0, 0x63c5ef1c, 0x80, 0x3, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x7, 0x2, @perf_config_ext={0xf2, 0x6}, 0x0, 0x5, 0xfffffff8, 0x0, 0x1, 0x0, 0x1b6, 0x0, 0x6}, 0x0, 0xd, 0xffffffffffffffff, 0x0)
rt_sigqueueinfo(0x0, 0x0, &(0x7f0000000000))
setsockopt$sock_timeval(r0, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10)
bind$packet(r2, &(0x7f00000000c0)={0x11, 0xfe, 0x0, 0x1, 0xfb, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}}, 0x14)
perf_event_open(&(0x7f0000000100)={0x0, 0x80, 0xff, 0x8, 0x4, 0x1, 0x0, 0x4, 0x684, 0x4, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0xdbc, 0x0, @perf_config_ext={0xd03}, 0x800, 0x3, 0x3, 0x5, 0x300000000000000, 0x7, 0x7ff, 0x0, 0x0, 0x0, 0x5}, r1, 0x10, 0xffffffffffffffff, 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r3, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
openat(r3, &(0x7f0000000180)='\x00', 0x400040, 0x80)
rt_sigqueueinfo(0x0, 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f0000000240)={'ip6_vti0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x4, 0x0, 0x7f, 0x40, 0xb, @local, @mcast1, 0x88, 0x20, 0x8, 0x2}})

00:17:25 executing program 2:
perf_event_open(&(0x7f0000000080)={0x0, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r1, &(0x7f0000000100), 0x0, 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r0, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r2, 0xff2f, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0x0, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r1, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

[ 2734.434027] syz-executor.4: attempt to access beyond end of device
[ 2734.434027] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2734.435313] Buffer I/O error on dev loop4, logical block 10, lost async page write
[ 2734.451484] syz-executor.5: attempt to access beyond end of device
[ 2734.451484] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2734.452860] Buffer I/O error on dev loop5, logical block 10, lost async page write
[ 2734.515935] loop6: detected capacity change from 0 to 40
00:17:25 executing program 5:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 70)

00:17:25 executing program 4:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
getpeername$unix(0xffffffffffffffff, &(0x7f0000000000)=@abs, &(0x7f00000000c0)=0x6e)
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x303440, 0x81)
syz_mount_image$tmpfs(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef)

[ 2734.645379] syz-executor.6: attempt to access beyond end of device
[ 2734.645379] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2734.646998] Buffer I/O error on dev loop6, logical block 10, lost async page write
[ 2734.668471] loop4: detected capacity change from 0 to 40
[ 2734.696189] loop5: detected capacity change from 0 to 40
[ 2734.776026] syz-executor.5: attempt to access beyond end of device
[ 2734.776026] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2734.777441] Buffer I/O error on dev loop5, logical block 10, lost async page write
00:17:40 executing program 3:
syz_mount_image$vfat(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r0, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)

00:17:40 executing program 5:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 71)

00:17:40 executing program 7:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684fd2981c8409820000080000000000000000"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x100d}], 0x5, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:17:40 executing program 0:
perf_event_open(&(0x7f0000000080)={0x0, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r1, &(0x7f0000000100), 0x0, 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r0, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r2, 0xff3f, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0x0, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r1, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:17:40 executing program 1:
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}}, 0x0, 0x6, 0xffffffffffffffff, 0xb)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
r1 = gettid()
rt_sigqueueinfo(0x0, 0x0, 0x0)
r2 = pidfd_getfd(0xffffffffffffffff, r0, 0x0)
perf_event_open(&(0x7f0000000040)={0x5, 0x80, 0x40, 0x71, 0x2, 0x0, 0x0, 0x8000, 0x20, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, @perf_config_ext={0xff}, 0x0, 0x9b5, 0xfa, 0xd, 0x0, 0x8000, 0x55, 0x0, 0x0, 0x0, 0x3ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000400)={0x2, 0x80, 0x2a, 0x81, 0xe0, 0x40, 0x0, 0x63c5ef1c, 0x80, 0x3, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x7, 0x2, @perf_config_ext={0xf2, 0x6}, 0x0, 0x5, 0xfffffff8, 0x0, 0x1, 0x0, 0x1b6, 0x0, 0x6}, 0x0, 0xd, 0xffffffffffffffff, 0x0)
rt_sigqueueinfo(0x0, 0x0, &(0x7f0000000000))
setsockopt$sock_timeval(r0, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10)
bind$packet(r2, &(0x7f00000000c0)={0x11, 0xfe, 0x0, 0x1, 0xfb, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}}, 0x14)
perf_event_open(&(0x7f0000000100)={0x0, 0x80, 0xff, 0x8, 0x4, 0x1, 0x0, 0x4, 0x684, 0x4, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0xdbc, 0x0, @perf_config_ext={0xd03}, 0x800, 0x3, 0x3, 0x5, 0x300000000000000, 0x7, 0x7ff, 0x0, 0x0, 0x0, 0x5}, r1, 0x10, 0xffffffffffffffff, 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r3, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
openat(r3, &(0x7f0000000180)='\x00', 0x400040, 0x80)
rt_sigqueueinfo(0x0, 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f0000000240)={'ip6_vti0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x4, 0x0, 0x7f, 0x40, 0xb, @local, @mcast1, 0x88, 0x20, 0x8, 0x2}})

00:17:40 executing program 6:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 68)

00:17:40 executing program 4:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x7f}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_mount_image$tmpfs(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
r2 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0xf5863d43d91dd394, 0x0)
fchdir(r2)
sendfile(r1, r0, 0x0, 0xfffffdef)

00:17:40 executing program 2:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
r1 = openat$sr(0xffffffffffffff9c, &(0x7f0000000000), 0x4040c0, 0x0)
ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000040)={{0x1, 0x1, 0x18, <r2=>r0}, './file1\x00'})
r3 = syz_mount_image$ext4(&(0x7f00000000c0)='ext2\x00', &(0x7f0000000180)='./file0\x00', 0x0, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000240)="64a6263f7e3038bd761c1b69bd137a1bd914b5cd21c05549e403ff1d796747101d6a499c691e4b555704e6e2dec62c10cc551d914fb496adf73fe1a2049994d57da41060bcb4d488f1fdf6df525cb0", 0x4f, 0xab48}], 0xa100c8, &(0x7f00000002c0)={[{@oldalloc}, {@mblk_io_submit}, {@grpjquota}], [{@fscontext={'fscontext', 0x3d, 'system_u'}}, {@appraise_type}]})
io_uring_register$IORING_REGISTER_FILES_UPDATE(r1, 0x6, &(0x7f0000000380)={0x1, 0x0, &(0x7f0000000340)=[r2, r0, 0xffffffffffffffff, r3, r0]}, 0x5)
chdir(&(0x7f0000000140)='./file0\x00')
pwritev(0xffffffffffffffff, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)

[ 2749.440195] FAT-fs (loop4): bogus number of reserved sectors
[ 2749.440647] FAT-fs (loop4): Can't find a valid FAT filesystem
[ 2749.468471] loop3: detected capacity change from 0 to 40
[ 2749.483796] loop2: detected capacity change from 0 to 40
[ 2749.514250] loop6: detected capacity change from 0 to 40
[ 2749.526288] loop5: detected capacity change from 0 to 40
00:17:40 executing program 1:
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}}, 0x0, 0x6, 0xffffffffffffffff, 0xb)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
r1 = gettid()
rt_sigqueueinfo(0x0, 0x0, 0x0)
r2 = pidfd_getfd(0xffffffffffffffff, r0, 0x0)
perf_event_open(&(0x7f0000000040)={0x5, 0x80, 0x40, 0x71, 0x2, 0x0, 0x0, 0x8000, 0x20, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, @perf_config_ext={0xff}, 0x0, 0x9b5, 0xfa, 0xd, 0x0, 0x8000, 0x55, 0x0, 0x0, 0x0, 0x3ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000400)={0x2, 0x80, 0x2a, 0x81, 0xe0, 0x40, 0x0, 0x63c5ef1c, 0x80, 0x3, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x7, 0x2, @perf_config_ext={0xf2, 0x6}, 0x0, 0x5, 0xfffffff8, 0x0, 0x1, 0x0, 0x1b6, 0x0, 0x6}, 0x0, 0xd, 0xffffffffffffffff, 0x0)
rt_sigqueueinfo(0x0, 0x0, &(0x7f0000000000))
setsockopt$sock_timeval(r0, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10)
bind$packet(r2, &(0x7f00000000c0)={0x11, 0xfe, 0x0, 0x1, 0xfb, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}}, 0x14)
perf_event_open(&(0x7f0000000100)={0x0, 0x80, 0xff, 0x8, 0x4, 0x1, 0x0, 0x4, 0x684, 0x4, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0xdbc, 0x0, @perf_config_ext={0xd03, 0x80000000}, 0x0, 0x3, 0x3, 0x5, 0x300000000000000, 0x7, 0x7ff, 0x0, 0x0, 0x0, 0x5}, r1, 0x10, 0xffffffffffffffff, 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r3, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
openat(r3, &(0x7f0000000180)='\x00', 0x400040, 0x80)
rt_sigqueueinfo(0x0, 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f0000000240)={'ip6_vti0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x4, 0x0, 0x7f, 0x40, 0xb, @local, @mcast1, 0x88, 0x20, 0x8, 0x2}})

00:17:40 executing program 3:
syz_mount_image$vfat(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r0, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)

00:17:40 executing program 2:
syz_mount_image$vfat(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r0, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)

[ 2749.647511] syz-executor.6: attempt to access beyond end of device
[ 2749.647511] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2749.648436] Buffer I/O error on dev loop6, logical block 10, lost async page write
[ 2749.656903] syz-executor.5: attempt to access beyond end of device
[ 2749.656903] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2749.657861] Buffer I/O error on dev loop5, logical block 10, lost async page write
00:17:40 executing program 0:
perf_event_open(&(0x7f0000000080)={0x0, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r1, &(0x7f0000000100), 0x0, 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r0, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r2, 0xff47, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0x0, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r1, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:17:40 executing program 6:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 69)

00:17:40 executing program 5:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 72)

[ 2749.793770] loop2: detected capacity change from 0 to 40
[ 2749.807587] loop3: detected capacity change from 0 to 40
00:17:40 executing program 1:
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}}, 0x0, 0x6, 0xffffffffffffffff, 0xb)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
r1 = gettid()
rt_sigqueueinfo(0x0, 0x0, 0x0)
r2 = pidfd_getfd(0xffffffffffffffff, r0, 0x0)
perf_event_open(&(0x7f0000000040)={0x5, 0x80, 0x40, 0x71, 0x2, 0x0, 0x0, 0x8000, 0x20, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, @perf_config_ext={0xff}, 0x0, 0x9b5, 0xfa, 0xd, 0x0, 0x8000, 0x55, 0x0, 0x0, 0x0, 0x3ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000400)={0x2, 0x80, 0x2a, 0x81, 0xe0, 0x40, 0x0, 0x63c5ef1c, 0x80, 0x3, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x7, 0x2, @perf_config_ext={0xf2, 0x6}, 0x0, 0x5, 0xfffffff8, 0x0, 0x1, 0x0, 0x1b6, 0x0, 0x6}, 0x0, 0xd, 0xffffffffffffffff, 0x0)
rt_sigqueueinfo(0x0, 0x0, &(0x7f0000000000))
setsockopt$sock_timeval(r0, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10)
bind$packet(r2, &(0x7f00000000c0)={0x11, 0xfe, 0x0, 0x1, 0xfb, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}}, 0x14)
perf_event_open(&(0x7f0000000100)={0x0, 0x80, 0xff, 0x8, 0x4, 0x1, 0x0, 0x4, 0x684, 0x4, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0xdbc, 0x0, @perf_config_ext={0xd03, 0x80000000}, 0x0, 0x3, 0x3, 0x5, 0x300000000000000, 0x7, 0x7ff, 0x0, 0x0, 0x0, 0x5}, r1, 0x10, 0xffffffffffffffff, 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r3, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
openat(r3, &(0x7f0000000180)='\x00', 0x400040, 0x80)
rt_sigqueueinfo(0x0, 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f0000000240)={'ip6_vti0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x4, 0x0, 0x7f, 0x40, 0xb, @local, @mcast1, 0x88, 0x20, 0x8, 0x2}})

[ 2749.903164] loop6: detected capacity change from 0 to 40
[ 2749.967315] loop5: detected capacity change from 0 to 40
[ 2750.112422] syz-executor.6: attempt to access beyond end of device
[ 2750.112422] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2750.113337] Buffer I/O error on dev loop6, logical block 10, lost async page write
[ 2750.155728] syz-executor.5: attempt to access beyond end of device
[ 2750.155728] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2750.156589] Buffer I/O error on dev loop5, logical block 10, lost async page write
[ 2750.301643] FAT-fs (loop4): Unrecognized mount option "./file0" or missing value
00:17:57 executing program 3:
syz_mount_image$vfat(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r0, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)

00:17:57 executing program 4:
r0 = syz_open_dev$tty1(0xc, 0x4, 0x1)
writev(r0, &(0x7f0000000000)=[{&(0x7f0000000140)="02b2dccad213e1e6cf54b7a797f8f22a47f25b7658fb110b2e76f95b0f318b8fa745e6ffba4414d29a42bfab524bc5bffb17decc4540a6f00b9772f5f9789a9525790df8d989b23530d0a1398f2ad734c7ff47961be476ffeec81efa3d3aa64b8ea329261dfc2e1047a68670f0e5950d6a5414956bddd09e101b5b66e5742fe843413e065e3b86a242b37bc58c68153a45015f6f1ea67762c302e461e0c84bbb7f8d464f5a72d9fad56dac0c5028a4012a93dbc7da640786e3c9898cdd8fe091b166bfcd66e6257abc923ceaf90e994deded3fe8a59c2105f5caf366d32170ef51299dbf441bc3cddda352a2e07375fb44e75fed8082f3e960015d9bcddb0c834feda68d113a9a9fc0d1c30153685caf43b176219b666d74e67b6192cfd8a561c6c4aadcc80ed8c469bc41b028f1db515d699e45ad3379f9b1edb8de4bb2f8615d6716297baac7e45073fcecf31e51ec78c40edd78f245bced04414f849fb961fbbe79ff2ed7c48ec1b5331f9755d7094986fc8da198ce4a12f9ddfb43e565bc4fed618da9a693d03c3e7ec4b3014dfc022103e277c1b12efb03ef8b197f3a931f6cbe238cf8a4e7639b409b4586f66da41b94eed69d52ba9fde5aa1ee774d4e626932dc3511b10ae3bc3e8688a7a83b0467dfbf92951747396735c9f47ad4552e7bdf4f8e7998a1266a360beb2ec1527390452139f9ab91ee250efcf3413e72a6b2688d8b6a4748ccc165bbf886573ccdd03bd93f32a866cd878ec246e06f31d4d7f7ec9836b7305ee0c1b9fa75cd6e4ca5cc2f107b654f15a2442cd9c8eaf581d093639fe35e0da49394c5ed66ad29bc2b863649e16c1951d0d3dd6f1048539e558ee1f059d91510a5acd84777ca01545635d2fb40e2f205bb11435023e47e4e2f85b6d1b56b688dd1a4304708a561d32dbaa6cd4f969e67af33773d4e9772751019dc6c2af7e2fe9d3c7eb6f1b401926603d90802f792b081957dd5ebd18410cd42b2ea05ae9a61254e4b878384b8a376fe9eba06afc1253f2224fab88feb7c426e3dfb19385afbb42cc13209b419568eeafdf505dc5ca30acc17d337e941e0badf9f9413f381fe9a315e2597426805827943f193f02a12554d434bd91708a28d9da1bf64ad64f80a7287d1e02d5d1f14bf9d89ba3badfa524694db6a651e97ea64104ad34942f36745259f4ec32fdce0bd13e693ccbe0e012e61a1fae9fc1662b99871e3812cea14d12646ccc08b0514762a475ecdbf9071377bb1ecd891c6fe32fde1d3044caf466b3a342b7541e8ed7432e94baf1d5546aff0e23f6a03c9ea5635519533e712639c27958e3a0f3684ed91cfb2e6e4", 0x3b8}], 0x1)
r1 = perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000500)=ANY=[@ANYBLOB="010000000100000018000000", @ANYRES32=r1, @ANYBLOB="00000000000000002ed9aeaff9b7f1164083cb1f9bed3f8f090000000000c100"])
r2 = openat$loop_ctrl(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$LOOP_CTL_REMOVE(r2, 0x4c81, 0x0)
r3 = perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000500)=ANY=[@ANYBLOB="010000000100000018000000", @ANYRES32=<r4=>r3, @ANYBLOB="00000000000000002ed9aeaff9b7f1164083cb1f9bed3f8f5e3000000000c100"])
ioctl$AUTOFS_DEV_IOCTL_READY(r4, 0xc0189376, &(0x7f0000000040)={{0x1, 0x1, 0x18, r2, {0x4f95}}, './file0\x00'})
r5 = perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000500)=ANY=[@ANYBLOB="010000000100000018000000", @ANYRES32=r5, @ANYBLOB="00000000000000002ed9aeaff9b7f1164083cb1f9bed3f8f5e3000000000c100"])
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x20000000000038d, 0x0, &(0x7f0000000200), 0x410, &(0x7f0000000540)=ANY=[@ANYRESHEX=r0, @ANYRESOCT=r1, @ANYRESDEC=r2, @ANYRES64, @ANYRESDEC=r5, @ANYRES64=r0, @ANYRES32, @ANYBLOB="64140627603e8a59b0005dfda9ec886b6f8c18a5771b39cddbb28d52bf6b14977c16d9d41e46c28d029292f2a000cea824dd47d4a881128303202d186196bce0071b7cc344184f85e1e78f66dcd9e3091691f9e0dbd4aba708bd233708cdf4b11f251d8ce60160a3d936deea990249a060cbdbeb176f2406ce5363ce8cbbdebe6a0b1f4f9a2277ede7c8cca8b201151d3bb7696280acc29cbb705b7df2d5c075b0d3ab3d379507cc8db0d398d3ece5c7a03849ec66e45a79f4df8bfd9ea5db000df895efef4e5916d4b9d6"])
chdir(&(0x7f0000000140)='./file0\x00')
ioctl$EXT4_IOC_GETSTATE(r3, 0x40046629, &(0x7f00000000c0))
r6 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_mount_image$tmpfs(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
r7 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r7, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r7, r6, 0x0, 0xfffffdef)

00:17:57 executing program 5:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 73)

00:17:57 executing program 6:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 70)

00:17:57 executing program 0:
perf_event_open(&(0x7f0000000080)={0x0, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r1, &(0x7f0000000100), 0x0, 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r0, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r2, 0xff4f, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0x0, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r1, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:17:57 executing program 1:
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}}, 0x0, 0x6, 0xffffffffffffffff, 0xb)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
r1 = gettid()
rt_sigqueueinfo(0x0, 0x0, 0x0)
r2 = pidfd_getfd(0xffffffffffffffff, r0, 0x0)
perf_event_open(&(0x7f0000000040)={0x5, 0x80, 0x40, 0x71, 0x2, 0x0, 0x0, 0x8000, 0x20, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, @perf_config_ext={0xff}, 0x0, 0x9b5, 0xfa, 0xd, 0x0, 0x8000, 0x55, 0x0, 0x0, 0x0, 0x3ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000400)={0x2, 0x80, 0x2a, 0x81, 0xe0, 0x40, 0x0, 0x63c5ef1c, 0x80, 0x3, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x7, 0x2, @perf_config_ext={0xf2, 0x6}, 0x0, 0x5, 0xfffffff8, 0x0, 0x1, 0x0, 0x1b6, 0x0, 0x6}, 0x0, 0xd, 0xffffffffffffffff, 0x0)
rt_sigqueueinfo(0x0, 0x0, &(0x7f0000000000))
setsockopt$sock_timeval(r0, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10)
bind$packet(r2, &(0x7f00000000c0)={0x11, 0xfe, 0x0, 0x1, 0xfb, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}}, 0x14)
perf_event_open(&(0x7f0000000100)={0x0, 0x80, 0xff, 0x8, 0x4, 0x1, 0x0, 0x4, 0x684, 0x4, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0xdbc, 0x0, @perf_config_ext={0xd03, 0x80000000}, 0x0, 0x3, 0x3, 0x5, 0x300000000000000, 0x7, 0x7ff, 0x0, 0x0, 0x0, 0x5}, r1, 0x10, 0xffffffffffffffff, 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r3, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
openat(r3, &(0x7f0000000180)='\x00', 0x400040, 0x80)
rt_sigqueueinfo(0x0, 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f0000000240)={'ip6_vti0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x4, 0x0, 0x7f, 0x40, 0xb, @local, @mcast1, 0x88, 0x20, 0x8, 0x2}})

00:17:57 executing program 7:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684fd2981c8409820000080000000000000000"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x100d}], 0x6, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:17:57 executing program 2:
perf_event_open(&(0x7f0000000080)={0x0, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r1, &(0x7f0000000100), 0x0, 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r0, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r2, 0xff3f, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0x0, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r1, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

[ 2767.269338] loop3: detected capacity change from 0 to 40
[ 2767.280374] loop5: detected capacity change from 0 to 40
[ 2767.290213] loop6: detected capacity change from 0 to 40
[ 2767.350239] loop4: detected capacity change from 0 to 264192
[ 2767.383440] syz-executor.5: attempt to access beyond end of device
[ 2767.383440] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2767.384414] Buffer I/O error on dev loop5, logical block 10, lost async page write
[ 2767.391934] FAT-fs (loop4): Unrecognized mount option "0x00000000000000030000000000000000000000418446744073709551615��������00000000000000000006" or missing value
00:17:58 executing program 3:
syz_mount_image$vfat(&(0x7f0000000080), 0x0, 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r0, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)

00:17:58 executing program 1:
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}}, 0x0, 0x6, 0xffffffffffffffff, 0xb)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
r1 = gettid()
rt_sigqueueinfo(0x0, 0x0, 0x0)
r2 = pidfd_getfd(0xffffffffffffffff, r0, 0x0)
perf_event_open(&(0x7f0000000040)={0x5, 0x80, 0x40, 0x71, 0x2, 0x0, 0x0, 0x8000, 0x20, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, @perf_config_ext={0xff}, 0x0, 0x9b5, 0xfa, 0xd, 0x0, 0x8000, 0x55, 0x0, 0x0, 0x0, 0x3ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000400)={0x2, 0x80, 0x2a, 0x81, 0xe0, 0x40, 0x0, 0x63c5ef1c, 0x80, 0x3, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x7, 0x2, @perf_config_ext={0xf2, 0x6}, 0x0, 0x5, 0xfffffff8, 0x0, 0x1, 0x0, 0x1b6, 0x0, 0x6}, 0x0, 0xd, 0xffffffffffffffff, 0x0)
rt_sigqueueinfo(0x0, 0x0, &(0x7f0000000000))
setsockopt$sock_timeval(r0, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10)
bind$packet(r2, &(0x7f00000000c0)={0x11, 0xfe, 0x0, 0x1, 0xfb, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}}, 0x14)
perf_event_open(&(0x7f0000000100)={0x0, 0x80, 0xff, 0x8, 0x4, 0x1, 0x0, 0x4, 0x684, 0x4, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0xdbc, 0x0, @perf_config_ext={0xd03, 0x80000000}, 0x800, 0x0, 0x3, 0x5, 0x300000000000000, 0x7, 0x7ff, 0x0, 0x0, 0x0, 0x5}, r1, 0x10, 0xffffffffffffffff, 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r3, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
openat(r3, &(0x7f0000000180)='\x00', 0x400040, 0x80)
rt_sigqueueinfo(0x0, 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f0000000240)={'ip6_vti0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x4, 0x0, 0x7f, 0x40, 0xb, @local, @mcast1, 0x88, 0x20, 0x8, 0x2}})

[ 2767.437235] syz-executor.6: attempt to access beyond end of device
[ 2767.437235] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2767.439139] Buffer I/O error on dev loop6, logical block 10, lost async page write
00:17:58 executing program 5:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 74)

00:17:58 executing program 0:
perf_event_open(&(0x7f0000000080)={0x0, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r1, &(0x7f0000000100), 0x0, 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r0, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r2, 0xff57, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0x0, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r1, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:17:58 executing program 6:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 71)

[ 2767.568936] loop3: detected capacity change from 0 to 40
00:17:58 executing program 2:
syz_mount_image$vfat(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r0, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)

[ 2767.591726] loop5: detected capacity change from 0 to 40
[ 2767.679722] loop6: detected capacity change from 0 to 40
[ 2767.683763] loop2: detected capacity change from 0 to 40
00:17:58 executing program 7:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684fd2981c8409820000080000000000000000"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x100d}], 0x7, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

[ 2767.743637] syz-executor.5: attempt to access beyond end of device
[ 2767.743637] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2767.745245] Buffer I/O error on dev loop5, logical block 10, lost async page write
00:17:58 executing program 1:
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}}, 0x0, 0x6, 0xffffffffffffffff, 0xb)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
r1 = gettid()
rt_sigqueueinfo(0x0, 0x0, 0x0)
r2 = pidfd_getfd(0xffffffffffffffff, r0, 0x0)
perf_event_open(&(0x7f0000000040)={0x5, 0x80, 0x40, 0x71, 0x2, 0x0, 0x0, 0x8000, 0x20, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, @perf_config_ext={0xff}, 0x0, 0x9b5, 0xfa, 0xd, 0x0, 0x8000, 0x55, 0x0, 0x0, 0x0, 0x3ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000400)={0x2, 0x80, 0x2a, 0x81, 0xe0, 0x40, 0x0, 0x63c5ef1c, 0x80, 0x3, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x7, 0x2, @perf_config_ext={0xf2, 0x6}, 0x0, 0x5, 0xfffffff8, 0x0, 0x1, 0x0, 0x1b6, 0x0, 0x6}, 0x0, 0xd, 0xffffffffffffffff, 0x0)
rt_sigqueueinfo(0x0, 0x0, &(0x7f0000000000))
setsockopt$sock_timeval(r0, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10)
bind$packet(r2, &(0x7f00000000c0)={0x11, 0xfe, 0x0, 0x1, 0xfb, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}}, 0x14)
perf_event_open(&(0x7f0000000100)={0x0, 0x80, 0xff, 0x8, 0x4, 0x1, 0x0, 0x4, 0x684, 0x4, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0xdbc, 0x0, @perf_config_ext={0xd03, 0x80000000}, 0x800, 0x0, 0x3, 0x5, 0x300000000000000, 0x7, 0x7ff, 0x0, 0x0, 0x0, 0x5}, r1, 0x10, 0xffffffffffffffff, 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r3, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
openat(r3, &(0x7f0000000180)='\x00', 0x400040, 0x80)
rt_sigqueueinfo(0x0, 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f0000000240)={'ip6_vti0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x4, 0x0, 0x7f, 0x40, 0xb, @local, @mcast1, 0x88, 0x20, 0x8, 0x2}})

[ 2767.783243] syz-executor.6: attempt to access beyond end of device
[ 2767.783243] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2767.785139] Buffer I/O error on dev loop6, logical block 10, lost async page write
00:17:58 executing program 3:
syz_mount_image$vfat(&(0x7f0000000080), 0x0, 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r0, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)

[ 2767.927137] loop3: detected capacity change from 0 to 40
[ 2768.145557] loop4: detected capacity change from 0 to 264192
[ 2768.181883] FAT-fs (loop4): Unrecognized mount option "0x00000000000000030000000000000000000000418446744073709551615��������00000000000000000006" or missing value
00:18:14 executing program 0:
perf_event_open(&(0x7f0000000080)={0x0, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r1, &(0x7f0000000100), 0x0, 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r0, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r2, 0xff5f, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0x0, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r1, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:18:14 executing program 4:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_mount_image$tmpfs(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef)
r2 = syz_mount_image$iso9660(&(0x7f00000000c0), &(0x7f0000000180)='./file0\x00', 0xff, 0x2, &(0x7f0000000300)=[{&(0x7f0000000240)="9730269fe31a1c59426f0af36a35908e771dc602431bba25782911d5c988f7c8fbbdfd3f6aa905874e85f68216d3276faf0835a9e2d462e0b30f264087570325e7f7a6b387093154afb901face3f84a6913d3f9d3a62866807595a7e93f22e81a4e19f46ec176fe12c2c228909e4b4eb5bc3d8f00e897d313cf5f9a0bfe439c80a908fbba7ff6d3982377c101f5ccd25f07a87b130a1", 0x96, 0x2}, {&(0x7f00000001c0)="6b42c00e963d00ec0665ce", 0xb, 0x1}], 0x40, &(0x7f0000000340)={[{@unhide}, {@check_relaxed}, {@mode={'mode', 0x3d, 0x4}}, {@map_acorn}, {@cruft}, {@dmode={'dmode', 0x3d, 0x35}}, {@session={'session', 0x3d, 0xf}}, {@mode={'mode', 0x3d, 0x9}}], [{@audit}]})
fsconfig$FSCONFIG_SET_PATH_EMPTY(r0, 0x4, &(0x7f0000000000)='vfat\x00', &(0x7f0000000040)='./file0\x00', r2)

00:18:14 executing program 7:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684fd2981c8409820000080000000000000000"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x100d}], 0x8, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:18:14 executing program 2:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_mount_image$tmpfs(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
ioctl$BTRFS_IOC_GET_FEATURES(r1, 0x80189439, &(0x7f0000000000))
sendfile(r1, r0, 0x0, 0xfffffdef)

00:18:14 executing program 3:
syz_mount_image$vfat(&(0x7f0000000080), 0x0, 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r0, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)

00:18:14 executing program 1:
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}}, 0x0, 0x6, 0xffffffffffffffff, 0xb)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
r1 = gettid()
rt_sigqueueinfo(0x0, 0x0, 0x0)
r2 = pidfd_getfd(0xffffffffffffffff, r0, 0x0)
perf_event_open(&(0x7f0000000040)={0x5, 0x80, 0x40, 0x71, 0x2, 0x0, 0x0, 0x8000, 0x20, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, @perf_config_ext={0xff}, 0x0, 0x9b5, 0xfa, 0xd, 0x0, 0x8000, 0x55, 0x0, 0x0, 0x0, 0x3ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000400)={0x2, 0x80, 0x2a, 0x81, 0xe0, 0x40, 0x0, 0x63c5ef1c, 0x80, 0x3, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x7, 0x2, @perf_config_ext={0xf2, 0x6}, 0x0, 0x5, 0xfffffff8, 0x0, 0x1, 0x0, 0x1b6, 0x0, 0x6}, 0x0, 0xd, 0xffffffffffffffff, 0x0)
rt_sigqueueinfo(0x0, 0x0, &(0x7f0000000000))
setsockopt$sock_timeval(r0, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10)
bind$packet(r2, &(0x7f00000000c0)={0x11, 0xfe, 0x0, 0x1, 0xfb, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}}, 0x14)
perf_event_open(&(0x7f0000000100)={0x0, 0x80, 0xff, 0x8, 0x4, 0x1, 0x0, 0x4, 0x684, 0x4, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0xdbc, 0x0, @perf_config_ext={0xd03, 0x80000000}, 0x800, 0x0, 0x3, 0x5, 0x300000000000000, 0x7, 0x7ff, 0x0, 0x0, 0x0, 0x5}, r1, 0x10, 0xffffffffffffffff, 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r3, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
openat(r3, &(0x7f0000000180)='\x00', 0x400040, 0x80)
rt_sigqueueinfo(0x0, 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f0000000240)={'ip6_vti0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x4, 0x0, 0x7f, 0x40, 0xb, @local, @mcast1, 0x88, 0x20, 0x8, 0x2}})

00:18:14 executing program 6:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 72)

00:18:14 executing program 5:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 75)

[ 2784.370940] loop2: detected capacity change from 0 to 40
[ 2784.377853] loop5: detected capacity change from 0 to 40
[ 2784.385451] loop4: detected capacity change from 0 to 40
[ 2784.386415] loop3: detected capacity change from 0 to 40
[ 2784.391829] loop6: detected capacity change from 0 to 40
[ 2784.489798] syz-executor.4: attempt to access beyond end of device
[ 2784.489798] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2784.491422] Buffer I/O error on dev loop4, logical block 10, lost async page write
[ 2784.506479] syz-executor.6: attempt to access beyond end of device
[ 2784.506479] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2784.508085] Buffer I/O error on dev loop6, logical block 10, lost async page write
[ 2784.531605] syz-executor.5: attempt to access beyond end of device
[ 2784.531605] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2784.533447] Buffer I/O error on dev loop5, logical block 10, lost async page write
[ 2784.561271] syz-executor.2: attempt to access beyond end of device
[ 2784.561271] loop2: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2784.563128] Buffer I/O error on dev loop2, logical block 10, lost async page write
00:18:15 executing program 3:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r0, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)

00:18:15 executing program 5:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 76)

00:18:15 executing program 6:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 73)

00:18:15 executing program 0:
perf_event_open(&(0x7f0000000080)={0x0, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r1, &(0x7f0000000100), 0x0, 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r0, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r2, 0xff67, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0x0, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r1, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:18:15 executing program 1:
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}}, 0x0, 0x6, 0xffffffffffffffff, 0xb)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
r1 = gettid()
rt_sigqueueinfo(0x0, 0x0, 0x0)
r2 = pidfd_getfd(0xffffffffffffffff, r0, 0x0)
perf_event_open(&(0x7f0000000040)={0x5, 0x80, 0x40, 0x71, 0x2, 0x0, 0x0, 0x8000, 0x20, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, @perf_config_ext={0xff}, 0x0, 0x9b5, 0xfa, 0xd, 0x0, 0x8000, 0x55, 0x0, 0x0, 0x0, 0x3ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000400)={0x2, 0x80, 0x2a, 0x81, 0xe0, 0x40, 0x0, 0x63c5ef1c, 0x80, 0x3, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x7, 0x2, @perf_config_ext={0xf2, 0x6}, 0x0, 0x5, 0xfffffff8, 0x0, 0x1, 0x0, 0x1b6, 0x0, 0x6}, 0x0, 0xd, 0xffffffffffffffff, 0x0)
rt_sigqueueinfo(0x0, 0x0, &(0x7f0000000000))
setsockopt$sock_timeval(r0, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10)
bind$packet(r2, &(0x7f00000000c0)={0x11, 0xfe, 0x0, 0x1, 0xfb, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}}, 0x14)
perf_event_open(&(0x7f0000000100)={0x0, 0x80, 0xff, 0x8, 0x4, 0x1, 0x0, 0x4, 0x684, 0x4, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0xdbc, 0x0, @perf_config_ext={0xd03, 0x80000000}, 0x800, 0x3, 0x0, 0x5, 0x300000000000000, 0x7, 0x7ff, 0x0, 0x0, 0x0, 0x5}, r1, 0x10, 0xffffffffffffffff, 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r3, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
openat(r3, &(0x7f0000000180)='\x00', 0x400040, 0x80)
rt_sigqueueinfo(0x0, 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f0000000240)={'ip6_vti0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x4, 0x0, 0x7f, 0x40, 0xb, @local, @mcast1, 0x88, 0x20, 0x8, 0x2}})

00:18:15 executing program 4:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x0, 0x0)
syz_mount_image$tmpfs(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
openat(0xffffffffffffffff, &(0x7f0000000000)='./file1\x00', 0x4c400, 0x40)
sendfile(r1, r0, 0x0, 0xfffffdef)

00:18:15 executing program 2:
syz_mount_image$vfat(&(0x7f0000000080), 0x0, 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r0, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)

[ 2784.845507] loop6: detected capacity change from 0 to 40
[ 2784.852772] loop5: detected capacity change from 0 to 40
[ 2784.867388] loop4: detected capacity change from 0 to 40
00:18:15 executing program 3:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r0, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)

00:18:15 executing program 7:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684fd2981c8409820000080000000000000000"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x100d}], 0x9, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

[ 2784.946664] syz-executor.5: attempt to access beyond end of device
[ 2784.946664] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2784.948117] Buffer I/O error on dev loop5, logical block 10, lost async page write
[ 2784.971776] loop2: detected capacity change from 0 to 40
[ 2784.998405] syz-executor.6: attempt to access beyond end of device
[ 2784.998405] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2785.000176] Buffer I/O error on dev loop6, logical block 10, lost async page write
00:18:15 executing program 0:
perf_event_open(&(0x7f0000000080)={0x0, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r1, &(0x7f0000000100), 0x0, 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r0, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r2, 0xff7f, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0x0, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r1, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:18:15 executing program 4:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0xffffffffffffff3d, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
syz_mount_image$tmpfs(&(0x7f00000000c0), &(0x7f0000000180)='./file1\x00', 0x7, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000300)="eeaa35962b6b8fe6856cd9452db626826706de711b8c95d2bdeee023855435943b67ada7ecec7fcb030544cd8c74dfdf870b686ea0e70e3237e01837af2877b335a4be47deb4a186d0c190bf857bc4e3", 0x50, 0x9}], 0x2840083, &(0x7f0000000380)={[{@mode={'mode', 0x3d, 0xd6a4}}, {@nr_blocks={'nr_blocks', 0x3d, [0x36]}}], [{@pcr={'pcr', 0x3d, 0x1a}}]})
chdir(&(0x7f0000000140)='./file0\x00')
setxattr$security_evm(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040), &(0x7f0000000240)=@v2={0x3, 0x3, 0xb2, 0x0, 0x7f, "0c4a950230ca81360a41572d609fc7f5ba37877f11b1b42545f450a01075a0e0c85f7816070c5f591f8ffe084ffa027ee02d78c5567f301437d44047bbbf94be7300ca0a1c68b70c88db3986ca6a844db8b93eb80e6a1bb099f76b958a0884ca7c1857e5cb03d5e214b28f7e245205b3d1b6d2ce6c0e1bf7ed81d60236a7c6"}, 0x88, 0x1)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_mount_image$tmpfs(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef)

00:18:15 executing program 5:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 77)

00:18:15 executing program 1:
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}}, 0x0, 0x6, 0xffffffffffffffff, 0xb)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
r1 = gettid()
rt_sigqueueinfo(0x0, 0x0, 0x0)
r2 = pidfd_getfd(0xffffffffffffffff, r0, 0x0)
perf_event_open(&(0x7f0000000040)={0x5, 0x80, 0x40, 0x71, 0x2, 0x0, 0x0, 0x8000, 0x20, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, @perf_config_ext={0xff}, 0x0, 0x9b5, 0xfa, 0xd, 0x0, 0x8000, 0x55, 0x0, 0x0, 0x0, 0x3ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000400)={0x2, 0x80, 0x2a, 0x81, 0xe0, 0x40, 0x0, 0x63c5ef1c, 0x80, 0x3, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x7, 0x2, @perf_config_ext={0xf2, 0x6}, 0x0, 0x5, 0xfffffff8, 0x0, 0x1, 0x0, 0x1b6, 0x0, 0x6}, 0x0, 0xd, 0xffffffffffffffff, 0x0)
rt_sigqueueinfo(0x0, 0x0, &(0x7f0000000000))
setsockopt$sock_timeval(r0, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10)
bind$packet(r2, &(0x7f00000000c0)={0x11, 0xfe, 0x0, 0x1, 0xfb, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}}, 0x14)
perf_event_open(&(0x7f0000000100)={0x0, 0x80, 0xff, 0x8, 0x4, 0x1, 0x0, 0x4, 0x684, 0x4, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0xdbc, 0x0, @perf_config_ext={0xd03, 0x80000000}, 0x800, 0x3, 0x0, 0x5, 0x300000000000000, 0x7, 0x7ff, 0x0, 0x0, 0x0, 0x5}, r1, 0x10, 0xffffffffffffffff, 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r3, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
openat(r3, &(0x7f0000000180)='\x00', 0x400040, 0x80)
rt_sigqueueinfo(0x0, 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f0000000240)={'ip6_vti0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x4, 0x0, 0x7f, 0x40, 0xb, @local, @mcast1, 0x88, 0x20, 0x8, 0x2}})

00:18:15 executing program 2:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684fd2981c8409820000080000000000000000"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x98b}], 0x1, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

[ 2785.182916] loop5: detected capacity change from 0 to 40
[ 2785.195263] FAT-fs (loop4): bogus number of reserved sectors
[ 2785.195810] FAT-fs (loop4): Can't find a valid FAT filesystem
[ 2785.252587] syz-executor.5: attempt to access beyond end of device
[ 2785.252587] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2785.253707] Buffer I/O error on dev loop5, logical block 10, lost async page write
[ 2786.013092] FAT-fs (loop4): Unrecognized mount option "./file0" or missing value
00:18:32 executing program 6:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 74)

00:18:32 executing program 4:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_mount_image$tmpfs(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef)
write(r0, &(0x7f0000000000)="d319c374722b90b5f700bd1e7aee11763ee94d430d19b4f6179e328b18c04231bd", 0x21)

00:18:32 executing program 2:
perf_event_open(&(0x7f0000000080)={0x0, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r1, &(0x7f0000000100), 0x0, 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r0, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r2, 0x5fff, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0x0, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r1, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:18:32 executing program 5:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 78)

00:18:32 executing program 7:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684fd2981c8409820000080000000000000000"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x100d}], 0xa, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:18:32 executing program 1:
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}}, 0x0, 0x6, 0xffffffffffffffff, 0xb)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
r1 = gettid()
rt_sigqueueinfo(0x0, 0x0, 0x0)
r2 = pidfd_getfd(0xffffffffffffffff, r0, 0x0)
perf_event_open(&(0x7f0000000040)={0x5, 0x80, 0x40, 0x71, 0x2, 0x0, 0x0, 0x8000, 0x20, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, @perf_config_ext={0xff}, 0x0, 0x9b5, 0xfa, 0xd, 0x0, 0x8000, 0x55, 0x0, 0x0, 0x0, 0x3ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000400)={0x2, 0x80, 0x2a, 0x81, 0xe0, 0x40, 0x0, 0x63c5ef1c, 0x80, 0x3, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x7, 0x2, @perf_config_ext={0xf2, 0x6}, 0x0, 0x5, 0xfffffff8, 0x0, 0x1, 0x0, 0x1b6, 0x0, 0x6}, 0x0, 0xd, 0xffffffffffffffff, 0x0)
rt_sigqueueinfo(0x0, 0x0, &(0x7f0000000000))
setsockopt$sock_timeval(r0, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10)
bind$packet(r2, &(0x7f00000000c0)={0x11, 0xfe, 0x0, 0x1, 0xfb, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}}, 0x14)
perf_event_open(&(0x7f0000000100)={0x0, 0x80, 0xff, 0x8, 0x4, 0x1, 0x0, 0x4, 0x684, 0x4, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0xdbc, 0x0, @perf_config_ext={0xd03, 0x80000000}, 0x800, 0x3, 0x0, 0x5, 0x300000000000000, 0x7, 0x7ff, 0x0, 0x0, 0x0, 0x5}, r1, 0x10, 0xffffffffffffffff, 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r3, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
openat(r3, &(0x7f0000000180)='\x00', 0x400040, 0x80)
rt_sigqueueinfo(0x0, 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f0000000240)={'ip6_vti0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x4, 0x0, 0x7f, 0x40, 0xb, @local, @mcast1, 0x88, 0x20, 0x8, 0x2}})

00:18:32 executing program 3:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r0, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)

00:18:32 executing program 0:
perf_event_open(&(0x7f0000000080)={0x0, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r1, &(0x7f0000000100), 0x0, 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r0, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r2, 0x59800, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0x0, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r1, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

[ 2801.431507] loop6: detected capacity change from 0 to 40
[ 2801.445856] loop5: detected capacity change from 0 to 40
[ 2801.490274] loop4: detected capacity change from 0 to 40
[ 2801.492456] syz-executor.6: attempt to access beyond end of device
[ 2801.492456] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2801.493604] Buffer I/O error on dev loop6, logical block 10, lost async page write
[ 2801.523948] syz-executor.5: attempt to access beyond end of device
[ 2801.523948] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2801.525106] Buffer I/O error on dev loop5, logical block 10, lost async page write
00:18:32 executing program 0:
perf_event_open(&(0x7f0000000080)={0x0, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r1, &(0x7f0000000100), 0x0, 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r0, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r2, 0x5a000, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0x0, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r1, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:18:32 executing program 6:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 75)

[ 2801.611435] syz-executor.4: attempt to access beyond end of device
[ 2801.611435] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2801.613332] Buffer I/O error on dev loop4, logical block 10, lost async page write
00:18:32 executing program 3:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r0, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)

[ 2801.688951] loop6: detected capacity change from 0 to 40
[ 2801.731852] syz-executor.6: attempt to access beyond end of device
[ 2801.731852] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2801.733055] Buffer I/O error on dev loop6, logical block 10, lost async page write
[ 2801.780096] FAT-fs (loop3): bogus number of reserved sectors
[ 2801.780962] FAT-fs (loop3): Can't find a valid FAT filesystem
[ 2820.094490] FAT-fs (loop3): bogus number of reserved sectors
[ 2820.094955] FAT-fs (loop3): Can't find a valid FAT filesystem
00:18:50 executing program 5:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 79)

00:18:50 executing program 3:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r0, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)

00:18:50 executing program 0:
perf_event_open(&(0x7f0000000080)={0x0, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r1, &(0x7f0000000100), 0x0, 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r0, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r2, 0x5a800, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0x0, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r1, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:18:50 executing program 2:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r0, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)

00:18:50 executing program 7:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684fd2981c8409820000080000000000000000"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x100d}], 0xf, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:18:50 executing program 1:
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}}, 0x0, 0x6, 0xffffffffffffffff, 0xb)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
r1 = gettid()
rt_sigqueueinfo(0x0, 0x0, 0x0)
r2 = pidfd_getfd(0xffffffffffffffff, r0, 0x0)
perf_event_open(&(0x7f0000000040)={0x5, 0x80, 0x40, 0x71, 0x2, 0x0, 0x0, 0x8000, 0x20, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, @perf_config_ext={0xff}, 0x0, 0x9b5, 0xfa, 0xd, 0x0, 0x8000, 0x55, 0x0, 0x0, 0x0, 0x3ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000400)={0x2, 0x80, 0x2a, 0x81, 0xe0, 0x40, 0x0, 0x63c5ef1c, 0x80, 0x3, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x7, 0x2, @perf_config_ext={0xf2, 0x6}, 0x0, 0x5, 0xfffffff8, 0x0, 0x1, 0x0, 0x1b6, 0x0, 0x6}, 0x0, 0xd, 0xffffffffffffffff, 0x0)
rt_sigqueueinfo(0x0, 0x0, &(0x7f0000000000))
setsockopt$sock_timeval(r0, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10)
bind$packet(r2, &(0x7f00000000c0)={0x11, 0xfe, 0x0, 0x1, 0xfb, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}}, 0x14)
perf_event_open(&(0x7f0000000100)={0x0, 0x80, 0xff, 0x8, 0x4, 0x1, 0x0, 0x4, 0x684, 0x4, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0xdbc, 0x0, @perf_config_ext={0xd03, 0x80000000}, 0x800, 0x3, 0x3, 0x0, 0x300000000000000, 0x7, 0x7ff, 0x0, 0x0, 0x0, 0x5}, r1, 0x10, 0xffffffffffffffff, 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r3, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
openat(r3, &(0x7f0000000180)='\x00', 0x400040, 0x80)
rt_sigqueueinfo(0x0, 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f0000000240)={'ip6_vti0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x4, 0x0, 0x7f, 0x40, 0xb, @local, @mcast1, 0x88, 0x20, 0x8, 0x2}})

00:18:50 executing program 6:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 76)

00:18:50 executing program 4:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_mount_image$tmpfs(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
r2 = syz_open_dev$tty1(0xc, 0x4, 0x1)
writev(r2, &(0x7f0000000000)=[{&(0x7f0000000140)="02b2dccad213e1e6cf54b7a797f8f22a47f25b7658fb110b2e76f95b0f318b8fa745e6ffba4414d29a42bfab524bc5bffb17decc4540a6f00b9772f5f9789a9525790df8d989b23530d0a1398f2ad734c7ff47961be476ffeec81efa3d3aa64b8ea329261dfc2e1047a68670f0e5950d6a5414956bddd09e101b5b66e5742fe843413e065e3b86a242b37bc58c68153a45015f6f1ea67762c302e461e0c84bbb7f8d464f5a72d9fad56dac0c5028a4012a93dbc7da640786e3c9898cdd8fe091b166bfcd66e6257abc923ceaf90e994deded3fe8a59c2105f5caf366d32170ef51299dbf441bc3cddda352a2e07375fb44e75fed8082f3e960015d9bcddb0c834feda68d113a9a9fc0d1c30153685caf43b176219b666d74e67b6192cfd8a561c6c4aadcc80ed8c469bc41b028f1db515d699e45ad3379f9b1edb8de4bb2f8615d6716297baac7e45073fcecf31e51ec78c40edd78f245bced04414f849fb961fbbe79ff2ed7c48ec1b5331f9755d7094986fc8da198ce4a12f9ddfb43e565bc4fed618da9a693d03c3e7ec4b3014dfc022103e277c1b12efb03ef8b197f3a931f6cbe238cf8a4e7639b409b4586f66da41b94eed69d52ba9fde5aa1ee774d4e626932dc3511b10ae3bc3e8688a7a83b0467dfbf92951747396735c9f47ad4552e7bdf4f8e7998a1266a360beb2ec1527390452139f9ab91ee250efcf3413e72a6b2688d8b6a4748ccc165bbf886573ccdd03bd93f32a866cd878ec246e06f31d4d7f7ec9836b7305ee0c1b9fa75cd6e4ca5cc2f107b654f15a2442cd9c8eaf581d093639fe35e0da49394c5ed66ad29bc2b863649e16c1951d0d3dd6f1048539e558ee1f059d91510a5acd84777ca01545635d2fb40e2f205bb11435023e47e4e2f85b6d1b56b688dd1a4304708a561d32dbaa6cd4f969e67af33773d4e9772751019dc6c2af7e2fe9d3c7eb6f1b401926603d90802f792b081957dd5ebd18410cd42b2ea05ae9a61254e4b878384b8a376fe9eba06afc1253f2224fab88feb7c426e3dfb19385afbb42cc13209b419568eeafdf505dc5ca30acc17d337e941e0badf9f9413f381fe9a315e2597426805827943f193f02a12554d434bd91708a28d9da1bf64ad64f80a7287d1e02d5d1f14bf9d89ba3badfa524694db6a651e97ea64104ad34942f36745259f4ec32fdce0bd13e693ccbe0e012e61a1fae9fc1662b99871e3812cea14d12646ccc08b0514762a475ecdbf9071377bb1ecd891c6fe32fde1d3044caf466b3a342b7541e8ed7432e94baf1d5546aff0e23f6a03c9ea5635519533e712639c27958e3a0f3684ed91cfb2e6e4", 0x3b8}], 0x1)
pidfd_getfd(r1, r0, 0x0)
r3 = openat$loop_ctrl(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$LOOP_CTL_REMOVE(r3, 0x4c81, 0x0)
r4 = perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000500)=ANY=[@ANYBLOB="010000000100000018000000", @ANYRES32=<r5=>r4, @ANYBLOB="00000000000000002ed9aeaff9b7f1164083cb1f9bed3f8f5e3000000000c100"])
ioctl$AUTOFS_DEV_IOCTL_READY(r5, 0xc0189376, &(0x7f00000000c0)=ANY=[@ANYBLOB="010000000100000018000000", @ANYRES32=r3, @ANYBLOB="954f00000000001dbae15578ee2b16193dbe4bcf96002e2f666bc1653000"])
sendfile(r2, r2, 0x0, 0xffff)

[ 2820.133228] loop4: detected capacity change from 0 to 40
00:18:50 executing program 3:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r0, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)

[ 2820.181660] loop6: detected capacity change from 0 to 40
[ 2820.190906] loop5: detected capacity change from 0 to 40
[ 2820.241185] FAT-fs (loop3): bogus number of reserved sectors
[ 2820.241673] FAT-fs (loop3): Can't find a valid FAT filesystem
[ 2820.243409] syz-executor.6: attempt to access beyond end of device
[ 2820.243409] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2820.244302] Buffer I/O error on dev loop6, logical block 10, lost async page write
00:18:50 executing program 2:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_mount_image$tmpfs(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef)
write(r0, &(0x7f0000000000)="d319c374722b90b5f700bd1e7aee11763ee94d430d19b4f6179e328b18c04231bd", 0x21)

00:18:50 executing program 0:
perf_event_open(&(0x7f0000000080)={0x0, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r1, &(0x7f0000000100), 0x0, 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r0, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r2, 0x5b000, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0x0, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r1, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:18:50 executing program 6:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 77)

00:18:50 executing program 3:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r0, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)

[ 2820.354505] syz-executor.5: attempt to access beyond end of device
[ 2820.354505] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2820.356201] Buffer I/O error on dev loop5, logical block 10, lost async page write
[ 2820.371070] FAT-fs (loop3): bogus number of reserved sectors
[ 2820.371534] FAT-fs (loop3): Can't find a valid FAT filesystem
[ 2820.419897] loop6: detected capacity change from 0 to 40
00:18:51 executing program 1:
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}}, 0x0, 0x6, 0xffffffffffffffff, 0xb)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
r1 = gettid()
rt_sigqueueinfo(0x0, 0x0, 0x0)
r2 = pidfd_getfd(0xffffffffffffffff, r0, 0x0)
perf_event_open(&(0x7f0000000040)={0x5, 0x80, 0x40, 0x71, 0x2, 0x0, 0x0, 0x8000, 0x20, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, @perf_config_ext={0xff}, 0x0, 0x9b5, 0xfa, 0xd, 0x0, 0x8000, 0x55, 0x0, 0x0, 0x0, 0x3ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000400)={0x2, 0x80, 0x2a, 0x81, 0xe0, 0x40, 0x0, 0x63c5ef1c, 0x80, 0x3, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x7, 0x2, @perf_config_ext={0xf2, 0x6}, 0x0, 0x5, 0xfffffff8, 0x0, 0x1, 0x0, 0x1b6, 0x0, 0x6}, 0x0, 0xd, 0xffffffffffffffff, 0x0)
rt_sigqueueinfo(0x0, 0x0, &(0x7f0000000000))
setsockopt$sock_timeval(r0, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10)
bind$packet(r2, &(0x7f00000000c0)={0x11, 0xfe, 0x0, 0x1, 0xfb, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}}, 0x14)
perf_event_open(&(0x7f0000000100)={0x0, 0x80, 0xff, 0x8, 0x4, 0x1, 0x0, 0x4, 0x684, 0x4, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0xdbc, 0x0, @perf_config_ext={0xd03, 0x80000000}, 0x800, 0x3, 0x3, 0x0, 0x300000000000000, 0x7, 0x7ff, 0x0, 0x0, 0x0, 0x5}, r1, 0x10, 0xffffffffffffffff, 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r3, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
openat(r3, &(0x7f0000000180)='\x00', 0x400040, 0x80)
rt_sigqueueinfo(0x0, 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f0000000240)={'ip6_vti0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x4, 0x0, 0x7f, 0x40, 0xb, @local, @mcast1, 0x88, 0x20, 0x8, 0x2}})

00:18:51 executing program 0:
perf_event_open(&(0x7f0000000080)={0x0, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r1, &(0x7f0000000100), 0x0, 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r0, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r2, 0x5b800, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0x0, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r1, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:18:51 executing program 4:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_mount_image$tmpfs(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
openat(0xffffffffffffffff, &(0x7f0000000000)='.\x00', 0x42100, 0x8e)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef)

[ 2820.472593] loop2: detected capacity change from 0 to 40
00:18:51 executing program 5:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 80)

00:18:51 executing program 3:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r0, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)

[ 2820.553199] FAT-fs (loop3): bogus number of reserved sectors
[ 2820.553679] FAT-fs (loop3): Can't find a valid FAT filesystem
[ 2820.573741] loop4: detected capacity change from 0 to 40
[ 2820.585322] syz-executor.6: attempt to access beyond end of device
[ 2820.585322] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
00:18:51 executing program 1:
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}}, 0x0, 0x6, 0xffffffffffffffff, 0xb)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
r1 = gettid()
rt_sigqueueinfo(0x0, 0x0, 0x0)
r2 = pidfd_getfd(0xffffffffffffffff, r0, 0x0)
perf_event_open(&(0x7f0000000040)={0x5, 0x80, 0x40, 0x71, 0x2, 0x0, 0x0, 0x8000, 0x20, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, @perf_config_ext={0xff}, 0x0, 0x9b5, 0xfa, 0xd, 0x0, 0x8000, 0x55, 0x0, 0x0, 0x0, 0x3ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000400)={0x2, 0x80, 0x2a, 0x81, 0xe0, 0x40, 0x0, 0x63c5ef1c, 0x80, 0x3, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x7, 0x2, @perf_config_ext={0xf2, 0x6}, 0x0, 0x5, 0xfffffff8, 0x0, 0x1, 0x0, 0x1b6, 0x0, 0x6}, 0x0, 0xd, 0xffffffffffffffff, 0x0)
rt_sigqueueinfo(0x0, 0x0, &(0x7f0000000000))
setsockopt$sock_timeval(r0, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10)
bind$packet(r2, &(0x7f00000000c0)={0x11, 0xfe, 0x0, 0x1, 0xfb, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}}, 0x14)
perf_event_open(&(0x7f0000000100)={0x0, 0x80, 0xff, 0x8, 0x4, 0x1, 0x0, 0x4, 0x684, 0x4, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0xdbc, 0x0, @perf_config_ext={0xd03, 0x80000000}, 0x800, 0x3, 0x3, 0x0, 0x300000000000000, 0x7, 0x7ff, 0x0, 0x0, 0x0, 0x5}, r1, 0x10, 0xffffffffffffffff, 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r3, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
openat(r3, &(0x7f0000000180)='\x00', 0x400040, 0x80)
rt_sigqueueinfo(0x0, 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f0000000240)={'ip6_vti0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x4, 0x0, 0x7f, 0x40, 0xb, @local, @mcast1, 0x88, 0x20, 0x8, 0x2}})

[ 2820.586954] Buffer I/O error on dev loop6, logical block 10, lost async page write
00:18:51 executing program 0:
perf_event_open(&(0x7f0000000080)={0x0, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r1, &(0x7f0000000100), 0x0, 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r0, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r2, 0x5c000, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0x0, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r1, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

[ 2820.646913] syz-executor.2: attempt to access beyond end of device
[ 2820.646913] loop2: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2820.647760] Buffer I/O error on dev loop2, logical block 10, lost async page write
[ 2820.691808] syz-executor.4: attempt to access beyond end of device
[ 2820.691808] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2820.692690] Buffer I/O error on dev loop4, logical block 10, lost async page write
[ 2820.714562] loop5: detected capacity change from 0 to 40
00:18:51 executing program 6:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 78)

00:18:51 executing program 3:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r0, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)

00:18:51 executing program 4:
r0 = syz_mount_image$vfat(&(0x7f0000000040), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_mount_image$tmpfs(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
mknodat$loop(r1, &(0x7f0000000000)='./file1\x00', 0x400, 0x1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r2, r1, 0x0, 0xfffffdef)
name_to_handle_at(r0, &(0x7f0000000080)='./file1\x00', &(0x7f0000000240)=@OVL_FILEID_V1={0x1018, 0xf8, {'\x00', {0x0, 0xfb, 0x1015, 0x0, 0x2, "22a9c7de7b0c0ba9138e7792e9ec499f", "e2478d02898127c559e3ca96257bab69716da8bbf2b5c7af5a37890d665aeb364427f9da34a5bf5b3bfbb83972a5c99e2e4071e8122a7c04f4e0acf3e2f04750e412b6be2a50c6659ebe9d9f8066aa4b6fcd9413fafac1149bba1efe1c839d615420f9be899eb998df6959273d86bd2b2ed0aa14676abdaf2343d39a1bd66020e5f82e97099cb8dd630418d9d5965c4c3405d1bf08900a6b92a70551360250f286ee83604a99e07821f2ed2493014eba4b7ba23db946f03814e87eecfeff5d719a8edee1f9a3304f773a83d931e9bfd313e5d0f962bdb12465de77f3e2ef8fcfcc18764fa7e2bfe1a34dc445adb67c15cd60e34e4a4410860c9647f17de46aeec2d7892a5fbeb2a98f58e35d9e106526f5d4cd42a54c0740efb919fabd2529161012c7b1b4f96a784ffe8ddba66c3d08884d93ca589259996a9425a9ed77c15cf0a5a857a8d9c73277675f02b83d27e5364bef69b6b465c676744f90be05daa6d29541491b8590c3209a3ff4d25a00f9cb648837ecda5229dc07e2f06b87d1b055e7b3f5ee7079e2016e670778aa77b064281d0334786bc7ee259b4474ff70708ca026f9f427bbf6edb354b13d3e545f10aaaa36873df2c08aa25360f085acac5e74a7e645d4b5127cdfe50541e90fd38f67bb15feb48586c865669af26ea70aa2a96f6c479594529e4a976d6c6464731406ca95c83c0a687280dcb862310caff89b1dcd1d74b13a9bb58a3b4a350b41e4825c461404e653826f13427686b488ae8525e14e7015bbc5716e5454e1608619eed02be15e64df48b0f86b292dbb7eb9f3d6392a7d7bcd43c3fd76160f20893a6bb1b301bb673fc46154a9a1dc7b0a2cc34e79eadd7abeaa400a750c696e4b147b5133fee334eafaa9a7a54ebd914521c43ebdddac368e2595405496352600f1c7cfc51f6a756ec2ae6249f8bffb5bc21be74854fade09858cc51baa1f4be03d20b320f3b53c57b00cb17135db9fa97f096834d540d5d229e3ca91e7adb1da7c08890f510384d855507900dca10af4cbbdfec5b2b692e98be13e3b304fbbdc10736977fc520026f9a49cce70bc56eb629866142fa9b42b5a60a470b9b0eb582b9bd9d7130dacc5231aa2893ba7a7a6d0c36356ea44545e8d0548442c3559c86d7e7e879fff957b993d655044e3b12d9f8f3d780da13f082c0df6a622a54388df9d41207e3a0387648ab47a5b80fde361c4961072b465f797a8bff2b9060370defa06f4c6f21e6978c33bc79a357f7e5ddb2c052c695b83e887844e128bc61992b48e97503745a0234b3f2ecc579216a5991e779fe69cecd622b11b8620a431a7b2849efdb9c1557dd51d832084c61e757e6acfa583785df2f00183cb36d56a0d0841550e286ab2da0bd33518b95e06c230fd777fcae58647bc57f1ab53526f1de9c1323e1d7d800e2625b33ba1bf487c366c5e9fb848eeda4d56da0cc41c67960dcfed5122693eceaec195f5665d4accd2821eacc82029a5081fe3724a7b360d8cd9620a70cb1cc3f49f3ab3d340fb72ddebc61c345133c631aad1b4a857c533692406b4180ab28809c558d72e553b24fd6a5e942f749f3ceec6ffb067c2e266bd0baa155808e766abeb35786e8fb1f504dc5465dcade4dae61790a8fbbc986d2e070e639148a434e1f3ae7ccd0a800d68edb915cb05896420c2553eede1cc82564d20330725614e2acb52f8022ad1f5f62b6f7c77786b95884b29ed8fd0da99c7b269b2da6e73069a9550415d7cf62f4cc51f0144b690471b60696b3fb950cd91f61ce1f438a834a90650b0a6af148a0532152d1c27030dd442d0d38681fc6830576014dc0ff9fa8bbf8bb6ac6d9b70ff41a42e27f49221983fa843a641da5355e1d32231a175791e09fb857d3e46f40b518b189d5956fe022fd0896faf506fdc54e7181d5b4bd762ff1a8e0b94ba5d9a7e54af694364132c797f09c38680d7fed57e6c40f598b9df7702a7580d93a5c913f5ef69b795edaef0176bd236fd30748b7c53fa5747213f375c7359285b28aaa714b0a39975b12b871653c056e91d4f886bf318526914189b1ed63cd142911867bfd599febd090d1c8559fb7308cbfbeaf2619be1f02fd14fe65f6c0e2db5c5ccdfd20e5e57fb8be9a7dc07770eabbee4165647e5d9dc87492dc1fd555ee9ec0995037ee10fcae5c58d7055d856c60fa32fcfef71a5d92a57635599a4f77bd3fffce48d3902e9fc0e8ac28b167aa4b25450cc99d9cf9ef5ce5861a1ad030a50cc619e07b7e932d110b44fd7ec5c30b63e8fa9961d687c23b66b7149b72c87db3af49f610c35982e3d0cdfaa722ac72c88cf7618a81212d5c16fe6660d5352591d81478c6a9aa1d8c2ea4c228f1b1f7e2c1e65ba867a8a8de9a3ebaccea8da1b3aa8b0a52e1d78cc11ec04cb1f5bc54cb15c2dba56217e77845f45a9fb7ae788ad1d9b68b78f58db174b85991e37009cc37c18dd806569f54295f4e9ad690ca8504fce0e7fbbd74761f8e11b057b5cbdd430701bb29338ef396575e68784779877f9e15bd049fa9fdc881ba2c9d7b4360c3d9c29df30399638bd8f9a26cd4df27e1fa7475a072d245444f225733dbe2d3db2d75201409c7f4c50e73e8246c76ad15695832921eaff5f39971af17a95006dae56d7afeb923921c15bffeb766162cc6cacd1992b3cbef489f1f345205cde3b4fd0af5a07c058b9f3b84c46e32909d1b6f76babcaab527e0516274060a8342c3fb2e902e4b9aad448688a698327700a44bbbf10857db95d73129afd3d842f0353c60bf0068078e69ff799857df543a160c5701f694df8f78d22cb29d379bc071a5e9000706ed0ddbfa3932cc4011391b3e6cf736e14590dae672ae6dddd9824a44a2555a0fb0fa3d45209772d2603d285d3099063bec0058d25ccd0a5d300046b1134c5e46195bdb3c4ece45bf01bf6e1d69be6e93d551c91b803a3f1c937e4e0ba883889d87c0ab4b1015329038b0c10c135a9fdcc852728585e4d2d04ab80289d7a5d06a8342c2136ed79db669e96712c38e67ad157c692163356b28605929b5b1e7673569421492295ebc0f35cdb20dc0ab14403cfe27c7fcfc7ea957e599e4fd13a4abf79aadfa6c32b4bb17596cb466ad235b5ca5e241f54e7993a6500b4dbd9288da93325cfbccac78419bf23a2b4d3408934bd84c5496ac34caa7d1317796e83313f0f68ddf4301f7c2c963d4fa7c82ba14931bb29e132ae4b432d32f76e6d4afdfbfdfdf85a35d3c0f91841d44a7843ce6c0cfba8a072653c7ad760ff3f2a2a0edb42204a362147b72e811da0d3c9c41dc079e1424ce224e4f7b4980ebe570150df80eb107a666cb09a1a87b2ef3a4410d13975ecd0b77dafe6d8bb7c2b74c8e2ec05eb9c0fdfe3c4c57ca462836ec357a585bc47c300c52d1273db339a0c681f110915562d3c01a3a4042439e2b525a397abd9146e96d3aaee310fb272de4a4ec35020caba01158e5567d4ef2179f3244a1fb341fa983ec04b1f23eca2f655656ed78bb9230bca48fc06d1ac857504654c9dbd16c201ea2363550ff4520fda01e1edb13d128f4eed567b340a8225382e83bd157e043491c7b159d5f038aaace44c1e7923b44ab6d5bc4d72eeb77ef3c7b759711093577358effc6c08e03a7ec34653abf34125ef5a7f1b3826705e947807d2cf421660f4c073359b7b30d43a33ed9d3885d679a726f889677fdd31c515a9ec2f523b61434a49bebed1d844da3f1f740ec8f547e4a3b3b85d8f86bbd886a2f2931068df85b6c5cae7b696495325ed62398034a85cb6490855b2ce81f6a6752d9bcd5ad12ecada89e5dfc21b3ffe20a25f8a16c1c0d635fb41d0e71cdb17d3ea787829072f1a3ad58f71697e7f9c597640ea2f7374a55fe2905024897127bd356aa2ed79be504d8ea12dcafbe85bf96de6e0abadc2dd803e75ebfe0453ddd1c469310dda7ae36baf1984dcbd70f8a82e9dbb423080433d47241c5a0adf61aeab4299779be4f03bbc024dc8e00c9cfbdc282dda5adb8c18129f20db21c4b281cb19f55e057299d89233b194f390d3886fafc47335dc2156b18443435c768464a8c61ab884c5ea542b81d5ec272fc113a7e489880e213d628a9308491b13474c1b1caf3a5b835f7b13b79db9b0cab3c9c33dca32af96b337e26abb805b66139fcea58663598d536ae1171409cfd1d527603d1633c681c8e5613cd419062b1038968f2f419370a6aef1786c45b0fec71cbf8787570cccf596de3813e02dd6242115be04ebf4a186183b152a5d8da98231d28c97deee1d625572c784e2f09f8006d28254767f58b10e8ff1e8ca4952172ef18f24332269cf4b3f9f3bfdcfe1ba175b70975481f0cc626134c712b06f4e393a6466a442e4e0f70d6988c2cd455839b8f2eb2fc47e3fe12707f130b522a6a033092c85acf2c8150d9db5d7cc2114909deeb4f805fd8d7a2ba2bcedf040c2a2decb7b656e5a8138c61a3854dfefe61a84b777e0fb671139ce927343c7df599af80e5ed42ab6037ab33927fb4e28d1859905542a27700ae8d35e9b90bb8e53b0d8537bff0a7f86dcd260f446cfe57bc156b378787710ca87a4321418f4464a85475e85772637245f0b81fe271d36a1bab0d0f067dcc291bf7e95cf5c3352c3875b95f3ac47aaea8e6dede4ac53331fafcca0e6680db9f7ec3a5289a022eebf23655d981636558dac5060d804a5602602a669b82c623da3a5dab108ba7c6b3a3158469f0bc8264faef2b1595084d72d83a3dc52e06293316e993a3484ab283fc620989e99f2a2fe7d561305f68493f46a0a651606ff905d782f91797247c5ca432d5931e479483bd59f47fcc7cd52ef6ee5774316495f953e3b14e218617ceac242b191d1bc878024d9ef6d94087a6125b4ed6d6347c48e96ae65cd1b8c21b141345d798a0649c6bb6d16a2f7073ff3fc77f20b00c5f5d3b25da74d1c7590f822a6df3b8799b573551aad7c302b3b9265a2f699e0fb85b33817a83baef2d00064f87a02a0fe8ffa742a3a152ac246f1912de1f94c3a9a15cca582f6b47d295a80ede3d4acead69e59280e6b90cb332656b2959e2c87dd047f24bca589036d7de5892ec0c4f858d482dded913591a18d50ef5c3194ac4e3f8ac31d0fe6fa0608ff0f3bbb40fdc5e9a4361e1d24232b2e1249740f1df1a3b18e6e3edd4e489bc1e5f92e99396fcfdb9d176b8f485401dd26b3c5adb2d445aa9c09675aad371b8b2ad24b1b85fb2a56a3a8c3d7b05eb9b5a3b52ee05650fb68a72bcb1f22b7ae1b952ee073195510d99c33633c9a3da1b14e30e9567e8894c4f15d2a049238cae2d1c8f3577a5a472e9acc96fc2c0c5baa7cd91dc036efabee42e78df1441085d68b7400cbc496fe0066713ea489d7c455996a4ca42a100878cdd2c5cad0b916f7cae5a9e104ccc077e72c9ac8c699f8ebb033655b4bbdb55d438c3c2760d616b96db4370cc563ab3c100023e4c2c0a5272db579959d8789175217ad4ac5885429e8e6e309793e97ddad78a7c9631a19b6d59ff6a4c9f9f5b123f6c0be4012e34f946fe18b46737f5001ef474382af6f9e684eb25afb761274b54e20250cb48f32356c53d076d824f39d4e62b8df85649f2f06242c7e182d98efdddc4782d89d80d53b53c7d3f84e79bebb30c1a4b6ab1825fb44e672a9b388092dacd6836007e4dea761cdcfc7c36963395af1d2e42838c7480b0aa1d9f08569afafae5da8f61eed2e6bef7cbd6fcfc7315522f9be72ab8b79e16312882594aecc3f5a31aa88068af6e4d6ab73d6c4"}}}, &(0x7f00000000c0), 0x1000)

00:18:51 executing program 7:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684fd2981c8409820000080000000000000000"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x100d}], 0x10, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

[ 2820.794736] loop6: detected capacity change from 0 to 40
[ 2820.804092] FAT-fs (loop3): bogus number of reserved sectors
[ 2820.804483] FAT-fs (loop3): Can't find a valid FAT filesystem
00:18:51 executing program 0:
perf_event_open(&(0x7f0000000080)={0x0, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r1, &(0x7f0000000100), 0x0, 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r0, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r2, 0x5c800, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0x0, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r1, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

[ 2820.834092] syz-executor.5: attempt to access beyond end of device
[ 2820.834092] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2820.835685] Buffer I/O error on dev loop5, logical block 10, lost async page write
[ 2820.858599] loop4: detected capacity change from 0 to 40
[ 2820.873557] syz-executor.6: attempt to access beyond end of device
[ 2820.873557] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2820.874524] Buffer I/O error on dev loop6, logical block 10, lost async page write
[ 2821.002657] syz-executor.4: attempt to access beyond end of device
[ 2821.002657] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2821.004308] Buffer I/O error on dev loop4, logical block 10, lost async page write
00:19:08 executing program 7:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684fd2981c8409820000080000000000000000"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x100d}], 0x500, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:19:08 executing program 2:
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}}, 0x0, 0x6, 0xffffffffffffffff, 0xb)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
r1 = gettid()
rt_sigqueueinfo(0x0, 0x0, 0x0)
r2 = pidfd_getfd(0xffffffffffffffff, r0, 0x0)
perf_event_open(&(0x7f0000000040)={0x5, 0x80, 0x40, 0x71, 0x2, 0x0, 0x0, 0x8000, 0x20, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, @perf_config_ext={0xff}, 0x0, 0x9b5, 0xfa, 0xd, 0x0, 0x8000, 0x55, 0x0, 0x0, 0x0, 0x3ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000400)={0x2, 0x80, 0x2a, 0x81, 0xe0, 0x40, 0x0, 0x63c5ef1c, 0x80, 0x3, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x7, 0x2, @perf_config_ext={0xf2, 0x6}, 0x0, 0x5, 0xfffffff8, 0x0, 0x1, 0x0, 0x1b6, 0x0, 0x6}, 0x0, 0xd, 0xffffffffffffffff, 0x0)
rt_sigqueueinfo(0x0, 0x0, &(0x7f0000000000))
setsockopt$sock_timeval(r0, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10)
bind$packet(r2, &(0x7f00000000c0)={0x11, 0xfe, 0x0, 0x1, 0xfb, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}}, 0x14)
perf_event_open(&(0x7f0000000100)={0x0, 0x80, 0xff, 0x8, 0x4, 0x1, 0x0, 0x4, 0x684, 0x4, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0xdbc, 0x0, @perf_config_ext={0xd03, 0x80000000}, 0x800, 0x3, 0x3, 0x0, 0x300000000000000, 0x7, 0x7ff, 0x0, 0x0, 0x0, 0x5}, r1, 0x10, 0xffffffffffffffff, 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r3, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
openat(r3, &(0x7f0000000180)='\x00', 0x400040, 0x80)
rt_sigqueueinfo(0x0, 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f0000000240)={'ip6_vti0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x4, 0x0, 0x7f, 0x40, 0xb, @local, @mcast1, 0x88, 0x20, 0x8, 0x2}})

00:19:08 executing program 0:
perf_event_open(&(0x7f0000000080)={0x0, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r1, &(0x7f0000000100), 0x0, 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r0, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r2, 0x5d000, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0x0, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r1, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:19:08 executing program 6:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 79)

00:19:08 executing program 3:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r0, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)

00:19:08 executing program 1:
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}}, 0x0, 0x6, 0xffffffffffffffff, 0xb)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
r1 = gettid()
rt_sigqueueinfo(0x0, 0x0, 0x0)
r2 = pidfd_getfd(0xffffffffffffffff, r0, 0x0)
perf_event_open(&(0x7f0000000040)={0x5, 0x80, 0x40, 0x71, 0x2, 0x0, 0x0, 0x8000, 0x20, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, @perf_config_ext={0xff}, 0x0, 0x9b5, 0xfa, 0xd, 0x0, 0x8000, 0x55, 0x0, 0x0, 0x0, 0x3ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000400)={0x2, 0x80, 0x2a, 0x81, 0xe0, 0x40, 0x0, 0x63c5ef1c, 0x80, 0x3, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x7, 0x2, @perf_config_ext={0xf2, 0x6}, 0x0, 0x5, 0xfffffff8, 0x0, 0x1, 0x0, 0x1b6, 0x0, 0x6}, 0x0, 0xd, 0xffffffffffffffff, 0x0)
rt_sigqueueinfo(0x0, 0x0, &(0x7f0000000000))
setsockopt$sock_timeval(r0, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10)
bind$packet(r2, &(0x7f00000000c0)={0x11, 0xfe, 0x0, 0x1, 0xfb, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}}, 0x14)
perf_event_open(&(0x7f0000000100)={0x0, 0x80, 0xff, 0x8, 0x4, 0x1, 0x0, 0x4, 0x684, 0x4, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0xdbc, 0x0, @perf_config_ext={0xd03, 0x80000000}, 0x800, 0x3, 0x3, 0x5, 0x0, 0x7, 0x7ff, 0x0, 0x0, 0x0, 0x5}, r1, 0x10, 0xffffffffffffffff, 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r3, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
openat(r3, &(0x7f0000000180)='\x00', 0x400040, 0x80)
rt_sigqueueinfo(0x0, 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f0000000240)={'ip6_vti0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x4, 0x0, 0x7f, 0x40, 0xb, @local, @mcast1, 0x88, 0x20, 0x8, 0x2}})

00:19:08 executing program 5:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 81)

00:19:08 executing program 4:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_mount_image$tmpfs(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
creat(&(0x7f0000000000)='./file1\x00', 0x100)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef)

[ 2838.098596] loop4: detected capacity change from 0 to 40
[ 2838.120155] loop5: detected capacity change from 0 to 40
[ 2838.132714] loop3: detected capacity change from 0 to 40
[ 2838.135517] syz-executor.4: attempt to access beyond end of device
[ 2838.135517] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2838.136408] Buffer I/O error on dev loop4, logical block 10, lost async page write
[ 2838.138490] loop6: detected capacity change from 0 to 40
[ 2838.153625] syz-executor.4: attempt to access beyond end of device
[ 2838.153625] loop4: rw=2049, sector=44, nr_sectors = 4 limit=40
00:19:08 executing program 0:
perf_event_open(&(0x7f0000000080)={0x0, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r1, &(0x7f0000000100), 0x0, 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r0, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r2, 0x5d800, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0x0, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r1, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

[ 2838.163357] FAT-fs (loop3): bogus number of reserved sectors
[ 2838.164313] FAT-fs (loop3): Can't find a valid FAT filesystem
[ 2838.219487] syz-executor.5: attempt to access beyond end of device
[ 2838.219487] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2838.220495] Buffer I/O error on dev loop5, logical block 10, lost async page write
[ 2838.224859] syz-executor.6: attempt to access beyond end of device
[ 2838.224859] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2838.225772] Buffer I/O error on dev loop6, logical block 10, lost async page write
00:19:08 executing program 4:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_mount_image$tmpfs(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef)
r2 = openat$loop_ctrl(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$LOOP_CTL_REMOVE(r2, 0x4c81, 0x0)
r3 = perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000500)=ANY=[@ANYBLOB="010000000100000018000000", @ANYRES32=<r4=>r3, @ANYBLOB="00000000000000002ed9aeaff9b7f1164083cb1f9bed3f8f5e3000000000c100"])
ioctl$AUTOFS_DEV_IOCTL_READY(r4, 0xc0189376, &(0x7f0000000040)={{0x1, 0x1, 0x18, r2, {0x4f95}}, './file0\x00'})
ioctl$AUTOFS_DEV_IOCTL_EXPIRE(r1, 0xc018937c, &(0x7f0000000000)={{0x1, 0x1, 0x18, r2, {0x2}}, './file2\x00'})

00:19:08 executing program 6:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 80)

00:19:08 executing program 5:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 82)

[ 2838.349523] loop4: detected capacity change from 0 to 40
00:19:08 executing program 3:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r0, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)

[ 2838.405530] syz-executor.4: attempt to access beyond end of device
[ 2838.405530] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2838.406534] Buffer I/O error on dev loop4, logical block 10, lost async page write
00:19:09 executing program 0:
perf_event_open(&(0x7f0000000080)={0x0, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r1, &(0x7f0000000100), 0x0, 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r0, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r2, 0x5e000, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0x0, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r1, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

[ 2838.420801] loop3: detected capacity change from 0 to 40
[ 2838.427814] syz-executor.4: attempt to access beyond end of device
[ 2838.427814] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2838.428776] Buffer I/O error on dev loop4, logical block 10, lost async page write
[ 2838.430514] FAT-fs (loop3): bogus number of reserved sectors
[ 2838.430938] FAT-fs (loop3): Can't find a valid FAT filesystem
[ 2838.457519] loop6: detected capacity change from 0 to 40
00:19:09 executing program 1:
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}}, 0x0, 0x6, 0xffffffffffffffff, 0xb)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
r1 = gettid()
rt_sigqueueinfo(0x0, 0x0, 0x0)
r2 = pidfd_getfd(0xffffffffffffffff, r0, 0x0)
perf_event_open(&(0x7f0000000040)={0x5, 0x80, 0x40, 0x71, 0x2, 0x0, 0x0, 0x8000, 0x20, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, @perf_config_ext={0xff}, 0x0, 0x9b5, 0xfa, 0xd, 0x0, 0x8000, 0x55, 0x0, 0x0, 0x0, 0x3ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000400)={0x2, 0x80, 0x2a, 0x81, 0xe0, 0x40, 0x0, 0x63c5ef1c, 0x80, 0x3, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x7, 0x2, @perf_config_ext={0xf2, 0x6}, 0x0, 0x5, 0xfffffff8, 0x0, 0x1, 0x0, 0x1b6, 0x0, 0x6}, 0x0, 0xd, 0xffffffffffffffff, 0x0)
rt_sigqueueinfo(0x0, 0x0, &(0x7f0000000000))
setsockopt$sock_timeval(r0, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10)
bind$packet(r2, &(0x7f00000000c0)={0x11, 0xfe, 0x0, 0x1, 0xfb, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}}, 0x14)
perf_event_open(&(0x7f0000000100)={0x0, 0x80, 0xff, 0x8, 0x4, 0x1, 0x0, 0x4, 0x684, 0x4, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0xdbc, 0x0, @perf_config_ext={0xd03, 0x80000000}, 0x800, 0x3, 0x3, 0x5, 0x0, 0x7, 0x7ff, 0x0, 0x0, 0x0, 0x5}, r1, 0x10, 0xffffffffffffffff, 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r3, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
openat(r3, &(0x7f0000000180)='\x00', 0x400040, 0x80)
rt_sigqueueinfo(0x0, 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f0000000240)={'ip6_vti0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x4, 0x0, 0x7f, 0x40, 0xb, @local, @mcast1, 0x88, 0x20, 0x8, 0x2}})

00:19:09 executing program 4:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17, 0x10000000000}, {0x0, 0x0, 0x27ff}], 0x410, &(0x7f0000000040)=ANY=[@ANYRES64, @ANYRESOCT, @ANYRESDEC])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = creat(&(0x7f0000000000)='./file0\x00', 0x45)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_mount_image$tmpfs(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
fsmount(r0, 0x0, 0x26bc743fd1d394b1)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r2, r1, 0x0, 0xfffffdef)

[ 2838.533688] syz-executor.6: attempt to access beyond end of device
[ 2838.533688] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2838.534748] Buffer I/O error on dev loop6, logical block 10, lost async page write
[ 2838.555832] loop5: detected capacity change from 0 to 40
[ 2838.619818] loop4: detected capacity change from 0 to 262144
[ 2838.621508] FAT-fs (loop4): Unrecognized mount option "��������0177777777777777777777718446744073709551615" or missing value
[ 2838.678941] syz-executor.5: attempt to access beyond end of device
[ 2838.678941] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2838.679858] Buffer I/O error on dev loop5, logical block 10, lost async page write
[ 2839.455737] loop4: detected capacity change from 0 to 262144
[ 2839.465402] FAT-fs (loop4): Unrecognized mount option "��������0177777777777777777777718446744073709551615" or missing value
00:19:28 executing program 3:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r0, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)

00:19:28 executing program 0:
perf_event_open(&(0x7f0000000080)={0x0, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r1, &(0x7f0000000100), 0x0, 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r0, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r2, 0x5e800, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0x0, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r1, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:19:28 executing program 2:
perf_event_open(&(0x7f0000000080)={0x0, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r1, &(0x7f0000000100), 0x0, 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r0, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r2, 0x5d800, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0x0, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r1, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:19:28 executing program 7:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684fd2981c8409820000080000000000000000"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x100d}], 0x5a1, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:19:28 executing program 4:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_mount_image$tmpfs(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
mknod$loop(&(0x7f0000000000)='./file0\x00', 0x40, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef)

00:19:28 executing program 5:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 83)

00:19:28 executing program 1:
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}}, 0x0, 0x6, 0xffffffffffffffff, 0xb)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
r1 = gettid()
rt_sigqueueinfo(0x0, 0x0, 0x0)
r2 = pidfd_getfd(0xffffffffffffffff, r0, 0x0)
perf_event_open(&(0x7f0000000040)={0x5, 0x80, 0x40, 0x71, 0x2, 0x0, 0x0, 0x8000, 0x20, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, @perf_config_ext={0xff}, 0x0, 0x9b5, 0xfa, 0xd, 0x0, 0x8000, 0x55, 0x0, 0x0, 0x0, 0x3ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000400)={0x2, 0x80, 0x2a, 0x81, 0xe0, 0x40, 0x0, 0x63c5ef1c, 0x80, 0x3, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x7, 0x2, @perf_config_ext={0xf2, 0x6}, 0x0, 0x5, 0xfffffff8, 0x0, 0x1, 0x0, 0x1b6, 0x0, 0x6}, 0x0, 0xd, 0xffffffffffffffff, 0x0)
rt_sigqueueinfo(0x0, 0x0, &(0x7f0000000000))
setsockopt$sock_timeval(r0, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10)
bind$packet(r2, &(0x7f00000000c0)={0x11, 0xfe, 0x0, 0x1, 0xfb, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}}, 0x14)
perf_event_open(&(0x7f0000000100)={0x0, 0x80, 0xff, 0x8, 0x4, 0x1, 0x0, 0x4, 0x684, 0x4, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0xdbc, 0x0, @perf_config_ext={0xd03, 0x80000000}, 0x800, 0x3, 0x3, 0x5, 0x0, 0x7, 0x7ff, 0x0, 0x0, 0x0, 0x5}, r1, 0x10, 0xffffffffffffffff, 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r3, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
openat(r3, &(0x7f0000000180)='\x00', 0x400040, 0x80)
rt_sigqueueinfo(0x0, 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f0000000240)={'ip6_vti0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x4, 0x0, 0x7f, 0x40, 0xb, @local, @mcast1, 0x88, 0x20, 0x8, 0x2}})

00:19:28 executing program 6:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 81)

[ 2857.561500] loop3: detected capacity change from 0 to 40
[ 2857.565916] loop6: detected capacity change from 0 to 40
[ 2857.573786] loop5: detected capacity change from 0 to 40
[ 2857.583827] FAT-fs (loop3): bogus number of reserved sectors
[ 2857.584957] FAT-fs (loop3): Can't find a valid FAT filesystem
[ 2857.588784] loop4: detected capacity change from 0 to 40
[ 2857.654251] syz-executor.6: attempt to access beyond end of device
[ 2857.654251] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2857.655618] Buffer I/O error on dev loop6, logical block 10, lost async page write
[ 2857.702094] syz-executor.5: attempt to access beyond end of device
[ 2857.702094] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2857.703715] Buffer I/O error on dev loop5, logical block 10, lost async page write
[ 2857.755464] syz-executor.4: attempt to access beyond end of device
[ 2857.755464] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2857.757273] Buffer I/O error on dev loop4, logical block 10, lost async page write
00:19:28 executing program 2:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_mount_image$tmpfs(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
creat(&(0x7f0000000000)='./file1\x00', 0x100)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef)

00:19:28 executing program 0:
perf_event_open(&(0x7f0000000080)={0x0, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r1, &(0x7f0000000100), 0x0, 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r0, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r2, 0x5f000, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0x0, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r1, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:19:28 executing program 6:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 82)

[ 2857.870512] loop2: detected capacity change from 0 to 40
[ 2857.895798] loop6: detected capacity change from 0 to 40
[ 2857.925903] syz-executor.2: attempt to access beyond end of device
[ 2857.925903] loop2: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2857.927215] Buffer I/O error on dev loop2, logical block 10, lost async page write
[ 2857.941889] syz-executor.6: attempt to access beyond end of device
[ 2857.941889] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2857.943179] Buffer I/O error on dev loop6, logical block 10, lost async page write
00:19:42 executing program 6:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 83)

00:19:42 executing program 2:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_mount_image$tmpfs(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
creat(&(0x7f0000000000)='./file1\x00', 0x100)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef)

00:19:42 executing program 3:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{0x0}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r0, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)

00:19:42 executing program 4:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r1 = openat(r0, &(0x7f0000000000)='./file0\x00', 0x200680, 0x176d4eb8349760ff)
syz_mount_image$tmpfs(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000500)=ANY=[@ANYBLOB="010000000100000018000000", @ANYRES32=r3, @ANYBLOB="00000000000000002ed9aeaff9b7f1164083cb1f9bed3f8f5e3000000000c100"])
write$binfmt_aout(r2, &(0x7f00000000c0)=ANY=[@ANYRESHEX=0x0, @ANYRESHEX=r2], 0x220)
ioctl$RTC_PIE_ON(r1, 0x7005)
sendfile(r2, r0, 0x0, 0xfffffdef)

00:19:42 executing program 1:
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}}, 0x0, 0x6, 0xffffffffffffffff, 0xb)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
r1 = gettid()
rt_sigqueueinfo(0x0, 0x0, 0x0)
r2 = pidfd_getfd(0xffffffffffffffff, r0, 0x0)
perf_event_open(&(0x7f0000000040)={0x5, 0x80, 0x40, 0x71, 0x2, 0x0, 0x0, 0x8000, 0x20, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, @perf_config_ext={0xff}, 0x0, 0x9b5, 0xfa, 0xd, 0x0, 0x8000, 0x55, 0x0, 0x0, 0x0, 0x3ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000400)={0x2, 0x80, 0x2a, 0x81, 0xe0, 0x40, 0x0, 0x63c5ef1c, 0x80, 0x3, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x7, 0x2, @perf_config_ext={0xf2, 0x6}, 0x0, 0x5, 0xfffffff8, 0x0, 0x1, 0x0, 0x1b6, 0x0, 0x6}, 0x0, 0xd, 0xffffffffffffffff, 0x0)
rt_sigqueueinfo(0x0, 0x0, &(0x7f0000000000))
setsockopt$sock_timeval(r0, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10)
bind$packet(r2, &(0x7f00000000c0)={0x11, 0xfe, 0x0, 0x1, 0xfb, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}}, 0x14)
perf_event_open(&(0x7f0000000100)={0x0, 0x80, 0xff, 0x8, 0x4, 0x1, 0x0, 0x4, 0x684, 0x4, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0xdbc, 0x0, @perf_config_ext={0xd03, 0x80000000}, 0x800, 0x3, 0x3, 0x5, 0x300000000000000, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x5}, r1, 0x10, 0xffffffffffffffff, 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r3, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
openat(r3, &(0x7f0000000180)='\x00', 0x400040, 0x80)
rt_sigqueueinfo(0x0, 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f0000000240)={'ip6_vti0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x4, 0x0, 0x7f, 0x40, 0xb, @local, @mcast1, 0x88, 0x20, 0x8, 0x2}})

00:19:42 executing program 5:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 84)

00:19:42 executing program 7:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684fd2981c8409820000080000000000000000"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x100d}], 0x5ab, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:19:42 executing program 0:
perf_event_open(&(0x7f0000000080)={0x0, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r1, &(0x7f0000000100), 0x0, 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r0, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r2, 0x5f800, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0x0, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r1, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

[ 2872.345919] loop3: detected capacity change from 0 to 40
[ 2872.348190] FAT-fs (loop3): bogus number of reserved sectors
[ 2872.348644] FAT-fs (loop3): Can't find a valid FAT filesystem
[ 2872.368149] loop6: detected capacity change from 0 to 40
00:19:43 executing program 0:
perf_event_open(&(0x7f0000000080)={0x0, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r1, &(0x7f0000000100), 0x0, 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r0, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r2, 0x60000, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0x0, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r1, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

[ 2872.409838] loop5: detected capacity change from 0 to 40
[ 2872.410796] loop4: detected capacity change from 0 to 40
[ 2872.417183] loop2: detected capacity change from 0 to 40
[ 2872.448277] syz-executor.6: attempt to access beyond end of device
[ 2872.448277] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2872.449206] Buffer I/O error on dev loop6, logical block 10, lost async page write
00:19:43 executing program 7:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684fd2981c8409820000080000000000000000"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x100d}], 0x5b1, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

[ 2872.509362] syz-executor.5: attempt to access beyond end of device
[ 2872.509362] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2872.510314] Buffer I/O error on dev loop5, logical block 10, lost async page write
00:19:43 executing program 6:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 84)

00:19:43 executing program 3:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{0x0}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r0, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)

00:19:43 executing program 1:
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}}, 0x0, 0x6, 0xffffffffffffffff, 0xb)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
r1 = gettid()
rt_sigqueueinfo(0x0, 0x0, 0x0)
r2 = pidfd_getfd(0xffffffffffffffff, r0, 0x0)
perf_event_open(&(0x7f0000000040)={0x5, 0x80, 0x40, 0x71, 0x2, 0x0, 0x0, 0x8000, 0x20, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, @perf_config_ext={0xff}, 0x0, 0x9b5, 0xfa, 0xd, 0x0, 0x8000, 0x55, 0x0, 0x0, 0x0, 0x3ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000400)={0x2, 0x80, 0x2a, 0x81, 0xe0, 0x40, 0x0, 0x63c5ef1c, 0x80, 0x3, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x7, 0x2, @perf_config_ext={0xf2, 0x6}, 0x0, 0x5, 0xfffffff8, 0x0, 0x1, 0x0, 0x1b6, 0x0, 0x6}, 0x0, 0xd, 0xffffffffffffffff, 0x0)
rt_sigqueueinfo(0x0, 0x0, &(0x7f0000000000))
setsockopt$sock_timeval(r0, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10)
bind$packet(r2, &(0x7f00000000c0)={0x11, 0xfe, 0x0, 0x1, 0xfb, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}}, 0x14)
perf_event_open(&(0x7f0000000100)={0x0, 0x80, 0xff, 0x8, 0x4, 0x1, 0x0, 0x4, 0x684, 0x4, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0xdbc, 0x0, @perf_config_ext={0xd03, 0x80000000}, 0x800, 0x3, 0x3, 0x5, 0x300000000000000, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x5}, r1, 0x10, 0xffffffffffffffff, 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r3, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
openat(r3, &(0x7f0000000180)='\x00', 0x400040, 0x80)
rt_sigqueueinfo(0x0, 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f0000000240)={'ip6_vti0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x4, 0x0, 0x7f, 0x40, 0xb, @local, @mcast1, 0x88, 0x20, 0x8, 0x2}})

[ 2872.577218] syz-executor.2: attempt to access beyond end of device
[ 2872.577218] loop2: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2872.579025] Buffer I/O error on dev loop2, logical block 10, lost async page write
[ 2872.636337] loop6: detected capacity change from 0 to 40
[ 2872.690369] loop3: detected capacity change from 0 to 40
[ 2872.700380] syz-executor.6: attempt to access beyond end of device
[ 2872.700380] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2872.701357] Buffer I/O error on dev loop6, logical block 10, lost async page write
[ 2872.713452] FAT-fs (loop3): bogus number of reserved sectors
[ 2872.714315] FAT-fs (loop3): Can't find a valid FAT filesystem
[ 2872.716745] syz-executor.4: attempt to access beyond end of device
[ 2872.716745] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2872.718067] Buffer I/O error on dev loop4, logical block 10, lost async page write
[ 2872.757643] syz-executor.4: attempt to access beyond end of device
[ 2872.757643] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2872.758777] Buffer I/O error on dev loop4, logical block 10, lost async page write
[ 2887.050038] loop6: detected capacity change from 0 to 40
00:19:57 executing program 5:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 85)

00:19:57 executing program 1:
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}}, 0x0, 0x6, 0xffffffffffffffff, 0xb)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
r1 = gettid()
rt_sigqueueinfo(0x0, 0x0, 0x0)
r2 = pidfd_getfd(0xffffffffffffffff, r0, 0x0)
perf_event_open(&(0x7f0000000040)={0x5, 0x80, 0x40, 0x71, 0x2, 0x0, 0x0, 0x8000, 0x20, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, @perf_config_ext={0xff}, 0x0, 0x9b5, 0xfa, 0xd, 0x0, 0x8000, 0x55, 0x0, 0x0, 0x0, 0x3ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000400)={0x2, 0x80, 0x2a, 0x81, 0xe0, 0x40, 0x0, 0x63c5ef1c, 0x80, 0x3, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x7, 0x2, @perf_config_ext={0xf2, 0x6}, 0x0, 0x5, 0xfffffff8, 0x0, 0x1, 0x0, 0x1b6, 0x0, 0x6}, 0x0, 0xd, 0xffffffffffffffff, 0x0)
rt_sigqueueinfo(0x0, 0x0, &(0x7f0000000000))
setsockopt$sock_timeval(r0, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10)
bind$packet(r2, &(0x7f00000000c0)={0x11, 0xfe, 0x0, 0x1, 0xfb, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}}, 0x14)
perf_event_open(&(0x7f0000000100)={0x0, 0x80, 0xff, 0x8, 0x4, 0x1, 0x0, 0x4, 0x684, 0x4, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0xdbc, 0x0, @perf_config_ext={0xd03, 0x80000000}, 0x800, 0x3, 0x3, 0x5, 0x300000000000000, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x5}, r1, 0x10, 0xffffffffffffffff, 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r3, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
openat(r3, &(0x7f0000000180)='\x00', 0x400040, 0x80)
rt_sigqueueinfo(0x0, 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f0000000240)={'ip6_vti0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x4, 0x0, 0x7f, 0x40, 0xb, @local, @mcast1, 0x88, 0x20, 0x8, 0x2}})

00:19:57 executing program 4:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_mount_image$tmpfs(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
r2 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000040)='./file0\x00', 0x7b, 0x5, &(0x7f0000000180)=[{&(0x7f0000000240)="ab742f2fdc170c7d5b10762090f975b690e2d0a1c6cb196cadea23723d4ab8a0808c1f833990788537ed13562c9bd22a9f84a982c8dc11533dbb529a2570cd04a70d06613b8610f7989e1f6699adf184139ae54f584db2806bb3ba6a4674babb72273c04f5b6e711373dd898cb7d167823ec1b6f381e72696b3470efa4ffad54f1cf550a1699b7d941496f847d", 0x8d, 0x4}, {&(0x7f0000000300)="7952a5ec7766ccfc5ddfbc93279c3fc4113bc6f648a256544af9a71e2bb17e46bf26df4113fb8ae32e6b58de4c8ba54650ebeb64c86529976d1a626b3e425e3e49929b85cae9b67bab7f10df27961224c882ce588a1b09168e5a314851232b0f612451dde934e902e4e8e8b11c9d51a3f055a759df47bd3b6a948cd1acf7a2ba5110cfca7121772488ffe78b1d659ffec80f655548ae433abf0aff66bd178270eb9f3a84f7363325697127004d3c66e22d0730cad8c1a529cc8640f40755208c049d3c803ef6ed7046be14f7bade7f07fa9c64985cf14cf6a12b9e3ce8cb066f5dbac697ada7fe87650fb72ba5b9baa58563ec0af25146", 0xf7, 0x1}, {&(0x7f00000000c0)="b249", 0x2, 0x9}, {&(0x7f0000000400)="d57ed9871ea07c89bc7b3ff8a04878219253482048ed3fd30fcf37651f2971241fe1d6a2cf171f7f4559a04b038efde570f46e1ac1f3554cc9567eb61158afb7a5d5ba1cf06eaa5cbc433df057d8be76c9d5dcaed06d5398cfd18f054d68767b4493f5a4a70761edee6bdee80e047475fffeb3468f2ced9b373426346b8c6397e2691e02ef1e610a6528161c6451d1b70acb3506bae720224e4be20c92663452238656e5fb47f624cd64719ad7c42a9931fda76853922a4fed63ddd76d6cc23980725414eb683684fda3111a9891b4167d69bc75a5d98b8045d21409118280638a415acc1fc8074f3f00d640fd84c1fd2a23373956b04f3b828196b72ac644ec6c83c6f373592763eed01e45eb0d0826ce82705e9bb986cbe1092dbf645403e267060e03926f2943c9c6b6489c5c010af09cf74ec6bb338eb863cc09b738ffec8a6fa2c30c90486063630d58f75bc834340c2a7d0324fba2d50fe82a67bea4bad3a89270d66cac18aa0b97854defbfcbc63d3a14cf5985a7ad154b1ffc098e58a36a5691931bd233eb23208afcd1b6fb04fccc8a41327c9f53f8c39ce64d074d6289dc152d50f944ebd11a3a97ae6f4be07eb79f361f730685f2b54e830cae2d7d1ae55884f0e4ce40430a37b7b429fda314fe26c0e30bf1d50d72db8cba08d89f7d5048930a79894855376a51c0c5ba239541c189364b773bdf3a5a3833b8e6679c4a3887931731698ab16190ec6b6eb8f2c3bbfac87ab3688b0d9f83e2fa796d8d9767187a398dc67e6dc51c55a0f98492a54aeb5e7699a1848c4ef6435a8970005323f47f75d8131c4fd6fb087e11e6793beee40e42926eb0b77c41b7909db30e94491e7fadb81d14088972dfdf370e1bc9da5d1540bce8e170b7aebf14dead9ce0092befd9cb004d604eaef9eeff4c12841784e9689c896ad931e3ac895bd1be19bdf8eb8e39e391e81b74a5c4d1233f38ac8281e9c9157ad667a30e29b3ded5225ea6970c627163dbc453f781ad2b30607585718c1b03667776c31b4c0b66c217ee4422ed711aec2ad72d5e7113a4d5830b2fb32dc8d52b62cad08512e841797a3c09805a19dcac79111f62cceae40e049ecbb2e3049446621fcd5225ebe00d07af23314d775679a5a53137f977e22a023c41a3fa7e5fda877f489db92b3bde5fc413f3adb69977c489d3b74185aca83aaad343bbf859aad37a9c40f5ea94ad6caf480b7230628df5a3894add5e1f236c2f02a54b8fc14bd46cdd76c2463e1c1f5b4a86590a829e290c13b0c9047ba5eba6c55f7d912ecd571886ade6796feed691a8cd49cb0097c2d08dace0be67fb3c1ce1f48e6449ccbb4fd91960987ab5af0e192f9a93d4adff245663daf0f118e9f2b82c3fba77bc83d7cde250251882c2f49158a5773f23f0734779165008334d5920c1c24169dd89112535abd49d80eab15b29f81899ef65f97940d0f366f818b05b7c87df0b92fbfd1dcd904904ca66898eaf8123479f7d19d4f64fc900df33c8932f222385c85532603a1098f433729647bb2d43d49745d83f0d57dcc07ca0e9fb5e6be896d3d1fcbd8b9ea821f6e1c13dea7524830b0b646608aeaddd58686677c2bedabb702d788583c34bebb68b84a93c32110d2e11f1c27e7046d9e3670ab9c11ffa8e0fed20506d393904cec8e0253b3791ae7ea3522005bfccf2abddba9fea60b87bb71304881d4993ccfb455b9b8eacac7851552e2fb9506eb444900c245aeb82754564aee36a42878cd22115e191f74007d80b31d1bce19d389d9a47ddf9f52fe11855d41fd0d4e70e22f04544affba5d251f9feb6e906ce13d52d6d3245f20d9270560908a3f3afc88857be4868def843e7564ef59f7bbc7a653fecfa1acb8489bf1541352002b68c17cd78ea81a13c0fb0a08290d14db56d773fa2497483026f3661155e52f599553ab9a9695577479510e5f15f897682b72694ac7420ef0a6be52ad8b68cf38fbbe4088c98c53a145461155eb07efba675eef3cc28a4ba91ec95ae598e7ba9ab2539a87bfe6777b9715399c0d792f3e5e13e799b24e134913b82f8409316f0547a5e5a25c6121bc345715a9d4f667b69b7392b4800e61e6df74dbe32a4f2ff8f8bd39fdb937e646e219f52785fac6ebd2c7878e7755f22250d5ff092dfb835518b0f2e421527c5f5c7a4e9e280008f3ce34a3ed23ad31344718ea1d21816828184c3e4479cccd8c7bb9294ac6ce293e5c7b27a0fea882256b5c6be233145c5933e3d59d144a0920aa87a325cba4b700be9d970ee39acc20a1a99c1c5b73ca6ea3658289acb428c1df1d530da552f455c926eeb1426f03583d9900d03bef0d37a4c1daf235bf64437a9e8fffecf0556f36feead9cbbbae8c0dda9947599c016f0dae7843a8855e88f28316eee67e6576a27c522a3da694f0d8d4350564c753b15dcc200b6869905b79d47e65f4842c4ceade2c5d2e884edd73372eadf2113b1672042bed58432f82c9c093e80b01438d972f3de599cb378f37d0ebfa3e698e6738cf4599e22adf0d0a3b1b211979e8527fc69cacd2d75df41acdba971ffca935c3828a6da61e67f8c96c6bcd18c698536c514d008a2874e4d0c20407817ae6a1fb7e9c85ba0e1c82a2fc1f890e012e2fd30d88437ca39d07422fe4f522d8f337f2dda1fb59d3552955c139778aebe0bbac064c55bdfbd501e8d47de397d49de0ee5e92c347d04e9786a2fdf03a33aac4de08c0aaa3e267acef6bf2a341ed2bbe30b3c66971d5df7f8707d2c2447e67584681989ceae0b5757c68a46cd405c7fada4e06e8bf952b1e51d7234afe0c2f7f23b716f75d776a4709dc81f9cec3cd17fb3b56e5d972399413849d19a5e1cb92655130fe67a3fc4e4c14b63cdfb59c05d121b6edcc0136dea4617ce9635d97ec8b205907d7f563e2c539cf2452787f3ff85568f90e0483825b20778f8d77b344a956370a6c17f5477d954f861c38bf8100965ef648607f570ec5e989f25866c969830d03ebac306d68a2053d74815636e0c5e1b995e902e98190ce0cf52bdcc16ca6cac5989b179c323fee6af8f30408f7da4ab6127b8850bb022f34b1b102fa6c15ff917bca05b9f3f2953104868cdeb8b3a5d4e4bd0312349291ce4808fdda5bd7c2ba044df6812913243e460edd1abdd91b455103a29482cf6659cfc86b9111b90f5947c2ed58b752b76f3a0b33d4410eb95ca6b1cad4d599cc6efa1432f416d60512a187fe376ebccbf6a5b750d940eda4e973c62ceed152f39cab353c3e72334be48461021fa2e966e1b0c71ee5b8bb2bc1717850edc7339fc3b87eb55a0e14b287714cd1f6c979ce79a0c88e2548d5339f4d9b9abf18018d5a976fc656a04e7be8c17fffa737eac027e380bf9f88bf2cef3ebab94aa873c31eb76cd3c60d8d62c480f3ed1db73c27de09ae619043f70470d40083d108ae0cf7219146705a44ead4ee87606912cf19a0af98630e68f8abb9af885cb8b6037b933232b65fec4107128871c445421987b4974b30e0b80dc31c9d69675c42629aaf1a26ba7920fa2ec94136059b6900b2fe2e6db949efb48c4729965a740ba542e192d4c011ed11a95d3f1e6eaa30d83d1e5c15d263a7ed4f76f870f7854f417f10651d1f975ad98a8fca394ba94785cfd7927330068c891c0b79bf8f63f6d62464ede046429cdfa28938dbcf5aba493d5e877596a085550a8c09bad0e58b5693745b7c5af38689c3ab3339d9e6c3ce4e5d1033659788672c47fa084ea418b4d423758b7d3abfe1c6f4e4929d8e7467a81597369ccc2b667660c90486384e2ecbb555bce31ae68af16088d94801665834293fe1125706b94b23455dee6f3f0c491c090661dc9175fc8765eff5b55abb40f0148869a725cdfa9d0b8b6b45d600268ce0641cad8782d36bb7a4f5a99c30dd93a22e2fb2537bb03144d986c09d984564bf3158156fef55f8113f504e6690e657781fb378c582e69e0a3220933cc296851759f02e3b7a9753b4fef21098637fb52f4237dd60662edb937ccdce78bddf8faffe0441cf9bd263ce670836b6ae355e6011b48741562c493af3a094e486b82772ba79ad868a77ac03f7f24f92574d492bac45abd12b6337616028bb39c75ae9924c61e7cac44bb0b90c17f18d8f9684fa946135f5eba3387d358064c2042b50845c909ae0edfdf7bd9b0b4fb20ca86c7de3e23be02a2a4efc23885012e3a2cb98f647c29582920c9345051659ff343cacb8a5ea8bbe552b322f3a9e391dd9f85ce85e672498927b90e89922820dde202b420460948bf3a76c3b760e47a9380f24e8ae89f73e40aec8b532a98fb748f50d124fc10e0ba905707de80651e224188a2e7f9fb9cca57f1fde8762bcc4872dc0583ab83c0e9724bd2c4b4473231299ebe9cb58c79f3f6001a90826df3bbc0ded5947f4064be30c0a18db03dc098fd8333023a1a8faa36b6799ade16d21a5043d452e218ad601702d0b7d31911167b2564b4390856bab3d70ad196030f9aeed5cc252fe60e6dfc56038600ec7b1e4747530d70e059864dc143c804aadff62b2c61b0d15ffeb69f7a29e8086964580f3d8d8d768b5a3c55d88d60a5c1e5140c2ff0e9dc029c1ca9c04e1e91ddb2e22a9b819f365cc52b349cddfadaf05d123612ee9b489dd9af95b801710e7414db333ed0e5cfaeb85fc8c80b44cdc567bc267e0374fa533425185fca72471b5d8c3420b6efee1370a831ee5762342b192e248a0f3d5955db469b0fa8b145d72d3416791dcf5c23b0f7a4ec9b2c5e77550b6b4c81b9c2ec487c074398869a5cf14a06b4f457ea7d36c33f44b5a6741a4b250f7e7e6b8f9348f98bdad983cdab403a6cc5e3d73699c2239c66f2f2c15a510d687049e18b406a4374eaa3e7b922e10894eeb6114129a435a9e3c786f26acfd10549629c8285431d19fdfb4d174c15616d57d3fc893a077877dff94ee22dde38ebc902e74b89428eb36bdb1914423793ad30f60e66894758273a82cd3769d61b31d4e295fe9516f9b307f4e347fb33131b7cdbf849567cb82b6f68b56c2e3e9ba2117cf3a4d1505d4f8b009145fcff9476b6e37f9d537d54ef4cb01cd7e70ea056ffaa1598a9f8c25c53e20146c508b8b3f210f5b0a2df02ffa9993ad965b40f36ca9a64d8a5e2eb6e68a4fb10d80ad5febad6695936d152699397c31f95d0809ad8d8f068ca37c61b4622350b933c8dadb26577662b5da0ea88c250ae9af3b21771498e5af782356f6e2ba63af48c7aab260dff6e043360448e7b2654acdda1e769823551a6e7d5f54b7078c4b203cd54394c9db6123079d49397da64ea6766a542aab514369b1e7b4796cd67f3445a5e4f7e3befa143f665bd3d711d23dc2669795626f575f643ae2ac183bab3881e6285e15276581b64baf6d0f88e26f25e3f7c2cad57470d1b335458711fd1874ed9309ef27fff0da636dceba6532a100cc366a0bf82396f27153e6b41fa8ac9393cd89fe1715dd52d5f394ebdf1a4d83fcba28d58938a5275bb001ba7afee41e74d06b069129104abb37aac71c078953153012ed1bd8d5be9b23405dede7c2104a051c8c603d87369b572a9576025c16017bcf0bfcd4172f9b092390827dbce092c3540a6b10aee26220a9a891d8ffff7c72de0cfebb6813ba4dc14158245f6e455dbc16cb287692719aaf1e59210d8134bd2a4db30ff0bbb54ad166585a425d32c8819e04fd75a37846d3a5827b800adcaa730097c5ae5b8e009a4f694fe2c70141f8a984f9aaaa02776b1b3ed8a848e68c52164d8ba", 0x1000, 0x1}, {&(0x7f0000001400)="5fb61379b5e85fc084fa2ca23a9efe097318db17ea7bc18dc01211f6ffe88abebe3cb9740649c9919761970ca3abd0a5fb0d1e6d9e7688568834541d95b825b8f3bca79bd7af0f427de423b688d6ee8ae4f9c9f9543a63ef5336b40bf16ec00c0be73781cc243be24b366251dcc5ec1d77044b676070fc9bcfbc9774f01c69de745327b2a061ac44", 0x88, 0x1}], 0x800, &(0x7f00000014c0)={[{@shortname_lower}, {@fat=@allow_utime={'allow_utime', 0x3d, 0x40000000000}}, {@shortname_lower}, {@fat=@usefree}], [{@smackfsdef={'smackfsdef', 0x3d, '+!#-&{\\\x9d\xb1-\xf5&}'}}]})
openat(r2, &(0x7f0000001540)='./file1\x00', 0x80000, 0x15)
sendfile(r1, r0, 0x0, 0xfffffdef)

00:19:57 executing program 3:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{0x0}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r0, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)

00:19:57 executing program 6:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 85)

00:19:57 executing program 2:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_mount_image$tmpfs(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
creat(&(0x7f0000000000)='./file1\x00', 0x100)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef)

00:19:57 executing program 7:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684fd2981c8409820000080000000000000000"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x100d}], 0x5b7, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:19:57 executing program 0:
perf_event_open(&(0x7f0000000080)={0x0, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r1, &(0x7f0000000100), 0x0, 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r0, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r2, 0x61000, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0x0, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r1, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

[ 2887.069667] loop4: detected capacity change from 0 to 40
[ 2887.131025] syz-executor.4: attempt to access beyond end of device
[ 2887.131025] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2887.131917] Buffer I/O error on dev loop4, logical block 10, lost async page write
[ 2887.136602] loop3: detected capacity change from 0 to 40
[ 2887.152491] FAT-fs (loop3): bogus number of reserved sectors
[ 2887.152952] FAT-fs (loop3): Can't find a valid FAT filesystem
[ 2887.162164] syz-executor.6: attempt to access beyond end of device
[ 2887.162164] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2887.163293] syz-executor.4: attempt to access beyond end of device
[ 2887.163293] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2887.163927] Buffer I/O error on dev loop6, logical block 10, lost async page write
[ 2887.164595] Buffer I/O error on dev loop4, logical block 10, lost async page write
[ 2887.168705] loop2: detected capacity change from 0 to 40
[ 2887.171306] loop5: detected capacity change from 0 to 40
00:19:57 executing program 1:
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}}, 0x0, 0x6, 0xffffffffffffffff, 0xb)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
r1 = gettid()
rt_sigqueueinfo(0x0, 0x0, 0x0)
r2 = pidfd_getfd(0xffffffffffffffff, r0, 0x0)
perf_event_open(&(0x7f0000000040)={0x5, 0x80, 0x40, 0x71, 0x2, 0x0, 0x0, 0x8000, 0x20, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, @perf_config_ext={0xff}, 0x0, 0x9b5, 0xfa, 0xd, 0x0, 0x8000, 0x55, 0x0, 0x0, 0x0, 0x3ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000400)={0x2, 0x80, 0x2a, 0x81, 0xe0, 0x40, 0x0, 0x63c5ef1c, 0x80, 0x3, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x7, 0x2, @perf_config_ext={0xf2, 0x6}, 0x0, 0x5, 0xfffffff8, 0x0, 0x1, 0x0, 0x1b6, 0x0, 0x6}, 0x0, 0xd, 0xffffffffffffffff, 0x0)
rt_sigqueueinfo(0x0, 0x0, &(0x7f0000000000))
setsockopt$sock_timeval(r0, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10)
bind$packet(r2, &(0x7f00000000c0)={0x11, 0xfe, 0x0, 0x1, 0xfb, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}}, 0x14)
perf_event_open(&(0x7f0000000100)={0x0, 0x80, 0xff, 0x8, 0x4, 0x1, 0x0, 0x4, 0x684, 0x4, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0xdbc, 0x0, @perf_config_ext={0xd03, 0x80000000}, 0x800, 0x3, 0x3, 0x5, 0x300000000000000, 0x7, 0x0, 0x0, 0x0, 0x0, 0x5}, r1, 0x10, 0xffffffffffffffff, 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r3, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
openat(r3, &(0x7f0000000180)='\x00', 0x400040, 0x80)
rt_sigqueueinfo(0x0, 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f0000000240)={'ip6_vti0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x4, 0x0, 0x7f, 0x40, 0xb, @local, @mcast1, 0x88, 0x20, 0x8, 0x2}})

00:19:57 executing program 4:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_mount_image$tmpfs(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r1, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
r2 = openat(r1, &(0x7f0000000100)='./file0\x00', 0x101042, 0x0)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r2, r0, 0x0, 0xfffffdef)

00:19:57 executing program 0:
perf_event_open(&(0x7f0000000080)={0x0, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r1, &(0x7f0000000100), 0x0, 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r0, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r2, 0x61800, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0x0, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r1, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:19:57 executing program 3:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r0, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)

[ 2887.296846] syz-executor.5: attempt to access beyond end of device
[ 2887.296846] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2887.299095] Buffer I/O error on dev loop5, logical block 10, lost async page write
[ 2887.314305] syz-executor.2: attempt to access beyond end of device
[ 2887.314305] loop2: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2887.316080] Buffer I/O error on dev loop2, logical block 10, lost async page write
00:19:57 executing program 6:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 86)

[ 2887.394678] loop4: detected capacity change from 0 to 40
00:19:58 executing program 5:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 86)

[ 2887.420869] loop3: detected capacity change from 0 to 40
[ 2887.436260] FAT-fs (loop3): bogus number of reserved sectors
[ 2887.436720] FAT-fs (loop3): Can't find a valid FAT filesystem
[ 2887.497983] loop6: detected capacity change from 0 to 40
[ 2887.550688] syz-executor.6: attempt to access beyond end of device
[ 2887.550688] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2887.551705] Buffer I/O error on dev loop6, logical block 10, lost async page write
[ 2887.573283] loop5: detected capacity change from 0 to 40
[ 2887.631493] syz-executor.5: attempt to access beyond end of device
[ 2887.631493] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2887.633143] Buffer I/O error on dev loop5, logical block 10, lost async page write
00:20:12 executing program 5:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 87)

00:20:12 executing program 6:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 87)

00:20:12 executing program 3:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r0, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)

00:20:12 executing program 2:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_mount_image$tmpfs(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
creat(&(0x7f0000000000)='./file1\x00', 0x100)
write$binfmt_aout(r0, &(0x7f0000001180)=ANY=[], 0x220)

00:20:12 executing program 4:
r0 = syz_open_dev$tty1(0xc, 0x4, 0x1)
writev(r0, &(0x7f0000000000)=[{&(0x7f0000000140)="02b2dccad213e1e6cf54b7a797f8f22a47f25b7658fb110b2e76f95b0f318b8fa745e6ffba4414d29a42bfab524bc5bffb17decc4540a6f00b9772f5f9789a9525790df8d989b23530d0a1398f2ad734c7ff47961be476ffeec81efa3d3aa64b8ea329261dfc2e1047a68670f0e5950d6a5414956bddd09e101b5b66e5742fe843413e065e3b86a242b37bc58c68153a45015f6f1ea67762c302e461e0c84bbb7f8d464f5a72d9fad56dac0c5028a4012a93dbc7da640786e3c9898cdd8fe091b166bfcd66e6257abc923ceaf90e994deded3fe8a59c2105f5caf366d32170ef51299dbf441bc3cddda352a2e07375fb44e75fed8082f3e960015d9bcddb0c834feda68d113a9a9fc0d1c30153685caf43b176219b666d74e67b6192cfd8a561c6c4aadcc80ed8c469bc41b028f1db515d699e45ad3379f9b1edb8de4bb2f8615d6716297baac7e45073fcecf31e51ec78c40edd78f245bced04414f849fb961fbbe79ff2ed7c48ec1b5331f9755d7094986fc8da198ce4a12f9ddfb43e565bc4fed618da9a693d03c3e7ec4b3014dfc022103e277c1b12efb03ef8b197f3a931f6cbe238cf8a4e7639b409b4586f66da41b94eed69d52ba9fde5aa1ee774d4e626932dc3511b10ae3bc3e8688a7a83b0467dfbf92951747396735c9f47ad4552e7bdf4f8e7998a1266a360beb2ec1527390452139f9ab91ee250efcf3413e72a6b2688d8b6a4748ccc165bbf886573ccdd03bd93f32a866cd878ec246e06f31d4d7f7ec9836b7305ee0c1b9fa75cd6e4ca5cc2f107b654f15a2442cd9c8eaf581d093639fe35e0da49394c5ed66ad29bc2b863649e16c1951d0d3dd6f1048539e558ee1f059d91510a5acd84777ca01545635d2fb40e2f205bb11435023e47e4e2f85b6d1b56b688dd1a4304708a561d32dbaa6cd4f969e67af33773d4e9772751019dc6c2af7e2fe9d3c7eb6f1b401926603d90802f792b081957dd5ebd18410cd42b2ea05ae9a61254e4b878384b8a376fe9eba06afc1253f2224fab88feb7c426e3dfb19385afbb42cc13209b419568eeafdf505dc5ca30acc17d337e941e0badf9f9413f381fe9a315e2597426805827943f193f02a12554d434bd91708a28d9da1bf64ad64f80a7287d1e02d5d1f14bf9d89ba3badfa524694db6a651e97ea64104ad34942f36745259f4ec32fdce0bd13e693ccbe0e012e61a1fae9fc1662b99871e3812cea14d12646ccc08b0514762a475ecdbf9071377bb1ecd891c6fe32fde1d3044caf466b3a342b7541e8ed7432e94baf1d5546aff0e23f6a03c9ea5635519533e712639c27958e3a0f3684ed91cfb2e6e4", 0x3b8}], 0x1)
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x8000000000000000, 0x0, &(0x7f0000000200), 0x40c14, &(0x7f0000000040)=ANY=[@ANYRES16=r0, @ANYRESHEX, @ANYRES64])
chdir(&(0x7f0000000140)='./file0\x00')
ioctl$KDGETLED(r0, 0x4b31, &(0x7f00000000c0))
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
ioctl$EXT4_IOC_SWAP_BOOT(r2, 0x6611)
openat(r2, &(0x7f0000000500)='./file0\x00', 0x8200, 0x2)
syz_mount_image$tmpfs(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r3, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r3, r1, 0x0, 0xfffffdef)
r4 = openat$loop_ctrl(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$LOOP_CTL_REMOVE(r4, 0x4c81, 0x0)
r5 = perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000500)=ANY=[@ANYBLOB="010000000100000018000000", @ANYRES32=<r6=>r5, @ANYBLOB="00000000000000002ed9aeaff9b7f1164083cb1f9bed3f8f5e3000000000c100"])
ioctl$AUTOFS_DEV_IOCTL_READY(r6, 0xc0189376, &(0x7f0000000040)={{0x1, 0x1, 0x18, r4, {0x4f95}}, './file0\x00'})
ioctl$F2FS_IOC_RELEASE_COMPRESS_BLOCKS(r4, 0x8008f512, &(0x7f0000000540))

00:20:12 executing program 7:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684fd2981c8409820000080000000000000000"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x100d}], 0x5c0, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:20:12 executing program 0:
perf_event_open(&(0x7f0000000080)={0x0, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r1, &(0x7f0000000100), 0x0, 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r0, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r2, 0x62000, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0x0, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r1, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

[ 2901.993591] loop2: detected capacity change from 0 to 40
00:20:12 executing program 1:
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}}, 0x0, 0x6, 0xffffffffffffffff, 0xb)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
r1 = gettid()
rt_sigqueueinfo(0x0, 0x0, 0x0)
r2 = pidfd_getfd(0xffffffffffffffff, r0, 0x0)
perf_event_open(&(0x7f0000000040)={0x5, 0x80, 0x40, 0x71, 0x2, 0x0, 0x0, 0x8000, 0x20, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, @perf_config_ext={0xff}, 0x0, 0x9b5, 0xfa, 0xd, 0x0, 0x8000, 0x55, 0x0, 0x0, 0x0, 0x3ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000400)={0x2, 0x80, 0x2a, 0x81, 0xe0, 0x40, 0x0, 0x63c5ef1c, 0x80, 0x3, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x7, 0x2, @perf_config_ext={0xf2, 0x6}, 0x0, 0x5, 0xfffffff8, 0x0, 0x1, 0x0, 0x1b6, 0x0, 0x6}, 0x0, 0xd, 0xffffffffffffffff, 0x0)
rt_sigqueueinfo(0x0, 0x0, &(0x7f0000000000))
setsockopt$sock_timeval(r0, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10)
bind$packet(r2, &(0x7f00000000c0)={0x11, 0xfe, 0x0, 0x1, 0xfb, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}}, 0x14)
perf_event_open(&(0x7f0000000100)={0x0, 0x80, 0xff, 0x8, 0x4, 0x1, 0x0, 0x4, 0x684, 0x4, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0xdbc, 0x0, @perf_config_ext={0xd03, 0x80000000}, 0x800, 0x3, 0x3, 0x5, 0x300000000000000, 0x7, 0x0, 0x0, 0x0, 0x0, 0x5}, r1, 0x10, 0xffffffffffffffff, 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r3, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
openat(r3, &(0x7f0000000180)='\x00', 0x400040, 0x80)
rt_sigqueueinfo(0x0, 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f0000000240)={'ip6_vti0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x4, 0x0, 0x7f, 0x40, 0xb, @local, @mcast1, 0x88, 0x20, 0x8, 0x2}})

[ 2902.017961] loop3: detected capacity change from 0 to 40
[ 2902.021796] loop5: detected capacity change from 0 to 40
[ 2902.021859] loop4: detected capacity change from 0 to 264192
[ 2902.034801] FAT-fs (loop3): bogus number of reserved sectors
[ 2902.035604] FAT-fs (loop3): Can't find a valid FAT filesystem
[ 2902.054037] loop6: detected capacity change from 0 to 40
00:20:12 executing program 1:
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}}, 0x0, 0x6, 0xffffffffffffffff, 0xb)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
r1 = gettid()
rt_sigqueueinfo(0x0, 0x0, 0x0)
r2 = pidfd_getfd(0xffffffffffffffff, r0, 0x0)
perf_event_open(&(0x7f0000000040)={0x5, 0x80, 0x40, 0x71, 0x2, 0x0, 0x0, 0x8000, 0x20, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, @perf_config_ext={0xff}, 0x0, 0x9b5, 0xfa, 0xd, 0x0, 0x8000, 0x55, 0x0, 0x0, 0x0, 0x3ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000400)={0x2, 0x80, 0x2a, 0x81, 0xe0, 0x40, 0x0, 0x63c5ef1c, 0x80, 0x3, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x7, 0x2, @perf_config_ext={0xf2, 0x6}, 0x0, 0x5, 0xfffffff8, 0x0, 0x1, 0x0, 0x1b6, 0x0, 0x6}, 0x0, 0xd, 0xffffffffffffffff, 0x0)
rt_sigqueueinfo(0x0, 0x0, &(0x7f0000000000))
setsockopt$sock_timeval(r0, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10)
bind$packet(r2, &(0x7f00000000c0)={0x11, 0xfe, 0x0, 0x1, 0xfb, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}}, 0x14)
perf_event_open(&(0x7f0000000100)={0x0, 0x80, 0xff, 0x8, 0x4, 0x1, 0x0, 0x4, 0x684, 0x4, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0xdbc, 0x0, @perf_config_ext={0xd03, 0x80000000}, 0x800, 0x3, 0x3, 0x5, 0x300000000000000, 0x7, 0x0, 0x0, 0x0, 0x0, 0x5}, r1, 0x10, 0xffffffffffffffff, 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r3, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
openat(r3, &(0x7f0000000180)='\x00', 0x400040, 0x80)
rt_sigqueueinfo(0x0, 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f0000000240)={'ip6_vti0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x4, 0x0, 0x7f, 0x40, 0xb, @local, @mcast1, 0x88, 0x20, 0x8, 0x2}})

00:20:12 executing program 0:
perf_event_open(&(0x7f0000000080)={0x0, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r1, &(0x7f0000000100), 0x0, 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r0, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r2, 0x62800, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0x0, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r1, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:20:12 executing program 2:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_mount_image$tmpfs(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
creat(&(0x7f0000000000)='./file1\x00', 0x100)

[ 2902.159234] syz-executor.5: attempt to access beyond end of device
[ 2902.159234] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2902.160173] Buffer I/O error on dev loop5, logical block 10, lost async page write
[ 2902.201864] syz-executor.6: attempt to access beyond end of device
[ 2902.201864] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2902.202821] Buffer I/O error on dev loop6, logical block 10, lost async page write
00:20:12 executing program 3:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r0, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)

00:20:12 executing program 5:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 88)

[ 2902.237414] loop2: detected capacity change from 0 to 40
00:20:12 executing program 6:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 88)

[ 2902.369211] loop3: detected capacity change from 0 to 40
[ 2902.385620] loop6: detected capacity change from 0 to 40
[ 2902.390625] loop5: detected capacity change from 0 to 40
[ 2902.408506] FAT-fs (loop3): bogus number of reserved sectors
[ 2902.409355] FAT-fs (loop3): Can't find a valid FAT filesystem
[ 2902.460131] FAULT_INJECTION: forcing a failure.
[ 2902.460131] name failslab, interval 1, probability 0, space 0, times 0
[ 2902.462060] CPU: 1 PID: 13994 Comm: syz-executor.6 Not tainted 6.1.0-rc8-next-20221208 #1
[ 2902.463311] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
[ 2902.464503] Call Trace:
[ 2902.464865]  <TASK>
[ 2902.465191]  dump_stack_lvl+0x8f/0xb7
[ 2902.465748]  should_fail_ex.cold+0x5/0xa
[ 2902.466346]  should_failslab+0x9/0x20
[ 2902.466882]  __kmem_cache_alloc_node+0x5b/0x400
[ 2902.467489]  ? iter_file_splice_write+0x169/0xcb0
[ 2902.468177]  ? iter_file_splice_write+0x169/0xcb0
[ 2902.468850]  __kmalloc+0x46/0xc0
[ 2902.469348]  iter_file_splice_write+0x169/0xcb0
[ 2902.469977]  ? generic_file_read_iter+0x330/0x550
[ 2902.470697]  ? generic_file_splice_read+0x1bc/0x4d0
[ 2902.471365]  ? __pfx_iter_file_splice_write+0x10/0x10
[ 2902.472025]  ? __pfx_generic_file_splice_read+0x10/0x10
[ 2902.472756]  ? inode_security+0x105/0x140
[ 2902.473380]  ? security_file_permission+0xb5/0xe0
[ 2902.474084]  ? __pfx_iter_file_splice_write+0x10/0x10
[ 2902.474810]  direct_splice_actor+0x113/0x180
[ 2902.475405]  splice_direct_to_actor+0x33a/0x8c0
[ 2902.476071]  ? __pfx_direct_splice_actor+0x10/0x10
[ 2902.476407] syz-executor.5: attempt to access beyond end of device
[ 2902.476407] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2902.476724]  ? __pfx_splice_direct_to_actor+0x10/0x10
[ 2902.477603] Buffer I/O error on dev loop5, logical block 10, lost async page write
[ 2902.478250]  ? security_file_permission+0xb5/0xe0
[ 2902.479507]  do_splice_direct+0x1bc/0x290
[ 2902.480099]  ? __pfx_do_splice_direct+0x10/0x10
[ 2902.480782]  ? lock_is_held_type+0xdb/0x130
[ 2902.481425]  do_sendfile+0xb1d/0x1280
[ 2902.481994]  ? __pfx_do_sendfile+0x10/0x10
[ 2902.482616]  ? lock_is_held_type+0xdb/0x130
[ 2902.483240]  __x64_sys_sendfile64+0x248/0x2a0
[ 2902.483820]  ? trace_rcu_dyntick+0x1a7/0x250
[ 2902.484452]  ? __pfx___x64_sys_sendfile64+0x10/0x10
[ 2902.485131]  ? syscall_enter_from_user_mode+0x21/0x50
[ 2902.485843]  ? syscall_enter_from_user_mode+0x21/0x50
[ 2902.486583]  do_syscall_64+0x3f/0x90
[ 2902.487118]  entry_SYSCALL_64_after_hwframe+0x72/0xdc
[ 2902.487813] RIP: 0033:0x7f3186383b19
[ 2902.488332] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
[ 2902.491143] RSP: 002b:00007f31838f9188 EFLAGS: 00000246 ORIG_RAX: 0000000000000028
[ 2902.492427] RAX: ffffffffffffffda RBX: 00007f3186496f60 RCX: 00007f3186383b19
[ 2902.493626] RDX: 0000000000000000 RSI: 0000000000000003 RDI: 0000000000000004
[ 2902.494846] RBP: 00007f31838f91d0 R08: 0000000000000000 R09: 0000000000000000
[ 2902.496041] R10: 00000000fffffdef R11: 0000000000000246 R12: 0000000000000002
[ 2902.497191] R13: 00007ffc1396bf2f R14: 00007f31838f9300 R15: 0000000000022000
[ 2902.498207]  </TASK>
[ 2902.829425] loop4: detected capacity change from 0 to 264192
00:20:31 executing program 4:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
ioctl$EXT4_IOC_SWAP_BOOT(r1, 0x6611)
openat(r1, &(0x7f0000000000)='./file1\x00', 0x48082, 0xa0)
syz_mount_image$tmpfs(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r2, r0, 0x0, 0xfffffdef)

00:20:31 executing program 6:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 89)

00:20:31 executing program 3:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00", 0xc}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r0, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)

00:20:31 executing program 1:
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}}, 0x0, 0x6, 0xffffffffffffffff, 0xb)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
r1 = gettid()
rt_sigqueueinfo(0x0, 0x0, 0x0)
r2 = pidfd_getfd(0xffffffffffffffff, r0, 0x0)
perf_event_open(&(0x7f0000000040)={0x5, 0x80, 0x40, 0x71, 0x2, 0x0, 0x0, 0x8000, 0x20, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, @perf_config_ext={0xff}, 0x0, 0x9b5, 0xfa, 0xd, 0x0, 0x8000, 0x55, 0x0, 0x0, 0x0, 0x3ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000400)={0x2, 0x80, 0x2a, 0x81, 0xe0, 0x40, 0x0, 0x63c5ef1c, 0x80, 0x3, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x7, 0x2, @perf_config_ext={0xf2, 0x6}, 0x0, 0x5, 0xfffffff8, 0x0, 0x1, 0x0, 0x1b6, 0x0, 0x6}, 0x0, 0xd, 0xffffffffffffffff, 0x0)
rt_sigqueueinfo(0x0, 0x0, &(0x7f0000000000))
setsockopt$sock_timeval(r0, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10)
bind$packet(r2, &(0x7f00000000c0)={0x11, 0xfe, 0x0, 0x1, 0xfb, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}}, 0x14)
perf_event_open(&(0x7f0000000100)={0x0, 0x80, 0xff, 0x8, 0x4, 0x1, 0x0, 0x4, 0x684, 0x4, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0xdbc, 0x0, @perf_config_ext={0xd03, 0x80000000}, 0x800, 0x3, 0x3, 0x5, 0x300000000000000, 0x7, 0x7ff}, r1, 0x10, 0xffffffffffffffff, 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r3, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
openat(r3, &(0x7f0000000180)='\x00', 0x400040, 0x80)
rt_sigqueueinfo(0x0, 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f0000000240)={'ip6_vti0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x4, 0x0, 0x7f, 0x40, 0xb, @local, @mcast1, 0x88, 0x20, 0x8, 0x2}})

00:20:31 executing program 2:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_mount_image$tmpfs(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
creat(&(0x7f0000000000)='./file1\x00', 0x100)

00:20:31 executing program 7:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684fd2981c8409820000080000000000000000"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x100d}], 0x5c5, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

[ 2921.280122] loop2: detected capacity change from 0 to 40
00:20:31 executing program 0:
perf_event_open(&(0x7f0000000080)={0x0, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r1, &(0x7f0000000100), 0x0, 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r0, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r2, 0x80000, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0x0, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r1, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:20:31 executing program 5:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 89)

[ 2921.291620] loop3: detected capacity change from 0 to 40
[ 2921.298465] loop5: detected capacity change from 0 to 40
[ 2921.305545] loop6: detected capacity change from 0 to 40
[ 2921.317730] FAT-fs (loop3): bogus number of reserved sectors
[ 2921.318516] FAT-fs (loop3): Can't find a valid FAT filesystem
[ 2921.326903] loop4: detected capacity change from 0 to 40
[ 2921.360885] syz-executor.5: attempt to access beyond end of device
[ 2921.360885] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2921.361824] Buffer I/O error on dev loop5, logical block 10, lost async page write
[ 2921.376225] syz-executor.6: attempt to access beyond end of device
[ 2921.376225] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2921.377164] Buffer I/O error on dev loop6, logical block 10, lost async page write
00:20:32 executing program 0:
perf_event_open(&(0x7f0000000080)={0x0, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r1, &(0x7f0000000100), 0x0, 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r0, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r2, 0x100000, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0x0, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r1, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

[ 2921.412541] syz-executor.4: attempt to access beyond end of device
[ 2921.412541] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2921.413692] Buffer I/O error on dev loop4, logical block 10, lost async page write
00:20:32 executing program 5:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 90)

00:20:32 executing program 2:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
creat(&(0x7f0000000000)='./file1\x00', 0x100)

00:20:32 executing program 1:
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}}, 0x0, 0x6, 0xffffffffffffffff, 0xb)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
r1 = gettid()
rt_sigqueueinfo(0x0, 0x0, 0x0)
r2 = pidfd_getfd(0xffffffffffffffff, r0, 0x0)
perf_event_open(&(0x7f0000000040)={0x5, 0x80, 0x40, 0x71, 0x2, 0x0, 0x0, 0x8000, 0x20, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, @perf_config_ext={0xff}, 0x0, 0x9b5, 0xfa, 0xd, 0x0, 0x8000, 0x55, 0x0, 0x0, 0x0, 0x3ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000400)={0x2, 0x80, 0x2a, 0x81, 0xe0, 0x40, 0x0, 0x63c5ef1c, 0x80, 0x3, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x7, 0x2, @perf_config_ext={0xf2, 0x6}, 0x0, 0x5, 0xfffffff8, 0x0, 0x1, 0x0, 0x1b6, 0x0, 0x6}, 0x0, 0xd, 0xffffffffffffffff, 0x0)
rt_sigqueueinfo(0x0, 0x0, &(0x7f0000000000))
setsockopt$sock_timeval(r0, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10)
bind$packet(r2, &(0x7f00000000c0)={0x11, 0xfe, 0x0, 0x1, 0xfb, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}}, 0x14)
perf_event_open(&(0x7f0000000100)={0x0, 0x80, 0xff, 0x8, 0x4, 0x1, 0x0, 0x4, 0x684, 0x4, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0xdbc, 0x0, @perf_config_ext={0xd03, 0x80000000}, 0x800, 0x3, 0x3, 0x5, 0x300000000000000, 0x7, 0x7ff}, r1, 0x10, 0xffffffffffffffff, 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r3, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
openat(r3, &(0x7f0000000180)='\x00', 0x400040, 0x80)
rt_sigqueueinfo(0x0, 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f0000000240)={'ip6_vti0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x4, 0x0, 0x7f, 0x40, 0xb, @local, @mcast1, 0x88, 0x20, 0x8, 0x2}})

00:20:32 executing program 3:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00", 0xc}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r0, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)

00:20:32 executing program 6:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 90)

[ 2921.506175] loop3: detected capacity change from 0 to 40
[ 2921.516593] FAT-fs (loop3): bogus number of reserved sectors
[ 2921.517120] FAT-fs (loop3): Can't find a valid FAT filesystem
00:20:32 executing program 4:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x7, &(0x7f0000000500)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}, {&(0x7f0000000000)="71a2e209dbe770dd7b8550517491c8eb8127fe51e0e44c8ff2f5e57a06f3d393e149f0f6905d1b816cf6d5c09a054128c8f4af14b1461033b10872ec13c60d13ca", 0x41, 0x1}, {&(0x7f0000000180)="2912667d40177e881276053d300fe470c405e2367cf079602117c312cca6f74a1479e20fa5788b3421b8bf4102277a8375f51cecfc7ed521f7396892946f951f0bda31c92529b11f65af1104", 0x4c, 0x1}, {&(0x7f0000000240)="d36e41fed6fc140ccdbe6e4aa475ddc64ff97942ade43e18281d3b560526bad8700f872c3133fc9ce40c2c5d2f28fdcfba902e26ac57bdd32dcc0f6cf64f6cdd040d9bd69fb4fa49004fcc1dc898721d8ab6084c739dc535f9b1041268b33156925fe89daf927592f2d79993fe14f753dab29149faaccb4694305643b0f2a0d872e5252f50a915bad12ec073a2eb2a8cf9dce7f519a45517b8d4372775afb503a18db7816faf9c9239fe231f1a7fdbfdd375bb16712a92d2ddf1701cb4eb688ed029c83df449d166b518d4fc36e05ab792f8146d100975ed1ff220a9da50093e3707b9bdec84de6c88f3e89ade1ad628", 0xf0, 0x7fffffff}, {&(0x7f0000000340)="63ede2056cba283167aedf5b285b325259e882e60bbc0d3592fcb906441ce50758e7ba8e411241d197a13bb095dac72370f651a1d46bab369af5eeb3186b6d19917838938c396c8ebd8075a46398752e2cd220688388412b384aad59427321a54470e074d6a1b44b934c10ee4bf99aea832ca46f4483a2bbe4e9695c368d947cdedc170454e9846993b94254729f08a127ccf273c3dcb7d87feba141ac46d829b8350638d14a4127317518a566587b86c8b32fbc4645b77a6f55f8f3", 0xbc, 0xffffffffffffffe6}, {&(0x7f0000000400)="2c71643da7979829e3b2c23d000ea9d0e295c4fc5b1f3e39c8f6133355692db61a5197393d3505b8899e6602535be3c3f652fe14cd8717492e41f8ff028a3844e88fe995a01ec54d2f0dd6617d2cd8268410858a87f2d12e9963623d5847ecedf28a250c5dda1e082eb1ad5031cf082422e64a23d65d68541cc94bea79c796f057a7b57017e5ec81fd01882698436dbd0392b76fa0da54749dab9ae2002f5a735baf6c3720aa6d4e41e0148f1555529df0aec5d6faf42d6321b826d932cb291cf3b142111b9c59d372a0a93b0c4002", 0xcf, 0x52a}], 0x120040e, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r1 = syz_mount_image$tmpfs(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
r2 = memfd_secret(0x80000)
pipe(&(0x7f00000005c0)={<r3=>0xffffffffffffffff})
bind$unix(r3, &(0x7f0000000600)=@abs={0x1, 0x0, 0x4e21}, 0x6e)
sendfile(r2, r1, 0x0, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
link(&(0x7f00000000c0)='./file2\x00', &(0x7f0000000200)='./file0\x00')
write$binfmt_aout(r4, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r4, r0, 0x0, 0xfffffdef)

[ 2921.534870] loop2: detected capacity change from 0 to 40
[ 2921.538351] loop5: detected capacity change from 0 to 40
[ 2921.593683] syz-executor.5: attempt to access beyond end of device
[ 2921.593683] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2921.594606] Buffer I/O error on dev loop5, logical block 10, lost async page write
[ 2921.607649] loop6: detected capacity change from 0 to 40
[ 2921.616930] loop4: detected capacity change from 0 to 264192
[ 2921.636207] FAT-fs (loop4): invalid media value (0x7c)
[ 2921.636619] FAT-fs (loop4): Can't find a valid FAT filesystem
[ 2921.679572] syz-executor.6: attempt to access beyond end of device
[ 2921.679572] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2921.680569] Buffer I/O error on dev loop6, logical block 10, lost async page write
[ 2922.446184] loop4: detected capacity change from 0 to 264192
[ 2922.449443] FAT-fs (loop4): Unrecognized mount option "./file0" or missing value
00:20:47 executing program 4:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_mount_image$tmpfs(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x1410c2, 0x0)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
ioctl$AUTOFS_IOC_PROTOVER(r0, 0x80049363, &(0x7f0000000000))
sendfile(r2, r1, 0x0, 0xfffffdef)

00:20:47 executing program 6:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 91)

00:20:47 executing program 7:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684fd2981c8409820000080000000000000000"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x100d}], 0x5cb, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:20:47 executing program 3:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00", 0xc}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r0, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)

00:20:47 executing program 1:
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}}, 0x0, 0x6, 0xffffffffffffffff, 0xb)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
r1 = gettid()
rt_sigqueueinfo(0x0, 0x0, 0x0)
r2 = pidfd_getfd(0xffffffffffffffff, r0, 0x0)
perf_event_open(&(0x7f0000000040)={0x5, 0x80, 0x40, 0x71, 0x2, 0x0, 0x0, 0x8000, 0x20, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, @perf_config_ext={0xff}, 0x0, 0x9b5, 0xfa, 0xd, 0x0, 0x8000, 0x55, 0x0, 0x0, 0x0, 0x3ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000400)={0x2, 0x80, 0x2a, 0x81, 0xe0, 0x40, 0x0, 0x63c5ef1c, 0x80, 0x3, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x7, 0x2, @perf_config_ext={0xf2, 0x6}, 0x0, 0x5, 0xfffffff8, 0x0, 0x1, 0x0, 0x1b6, 0x0, 0x6}, 0x0, 0xd, 0xffffffffffffffff, 0x0)
rt_sigqueueinfo(0x0, 0x0, &(0x7f0000000000))
setsockopt$sock_timeval(r0, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10)
bind$packet(r2, &(0x7f00000000c0)={0x11, 0xfe, 0x0, 0x1, 0xfb, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}}, 0x14)
perf_event_open(&(0x7f0000000100)={0x0, 0x80, 0xff, 0x8, 0x4, 0x1, 0x0, 0x4, 0x684, 0x4, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0xdbc, 0x0, @perf_config_ext={0xd03, 0x80000000}, 0x800, 0x3, 0x3, 0x5, 0x300000000000000, 0x7, 0x7ff}, r1, 0x10, 0xffffffffffffffff, 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r3, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
openat(r3, &(0x7f0000000180)='\x00', 0x400040, 0x80)
rt_sigqueueinfo(0x0, 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f0000000240)={'ip6_vti0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x4, 0x0, 0x7f, 0x40, 0xb, @local, @mcast1, 0x88, 0x20, 0x8, 0x2}})

00:20:47 executing program 2:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
creat(&(0x7f0000000000)='./file1\x00', 0x100)

00:20:47 executing program 0:
perf_event_open(&(0x7f0000000080)={0x0, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r1, &(0x7f0000000100), 0x0, 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r0, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r2, 0x100600, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0x0, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r1, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:20:47 executing program 5:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 91)

[ 2937.122497] loop3: detected capacity change from 0 to 40
[ 2937.126361] loop4: detected capacity change from 0 to 40
[ 2937.129921] loop5: detected capacity change from 0 to 40
[ 2937.134908] FAT-fs (loop3): bogus number of reserved sectors
[ 2937.135464] FAT-fs (loop3): Can't find a valid FAT filesystem
[ 2937.155426] loop2: detected capacity change from 0 to 40
[ 2937.168127] loop6: detected capacity change from 0 to 40
[ 2937.193423] syz-executor.5: attempt to access beyond end of device
[ 2937.193423] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2937.194312] Buffer I/O error on dev loop5, logical block 10, lost async page write
[ 2937.240672] syz-executor.6: attempt to access beyond end of device
[ 2937.240672] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2937.241839] Buffer I/O error on dev loop6, logical block 10, lost async page write
00:20:47 executing program 3:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440", 0x12}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r0, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)

00:20:47 executing program 0:
perf_event_open(&(0x7f0000000080)={0x0, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r1, &(0x7f0000000100), 0x0, 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r0, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r2, 0x180000, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0x0, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r1, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:20:47 executing program 5:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 92)

00:20:48 executing program 2:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
creat(&(0x7f0000000000)='./file1\x00', 0x100)

[ 2937.399910] loop3: detected capacity change from 0 to 40
[ 2937.427046] FAT-fs (loop3): invalid media value (0x00)
[ 2937.427792] FAT-fs (loop3): Can't find a valid FAT filesystem
[ 2937.435768] loop5: detected capacity change from 0 to 40
00:20:48 executing program 6:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 92)

00:20:48 executing program 1:
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}}, 0x0, 0x6, 0xffffffffffffffff, 0xb)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
gettid()
rt_sigqueueinfo(0x0, 0x0, 0x0)
r1 = pidfd_getfd(0xffffffffffffffff, r0, 0x0)
perf_event_open(&(0x7f0000000040)={0x5, 0x80, 0x40, 0x71, 0x2, 0x0, 0x0, 0x8000, 0x20, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, @perf_config_ext={0xff}, 0x0, 0x9b5, 0xfa, 0xd, 0x0, 0x8000, 0x55, 0x0, 0x0, 0x0, 0x3ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000400)={0x2, 0x80, 0x2a, 0x81, 0xe0, 0x40, 0x0, 0x63c5ef1c, 0x80, 0x3, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x7, 0x2, @perf_config_ext={0xf2, 0x6}, 0x0, 0x5, 0xfffffff8, 0x0, 0x1, 0x0, 0x1b6, 0x0, 0x6}, 0x0, 0xd, 0xffffffffffffffff, 0x0)
rt_sigqueueinfo(0x0, 0x0, &(0x7f0000000000))
setsockopt$sock_timeval(r0, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10)
bind$packet(r1, &(0x7f00000000c0)={0x11, 0xfe, 0x0, 0x1, 0xfb, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}}, 0x14)
perf_event_open(&(0x7f0000000100)={0x0, 0x80, 0xff, 0x8, 0x4, 0x1, 0x0, 0x4, 0x684, 0x4, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0xdbc, 0x0, @perf_config_ext={0xd03, 0x80000000}, 0x800, 0x3, 0x3, 0x5, 0x300000000000000, 0x7, 0x7ff, 0x0, 0x0, 0x0, 0x5}, 0x0, 0x10, 0xffffffffffffffff, 0x2)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r2, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
openat(r2, &(0x7f0000000180)='\x00', 0x400040, 0x80)
rt_sigqueueinfo(0x0, 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f0000000240)={'ip6_vti0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x4, 0x0, 0x7f, 0x40, 0xb, @local, @mcast1, 0x88, 0x20, 0x8, 0x2}})

[ 2937.512321] loop2: detected capacity change from 0 to 40
00:20:48 executing program 4:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r1, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
dup2(0xffffffffffffffff, r0)
recvfrom$unix(r1, &(0x7f0000006300)=""/239, 0xef, 0x40000000, &(0x7f0000006400)=@abs={0x1, 0x0, 0x4e23}, 0x6e)
chdir(&(0x7f0000000140)='./file0\x00')
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r2, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
syz_mount_image$tmpfs(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
sendmsg$NFT_MSG_GETFLOWTABLE(0xffffffffffffffff, &(0x7f00000062c0)={&(0x7f0000003440)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000006280)={&(0x7f0000006180)={0xf0, 0x17, 0xa, 0x101, 0x0, 0x0, {0x5, 0x0, 0xa}, [@NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_FLOWTABLE_HOOK={0xd0, 0x3, 0x0, 0x1, [@NFTA_FLOWTABLE_HOOK_DEVS={0xcc, 0x3, 0x0, 0x1, [{0x14, 0x1, 'ip6tnl0\x00'}, {0x14, 0x1, 'team_slave_0\x00'}, {0x14, 0x1, 'xfrm0\x00'}, {0x14, 0x1, 'wlan1\x00'}, {0x14, 0x1, 'gre0\x00'}, {0x14, 0x1, 'wlan1\x00'}, {0x14, 0x1, 'gre0\x00'}, {0x14, 0x1, 'macvlan1\x00'}, {0x14, 0x1, 'bridge0\x00'}, {0x14, 0x1, 'veth1_to_hsr\x00'}]}]}]}, 0xf0}, 0x1, 0x0, 0x0, 0x10000000}, 0x40)
write$binfmt_aout(r3, &(0x7f0000001180)=ANY=[], 0x220)
ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000700)={'wlan1\x00', <r4=>0x0})
sendmsg$NL80211_CMD_ASSOCIATE(0xffffffffffffffff, &(0x7f00000007c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000780)={&(0x7f0000000700)={0x50, 0x0, 0x4, 0x70bd29, 0x7, {{}, {@val={0x8, 0x3, r4}, @void}}, [@NL80211_ATTR_USE_MFP={0x8, 0x42, 0x1}, @NL80211_ATTR_PREV_BSSID={0xa, 0x4f, @random="890fa4764159"}, @crypto_settings=[@NL80211_ATTR_WPA_VERSIONS={0x8, 0x4b, 0x1}], @NL80211_ATTR_VHT_CAPABILITY={0x10, 0x9d, {0x2, {0x0, 0x3, 0x5, 0x200}}}, @NL80211_ATTR_USE_RRM={0x4}, @NL80211_ATTR_IE={0x4}]}, 0x50}, 0x1, 0x0, 0x0, 0x40}, 0x20000000)
sendmsg$NL80211_CMD_NEW_KEY(r3, &(0x7f0000006580)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000006540)={&(0x7f0000000540)={0x5c, 0x0, 0x100, 0x70bd2a, 0x25dfdbfb, {{}, {@val={0x8, 0x3, r4}, @val={0xc, 0x99, {0xffff8cfe, 0x79}}}}, [@NL80211_ATTR_KEY_DEFAULT={0x4}, @NL80211_ATTR_KEY_DEFAULT_MGMT={0x4}, @NL80211_ATTR_KEY_DEFAULT_TYPES={0xc, 0x6e, 0x0, 0x1, [@NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}]}, @NL80211_ATTR_KEY_DATA_WEP104={0x11, 0x7, "3c97e11e66b80328de96939a0a"}, @NL80211_ATTR_KEY_IDX={0x5, 0x8, 0x5}, @NL80211_ATTR_KEY_DEFAULT_MGMT={0x4}]}, 0x5c}, 0x1, 0x0, 0x0, 0x20000000}, 0x4008884)
clock_gettime(0x0, &(0x7f0000006100)={<r5=>0x0, <r6=>0x0})
recvmmsg$unix(0xffffffffffffffff, &(0x7f0000005ec0)=[{{&(0x7f00000006c0), 0x6e, &(0x7f0000000940)=[{&(0x7f0000000740)=""/88, 0x58}, {&(0x7f0000006600)=""/88, 0x58}, {&(0x7f0000000840)=""/219, 0xdb}], 0x3, &(0x7f0000000980)=[@rights={{0x20, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0x20}}, {{&(0x7f00000009c0)=@abs, 0x6e, &(0x7f0000000b80)=[{&(0x7f0000000a40)=""/138, 0x8a}, {&(0x7f0000000b00)=""/117, 0x75}], 0x2, &(0x7f0000000bc0)=[@rights={{0x28, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x28, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0x50}}, {{&(0x7f0000000c40)=@abs, 0x6e, &(0x7f0000000d00)=[{&(0x7f0000000cc0)=""/38, 0x26}], 0x1, &(0x7f0000000d40)=[@rights={{0x30, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @rights={{0x30, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @rights={{0x20, 0x1, 0x1, [<r7=>0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x24, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0xe8}}, {{0x0, 0x0, &(0x7f0000001300)=[{&(0x7f0000000e40)=""/183, 0xb7}, {&(0x7f0000000f00)=""/227, 0xe3}, {&(0x7f0000001000)=""/212, 0xd4}, {&(0x7f0000001100)=""/232, 0xe8}, {&(0x7f0000001200)=""/233, 0xe9}], 0x5, &(0x7f0000001380)=[@rights={{0x28, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @rights={{0x20, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}], 0xc8}}, {{&(0x7f0000001480)=@abs, 0x6e, &(0x7f00000018c0)=[{&(0x7f00000065c0)=""/34, 0x22}, {&(0x7f0000001540)=""/109, 0x6d}, {&(0x7f00000015c0)}, {&(0x7f0000001600)=""/2, 0x2}, {&(0x7f0000001640)=""/157, 0x9d}, {&(0x7f0000001700)=""/48, 0x30}, {&(0x7f0000001740)=""/127, 0x7f}, {&(0x7f00000017c0)=""/187, 0xbb}, {&(0x7f0000001880)=""/26, 0x1a}], 0x9}}, {{0x0, 0x0, &(0x7f0000001d80)=[{&(0x7f0000001980)=""/1, 0x1}, {&(0x7f00000019c0)=""/199, 0xc7}, {&(0x7f0000001ac0)=""/250, 0xfa}, {&(0x7f0000001bc0)=""/163, 0xa3}, {&(0x7f0000001c80)=""/207, 0xcf}], 0x5, &(0x7f0000001e00)}}, {{&(0x7f0000001f00), 0x6e, &(0x7f0000002100)=[{&(0x7f0000001f80)=""/124, 0x7c}, {&(0x7f0000002000)=""/91, 0x5b}, {&(0x7f0000002080)=""/91, 0x5b}], 0x3, &(0x7f0000002140)=[@cred={{0x1c}}, @rights={{0x20, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x24, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0x68}}, {{&(0x7f00000021c0)=@abs, 0x6e, &(0x7f0000004700)=[{&(0x7f0000002240)=""/4096, 0x1000}, {&(0x7f0000003240)=""/190, 0xbe}, {&(0x7f0000003300)=""/220, 0xdc}, {&(0x7f0000003400)=""/14, 0xe}, {&(0x7f0000003440)}, {&(0x7f0000003480)=""/109, 0x6d}, {&(0x7f0000003500)=""/244, 0xf4}, {&(0x7f0000003600)=""/7, 0x7}, {&(0x7f0000003640)=""/160, 0xa0}, {&(0x7f0000003700)=""/4096, 0x1000}], 0xa, &(0x7f00000047c0)=[@cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x2c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @rights={{0x24, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @rights={{0x24, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0x160}}, {{&(0x7f0000004940), 0x6e, &(0x7f0000005e40)=[{&(0x7f00000049c0)=""/246, 0xf6}, {&(0x7f0000004ac0)=""/4096, 0x1000}, {&(0x7f0000005ac0)=""/167, 0xa7}, {&(0x7f0000005b80)=""/216, 0xd8}, {&(0x7f0000005c80)=""/30, 0x1e}, {&(0x7f0000005cc0)=""/105, 0x69}, {&(0x7f0000005d40)=""/191, 0xbf}, {&(0x7f0000005e00)=""/4, 0x4}], 0x8}}], 0x9, 0x10104, &(0x7f0000006140)={r5, r6+10000000})
ioctl$TUNDETACHFILTER(r7, 0x401054d6, 0x0)
sendfile(r3, 0xffffffffffffffff, 0x0, 0xfffffdef)
syz_mount_image$tmpfs(&(0x7f0000000000), &(0x7f0000000040)='./file2\x00', 0x432b309e, 0x7, &(0x7f0000006480)=[{&(0x7f00000000c0)="5768946e8850008690cef58791ae777b0637d4538da631c43307c6ec0319", 0x1e, 0x100000000}, {&(0x7f0000000180)="5dc8328875faa7d1fc45ca20cc", 0xd, 0x8}, {&(0x7f0000000240)="9b8b98d64ad4405f3a6844406c34af0587d4582f4b5f668f59bd01cc693c18fc22635a1fb9c1fd165c3d984603aaf46b7fe4e0fc79b0ce665ac2b45c35f94b0c22c32cbdbfa78bd4e1e26c5131ba3a05a239110649bf48c861d4d90173", 0x5d, 0x1}, {&(0x7f00000002c0)="5192a77c9cf2979ff4934bed5e7e01bf3977fdbcaa35e2bd098c2ef7e58cc8a1f0bcf51724dcc8211fd9aa8f2324b20e45ce985a3e6e8e28a36b17d50eb57001d8864f4643d17372b7f30414c26c96042c82a775f5c8899cf6cfea2933ed63b5faddf2cffa09015c6ef50404eaf99d267c8a7bb9ab265eefe5ebbed27c273f11f68f7c08fdbd17b1b505c87429b1243c567d016ad035e8b23dcf330fdca80057b925d039502fcc1c1c093db01bae2c9d72310dff3e3e359a", 0xb8}, {&(0x7f0000000380)="747c5a409bce1c68c20f8b9dcb9e6760bbe6a12bf4f7fde015f0c1403078a33e5951af2acf173fb271ef923419982a5c699660cb116055079c568b312c152ce9375c20dfc4e0de8cdb3c95472059087944abfc71ab2ad447fa7eb1a755f24c70af417c40b8b1f83a16b61484e57dbbcd5b5ba0b32ea478be523e9037801c9c27c3f5ab51a1dac3ebb2d227987ced2738d637f0e49a464a9c230be2138207d8d52b6c2330803874984dd4da812288a726055879c89262177151689716d65b157c756cd8b51cc0bc809ac5c1fa71b746bbdcd1533cac5dab28daa9f366b7df55b722d245e842029bfe1e3904c6c82ca5b4ebbf62137c608e95936f", 0xfa, 0xbfde}, {&(0x7f0000000480)="00c5cf048f1f626b2529913249cfe7e7cc934f7089fb8eb7ac6dffda2a9903c10155c6129e65bce70275e909791ec93af1c60d7bce8b1ecdf0e2ff9cc9d0c91051cd8ab6a2dd608a5b608c50c6b5dee0904a1aa5d85ef8a14013c9775b", 0x5d, 0x3}, {&(0x7f00000001c0)="65fe9688516cfd3f159c3ef415e7f18623d8d7b0a33c6359303d831f7fd632f858e1ca4986665b6f8b567f2aa34d5afc7bebcc33e1a0df8969df6c", 0x3b, 0x80000000}], 0x10001, &(0x7f00000005c0)={[{@size={'size', 0x3d, [0x31, 0x6d, 0x65, 0x13, 0x6b, 0x36, 0x0]}}, {@size={'size', 0x3d, [0x37, 0x35, 0x39, 0x78, 0x59, 0x33, 0x2d, 0x0, 0x30]}}, {@nr_blocks={'nr_blocks', 0x3d, [0x39]}}, {@huge_always}, {@size={'size', 0x3d, [0x34, 0x39, 0x67]}}, {@huge_never}, {@huge_always}, {@huge_advise}, {@size={'size', 0x3d, [0x38, 0x30, 0x34, 0x34, 0x30, 0x67, 0x6d, 0x78, 0x30, 0x78]}}], [{@fowner_lt={'fowner<', 0xffffffffffffffff}}, {@obj_type={'obj_type', 0x3d, 'vfat\x00'}}, {@context={'context', 0x3d, 'root'}}, {@smackfshat={'smackfshat', 0x3d, 'vfat\x00'}}]})

[ 2937.570448] syz-executor.5: attempt to access beyond end of device
[ 2937.570448] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2937.572665] Buffer I/O error on dev loop5, logical block 10, lost async page write
[ 2937.585622] loop6: detected capacity change from 0 to 40
00:20:48 executing program 3:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440", 0x12}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r0, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)

00:20:48 executing program 2:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
creat(&(0x7f0000000000)='./file1\x00', 0x100)

[ 2937.701198] syz-executor.6: attempt to access beyond end of device
[ 2937.701198] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2937.702856] Buffer I/O error on dev loop6, logical block 10, lost async page write
[ 2937.706652] loop4: detected capacity change from 0 to 40
00:20:48 executing program 0:
perf_event_open(&(0x7f0000000080)={0x0, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r1, &(0x7f0000000100), 0x0, 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r0, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r2, 0x180600, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0x0, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r1, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

[ 2937.818605] loop3: detected capacity change from 0 to 40
[ 2937.871628] FAT-fs (loop3): invalid media value (0x00)
[ 2937.872756] FAT-fs (loop3): Can't find a valid FAT filesystem
[ 2937.884896] loop2: detected capacity change from 0 to 40
[ 2955.749519] loop4: detected capacity change from 0 to 40
[ 2955.755663] loop6: detected capacity change from 0 to 40
00:21:06 executing program 7:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684fd2981c8409820000080000000000000000"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x100d}], 0x5d3, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:21:06 executing program 1:
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}}, 0x0, 0x6, 0xffffffffffffffff, 0xb)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
gettid()
rt_sigqueueinfo(0x0, 0x0, 0x0)
r1 = pidfd_getfd(0xffffffffffffffff, r0, 0x0)
perf_event_open(&(0x7f0000000040)={0x5, 0x80, 0x40, 0x71, 0x2, 0x0, 0x0, 0x8000, 0x20, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, @perf_config_ext={0xff}, 0x0, 0x9b5, 0xfa, 0xd, 0x0, 0x8000, 0x55, 0x0, 0x0, 0x0, 0x3ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000400)={0x2, 0x80, 0x2a, 0x81, 0xe0, 0x40, 0x0, 0x63c5ef1c, 0x80, 0x3, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x7, 0x2, @perf_config_ext={0xf2, 0x6}, 0x0, 0x5, 0xfffffff8, 0x0, 0x1, 0x0, 0x1b6, 0x0, 0x6}, 0x0, 0xd, 0xffffffffffffffff, 0x0)
rt_sigqueueinfo(0x0, 0x0, &(0x7f0000000000))
setsockopt$sock_timeval(r0, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10)
bind$packet(r1, &(0x7f00000000c0)={0x11, 0xfe, 0x0, 0x1, 0xfb, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}}, 0x14)
perf_event_open(&(0x7f0000000100)={0x0, 0x80, 0xff, 0x8, 0x4, 0x1, 0x0, 0x4, 0x684, 0x4, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0xdbc, 0x0, @perf_config_ext={0xd03, 0x80000000}, 0x800, 0x3, 0x3, 0x5, 0x300000000000000, 0x7, 0x7ff, 0x0, 0x0, 0x0, 0x5}, 0x0, 0x10, 0xffffffffffffffff, 0x2)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r2, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
openat(r2, &(0x7f0000000180)='\x00', 0x400040, 0x80)
rt_sigqueueinfo(0x0, 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f0000000240)={'ip6_vti0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x4, 0x0, 0x7f, 0x40, 0xb, @local, @mcast1, 0x88, 0x20, 0x8, 0x2}})

00:21:06 executing program 3:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440", 0x12}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r0, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)

00:21:06 executing program 5:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 93)

00:21:06 executing program 6:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 93)

00:21:06 executing program 4:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_mount_image$tmpfs(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = syz_open_dev$tty1(0xc, 0x4, 0x1)
writev(r2, &(0x7f0000000000)=[{&(0x7f0000000140)="02b2dccad213e1e6cf54b7a797f8f22a47f25b7658fb110b2e76f95b0f318b8fa745e6ffba4414d29a42bfab524bc5bffb17decc4540a6f00b9772f5f9789a9525790df8d989b23530d0a1398f2ad734c7ff47961be476ffeec81efa3d3aa64b8ea329261dfc2e1047a68670f0e5950d6a5414956bddd09e101b5b66e5742fe843413e065e3b86a242b37bc58c68153a45015f6f1ea67762c302e461e0c84bbb7f8d464f5a72d9fad56dac0c5028a4012a93dbc7da640786e3c9898cdd8fe091b166bfcd66e6257abc923ceaf90e994deded3fe8a59c2105f5caf366d32170ef51299dbf441bc3cddda352a2e07375fb44e75fed8082f3e960015d9bcddb0c834feda68d113a9a9fc0d1c30153685caf43b176219b666d74e67b6192cfd8a561c6c4aadcc80ed8c469bc41b028f1db515d699e45ad3379f9b1edb8de4bb2f8615d6716297baac7e45073fcecf31e51ec78c40edd78f245bced04414f849fb961fbbe79ff2ed7c48ec1b5331f9755d7094986fc8da198ce4a12f9ddfb43e565bc4fed618da9a693d03c3e7ec4b3014dfc022103e277c1b12efb03ef8b197f3a931f6cbe238cf8a4e7639b409b4586f66da41b94eed69d52ba9fde5aa1ee774d4e626932dc3511b10ae3bc3e8688a7a83b0467dfbf92951747396735c9f47ad4552e7bdf4f8e7998a1266a360beb2ec1527390452139f9ab91ee250efcf3413e72a6b2688d8b6a4748ccc165bbf886573ccdd03bd93f32a866cd878ec246e06f31d4d7f7ec9836b7305ee0c1b9fa75cd6e4ca5cc2f107b654f15a2442cd9c8eaf581d093639fe35e0da49394c5ed66ad29bc2b863649e16c1951d0d3dd6f1048539e558ee1f059d91510a5acd84777ca01545635d2fb40e2f205bb11435023e47e4e2f85b6d1b56b688dd1a4304708a561d32dbaa6cd4f969e67af33773d4e9772751019dc6c2af7e2fe9d3c7eb6f1b401926603d90802f792b081957dd5ebd18410cd42b2ea05ae9a61254e4b878384b8a376fe9eba06afc1253f2224fab88feb7c426e3dfb19385afbb42cc13209b419568eeafdf505dc5ca30acc17d337e941e0badf9f9413f381fe9a315e2597426805827943f193f02a12554d434bd91708a28d9da1bf64ad64f80a7287d1e02d5d1f14bf9d89ba3badfa524694db6a651e97ea64104ad34942f36745259f4ec32fdce0bd13e693ccbe0e012e61a1fae9fc1662b99871e3812cea14d12646ccc08b0514762a475ecdbf9071377bb1ecd891c6fe32fde1d3044caf466b3a342b7541e8ed7432e94baf1d5546aff0e23f6a03c9ea5635519533e712639c27958e3a0f3684ed91cfb2e6e4", 0x3b8}], 0x1)
r3 = openat$loop_ctrl(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$LOOP_CTL_REMOVE(r3, 0x4c81, 0x0)
r4 = perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000500)=ANY=[@ANYBLOB="010000000100000018000000", @ANYRES32=<r5=>r4, @ANYBLOB="00000000000000002ed9aeaff9b7f1164083cb1f9bed3f8f5e3000000000c100"])
ioctl$AUTOFS_DEV_IOCTL_READY(r5, 0xc0189376, &(0x7f0000000040)={{0x1, 0x1, 0x18, r3, {0x4f95}}, './file0\x00'})
syz_mount_image$nfs4(&(0x7f0000000540), &(0x7f0000000580)='./file1\x00', 0xfffffffffffff000, 0x2, &(0x7f0000000780)=[{&(0x7f00000005c0)="8b2086e5a416940373f855b7e0d49b735f9f4571ee277f747ed1a751c0f0bdb85c632ee16ae510507324860f302e1743fe6d2030f0d5220f4e470410faadf8672a8436f409b48871b3a5d8a26acbac83e60d4869d535dd93f7bc64941f2f4a208cba97c48b4ecd1084b2f84acd39194ae481365f9b33aef0677c03156581efdd6a915a7df9acee8f", 0x88, 0xb5}, {&(0x7f0000000680)="487596b7e3d2f6220559cf1136caf18dfded03f8ea8f8f7dc5f4c3f45ddb4011d8319fa2b7cfec884c46435eea451a56f75946751bb6e03ec6f8d955a9c77e1fca084228efc4c8783744c56942ed5214dd697180c35a57a0d261f13872e3d58ac2a82a6e4e77c4fc2647a4ded76396caa811bc60e7ad03acb5fd7aad11af0934d58aed22c83b5ebebab39cfddfcfd6399968b6d25f276fe8712cf46b59bbb1e3ce1f06f448bb977f408adfc536e55216cc05e4934f7083a338bc58b05b56e561c45606deca4067ece9200a2679005922dc1ff02f0e0b5194ea7020b20ed2eb186b7c77764c95c18da9790b648c0853622692dd172aa1", 0xf6, 0xebae}], 0x2000, &(0x7f00000007c0)={[{'('}, {'vfat\x00'}, {'vfat\x00'}, {'vfat\x00'}, {}, {'$!/.\',].-]&%\'*(@:-}'}, {'vfat\x00'}, {':^:'}], [{@fsmagic={'fsmagic', 0x3d, 0x7}}, {@seclabel}, {@subj_type={'subj_type', 0x3d, 'vfat\x00'}}, {@dont_measure}, {@appraise_type}, {@hash}, {@func={'func', 0x3d, 'MMAP_CHECK'}}, {@permit_directio}, {@subj_role}, {@dont_measure}]})
write$binfmt_aout(r2, &(0x7f00000000c0)=ANY=[@ANYRESHEX=r2], 0xfffffe55)
sendfile(r1, r0, 0x0, 0xfffffdef)
r6 = syz_open_dev$tty1(0xc, 0x4, 0x1)
writev(r6, &(0x7f0000000000)=[{&(0x7f0000000140)="02b2dccad213e1e6cf54b7a797f8f22a47f25b7658fb110b2e76f95b0f318b8fa745e6ffba4414d29a42bfab524bc5bffb17decc4540a6f00b9772f5f9789a9525790df8d989b23530d0a1398f2ad734c7ff47961be476ffeec81efa3d3aa64b8ea329261dfc2e1047a68670f0e5950d6a5414956bddd09e101b5b66e5742fe843413e065e3b86a242b37bc58c68153a45015f6f1ea67762c302e461e0c84bbb7f8d464f5a72d9fad56dac0c5028a4012a93dbc7da640786e3c9898cdd8fe091b166bfcd66e6257abc923ceaf90e994deded3fe8a59c2105f5caf366d32170ef51299dbf441bc3cddda352a2e07375fb44e75fed8082f3e960015d9bcddb0c834feda68d113a9a9fc0d1c30153685caf43b176219b666d74e67b6192cfd8a561c6c4aadcc80ed8c469bc41b028f1db515d699e45ad3379f9b1edb8de4bb2f8615d6716297baac7e45073fcecf31e51ec78c40edd78f245bced04414f849fb961fbbe79ff2ed7c48ec1b5331f9755d7094986fc8da198ce4a12f9ddfb43e565bc4fed618da9a693d03c3e7ec4b3014dfc022103e277c1b12efb03ef8b197f3a931f6cbe238cf8a4e7639b409b4586f66da41b94eed69d52ba9fde5aa1ee774d4e626932dc3511b10ae3bc3e8688a7a83b0467dfbf92951747396735c9f47ad4552e7bdf4f8e7998a1266a360beb2ec1527390452139f9ab91ee250efcf3413e72a6b2688d8b6a4748ccc165bbf886573ccdd03bd93f32a866cd878ec246e06f31d4d7f7ec9836b7305ee0c1b9fa75cd6e4ca5cc2f107b654f15a2442cd9c8eaf581d093639fe35e0da49394c5ed66ad29bc2b863649e16c1951d0d3dd6f1048539e558ee1f059d91510a5acd84777ca01545635d2fb40e2f205bb11435023e47e4e2f85b6d1b56b688dd1a4304708a561d32dbaa6cd4f969e67af33773d4e9772751019dc6c2af7e2fe9d3c7eb6f1b401926603d90802f792b081957dd5ebd18410cd42b2ea05ae9a61254e4b878384b8a376fe9eba06afc1253f2224fab88feb7c426e3dfb19385afbb42cc13209b419568eeafdf505dc5ca30acc17d337e941e0badf9f9413f381fe9a315e2597426805827943f193f02a12554d434bd91708a28d9da1bf64ad64f80a7287d1e02d5d1f14bf9d89ba3badfa524694db6a651e97ea64104ad34942f36745259f4ec32fdce0bd13e693ccbe0e012e61a1fae9fc1662b99871e3812cea14d12646ccc08b0514762a475ecdbf9071377bb1ecd891c6fe32fde1d3044caf466b3a342b7541e8ed7432e94baf1d5546aff0e23f6a03c9ea5635519533e712639c27958e3a0f3684ed91cfb2e6e4", 0x3b8}], 0x1)
ioctl$TIOCVHANGUP(r6, 0x5437, 0x0)

00:21:06 executing program 2:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
creat(&(0x7f0000000000)='./file1\x00', 0x100)

00:21:06 executing program 0:
perf_event_open(&(0x7f0000000080)={0x0, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r1, &(0x7f0000000100), 0x0, 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r0, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r2, 0x200000, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0x0, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r1, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

[ 2955.797527] loop2: detected capacity change from 0 to 40
[ 2955.799344] syz-executor.6: attempt to access beyond end of device
[ 2955.799344] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2955.799371] Buffer I/O error on dev loop6, logical block 10, lost async page write
[ 2955.849483] loop5: detected capacity change from 0 to 40
[ 2955.851271] loop3: detected capacity change from 0 to 40
00:21:06 executing program 6:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 94)

[ 2955.864735] FAT-fs (loop3): invalid media value (0x00)
[ 2955.864770] FAT-fs (loop3): Can't find a valid FAT filesystem
00:21:06 executing program 2:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
creat(&(0x7f0000000000)='./file1\x00', 0x100)

[ 2955.962721] loop6: detected capacity change from 0 to 40
[ 2955.985347] loop2: detected capacity change from 0 to 40
[ 2955.985406] syz-executor.5: attempt to access beyond end of device
[ 2955.985406] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2955.987400] Buffer I/O error on dev loop5, logical block 10, lost async page write
00:21:06 executing program 1:
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}}, 0x0, 0x6, 0xffffffffffffffff, 0xb)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
gettid()
rt_sigqueueinfo(0x0, 0x0, 0x0)
r1 = pidfd_getfd(0xffffffffffffffff, r0, 0x0)
perf_event_open(&(0x7f0000000040)={0x5, 0x80, 0x40, 0x71, 0x2, 0x0, 0x0, 0x8000, 0x20, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, @perf_config_ext={0xff}, 0x0, 0x9b5, 0xfa, 0xd, 0x0, 0x8000, 0x55, 0x0, 0x0, 0x0, 0x3ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000400)={0x2, 0x80, 0x2a, 0x81, 0xe0, 0x40, 0x0, 0x63c5ef1c, 0x80, 0x3, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x7, 0x2, @perf_config_ext={0xf2, 0x6}, 0x0, 0x5, 0xfffffff8, 0x0, 0x1, 0x0, 0x1b6, 0x0, 0x6}, 0x0, 0xd, 0xffffffffffffffff, 0x0)
rt_sigqueueinfo(0x0, 0x0, &(0x7f0000000000))
setsockopt$sock_timeval(r0, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10)
bind$packet(r1, &(0x7f00000000c0)={0x11, 0xfe, 0x0, 0x1, 0xfb, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}}, 0x14)
perf_event_open(&(0x7f0000000100)={0x0, 0x80, 0xff, 0x8, 0x4, 0x1, 0x0, 0x4, 0x684, 0x4, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0xdbc, 0x0, @perf_config_ext={0xd03, 0x80000000}, 0x800, 0x3, 0x3, 0x5, 0x300000000000000, 0x7, 0x7ff, 0x0, 0x0, 0x0, 0x5}, 0x0, 0x10, 0xffffffffffffffff, 0x2)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r2, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
openat(r2, &(0x7f0000000180)='\x00', 0x400040, 0x80)
rt_sigqueueinfo(0x0, 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r1, 0x89f0, &(0x7f0000000240)={'ip6_vti0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x4, 0x0, 0x7f, 0x40, 0xb, @local, @mcast1, 0x88, 0x20, 0x8, 0x2}})

[ 2956.018679] syz-executor.6: attempt to access beyond end of device
[ 2956.018679] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2956.019591] Buffer I/O error on dev loop6, logical block 10, lost async page write
00:21:06 executing program 3:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000", 0x15}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r0, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)

00:21:06 executing program 4:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_mount_image$tmpfs(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
chdir(&(0x7f0000000040)='./file0/file0\x00')
pwritev(r1, &(0x7f00000000c0)=[{&(0x7f0000000180)="9f50288c49ec0000a3930830309e39c593cc9f", 0x13}], 0x1, 0x0, 0x0)
unlinkat(r1, &(0x7f0000000000)='./file1\x00', 0x200)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = open$dir(&(0x7f00000001c0)='./file0/file0\x00', 0x81, 0x40)
signalfd4(r3, &(0x7f0000000240)={[0xf5b]}, 0x8, 0x80800)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
r4 = open(&(0x7f0000000280)='./file0/file0\x00', 0x84300, 0x2)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r5, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
renameat2(r4, &(0x7f00000002c0)='./file0\x00', r5, &(0x7f0000000300)='./file1\x00', 0x0)
sendfile(r2, r0, 0x0, 0xfffffdef)

00:21:06 executing program 2:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
creat(&(0x7f0000000000)='./file1\x00', 0x100)

00:21:06 executing program 6:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 95)

[ 2956.130139] loop4: detected capacity change from 0 to 40
00:21:06 executing program 0:
perf_event_open(&(0x7f0000000080)={0x0, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r1, &(0x7f0000000100), 0x0, 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r0, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r2, 0x200600, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0x0, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r1, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

[ 2956.159791] loop2: detected capacity change from 0 to 40
[ 2956.201445] loop6: detected capacity change from 0 to 40
[ 2956.207352] syz-executor.4: attempt to access beyond end of device
[ 2956.207352] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2956.207380] Buffer I/O error on dev loop4, logical block 10, lost async page write
[ 2956.214810] loop3: detected capacity change from 0 to 40
[ 2956.224249] FAT-fs (loop3): invalid media value (0x00)
[ 2956.224331] FAT-fs (loop3): Can't find a valid FAT filesystem
[ 2956.232356] syz-executor.4: attempt to access beyond end of device
[ 2956.232356] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2956.232404] Buffer I/O error on dev loop4, logical block 10, lost async page write
[ 2956.266202] syz-executor.6: attempt to access beyond end of device
[ 2956.266202] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2956.266232] Buffer I/O error on dev loop6, logical block 10, lost async page write
00:21:06 executing program 6:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 96)

00:21:06 executing program 5:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 94)

00:21:06 executing program 7:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684fd2981c8409820000080000000000000000"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x100d}], 0x5ee, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:21:06 executing program 2:
chdir(&(0x7f0000000140)='./file0\x00')
openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
creat(&(0x7f0000000000)='./file1\x00', 0x100)

00:21:07 executing program 1:
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}}, 0x0, 0x6, 0xffffffffffffffff, 0xb)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
r1 = gettid()
rt_sigqueueinfo(0x0, 0x0, 0x0)
r2 = pidfd_getfd(0xffffffffffffffff, r0, 0x0)
perf_event_open(&(0x7f0000000040)={0x5, 0x80, 0x40, 0x71, 0x2, 0x0, 0x0, 0x8000, 0x20, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, @perf_config_ext={0xff}, 0x0, 0x9b5, 0xfa, 0xd, 0x0, 0x8000, 0x55, 0x0, 0x0, 0x0, 0x3ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000400)={0x2, 0x80, 0x2a, 0x81, 0xe0, 0x40, 0x0, 0x63c5ef1c, 0x80, 0x3, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x7, 0x2, @perf_config_ext={0xf2, 0x6}, 0x0, 0x5, 0xfffffff8, 0x0, 0x1, 0x0, 0x1b6, 0x0, 0x6}, 0x0, 0xd, 0xffffffffffffffff, 0x0)
rt_sigqueueinfo(0x0, 0x0, &(0x7f0000000000))
setsockopt$sock_timeval(r0, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10)
bind$packet(r2, &(0x7f00000000c0)={0x11, 0xfe, 0x0, 0x1, 0xfb, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}}, 0x14)
perf_event_open(&(0x7f0000000100)={0x0, 0x80, 0xff, 0x8, 0x4, 0x1, 0x0, 0x4, 0x684, 0x4, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0xdbc, 0x0, @perf_config_ext={0xd03, 0x80000000}, 0x800, 0x3, 0x3, 0x5, 0x300000000000000, 0x7, 0x7ff, 0x0, 0x0, 0x0, 0x5}, r1, 0x0, 0xffffffffffffffff, 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r3, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
openat(r3, &(0x7f0000000180)='\x00', 0x400040, 0x80)
rt_sigqueueinfo(0x0, 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f0000000240)={'ip6_vti0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x4, 0x0, 0x7f, 0x40, 0xb, @local, @mcast1, 0x88, 0x20, 0x8, 0x2}})

[ 2956.362110] loop5: detected capacity change from 0 to 40
[ 2956.418573] syz-executor.5: attempt to access beyond end of device
[ 2956.418573] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2956.419562] Buffer I/O error on dev loop5, logical block 10, lost async page write
[ 2956.424483] loop6: detected capacity change from 0 to 40
[ 2956.472462] syz-executor.6: attempt to access beyond end of device
[ 2956.472462] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2956.473412] Buffer I/O error on dev loop6, logical block 10, lost async page write
00:21:22 executing program 7:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684fd2981c8409820000080000000000000000"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x100d}], 0x5f8, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:21:22 executing program 1:
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}}, 0x0, 0x6, 0xffffffffffffffff, 0xb)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
r1 = gettid()
rt_sigqueueinfo(0x0, 0x0, 0x0)
r2 = pidfd_getfd(0xffffffffffffffff, r0, 0x0)
perf_event_open(&(0x7f0000000040)={0x5, 0x80, 0x40, 0x71, 0x2, 0x0, 0x0, 0x8000, 0x20, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, @perf_config_ext={0xff}, 0x0, 0x9b5, 0xfa, 0xd, 0x0, 0x8000, 0x55, 0x0, 0x0, 0x0, 0x3ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000400)={0x2, 0x80, 0x2a, 0x81, 0xe0, 0x40, 0x0, 0x63c5ef1c, 0x80, 0x3, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x7, 0x2, @perf_config_ext={0xf2, 0x6}, 0x0, 0x5, 0xfffffff8, 0x0, 0x1, 0x0, 0x1b6, 0x0, 0x6}, 0x0, 0xd, 0xffffffffffffffff, 0x0)
rt_sigqueueinfo(0x0, 0x0, &(0x7f0000000000))
setsockopt$sock_timeval(r0, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10)
bind$packet(r2, &(0x7f00000000c0)={0x11, 0xfe, 0x0, 0x1, 0xfb, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}}, 0x14)
perf_event_open(&(0x7f0000000100)={0x0, 0x80, 0xff, 0x8, 0x4, 0x1, 0x0, 0x4, 0x684, 0x4, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0xdbc, 0x0, @perf_config_ext={0xd03, 0x80000000}, 0x800, 0x3, 0x3, 0x5, 0x300000000000000, 0x7, 0x7ff, 0x0, 0x0, 0x0, 0x5}, r1, 0x0, 0xffffffffffffffff, 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r3, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
openat(r3, &(0x7f0000000180)='\x00', 0x400040, 0x80)
rt_sigqueueinfo(0x0, 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f0000000240)={'ip6_vti0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x4, 0x0, 0x7f, 0x40, 0xb, @local, @mcast1, 0x88, 0x20, 0x8, 0x2}})

00:21:22 executing program 3:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000", 0x15}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r0, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)

00:21:22 executing program 5:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 95)

00:21:22 executing program 4:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
ioctl$AUTOFS_DEV_IOCTL_EXPIRE(0xffffffffffffffff, 0xc018937c, &(0x7f0000000380)={{0x1, 0x1, 0x18, <r1=>r0}, './file1\x00'})
r2 = openat$tcp_mem(0xffffffffffffff9c, &(0x7f00000003c0)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0)
ioctl$AUTOFS_DEV_IOCTL_EXPIRE(r1, 0xc018937c, &(0x7f0000000400)={{0x1, 0x1, 0x18, r2, {0x2}}, './file1\x00'})
openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r3, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
openat(r3, &(0x7f0000000040)='./file2\x00', 0x101000, 0x8)
syz_mount_image$tmpfs(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r5 = socket$nl_generic(0x10, 0x3, 0x10)
r6 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000180), 0xffffffffffffffff)
sendmsg$IPVS_CMD_FLUSH(r5, &(0x7f0000000340)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000240)={0xcc, r6, 0x200, 0x70bd26, 0x25dfdbfd, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x10001}, @IPVS_CMD_ATTR_SERVICE={0x3c, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x3}, @IPVS_SVC_ATTR_AF={0x6, 0x1, 0x2}, @IPVS_SVC_ATTR_PORT={0x6, 0x4, 0x4e22}, @IPVS_SVC_ATTR_SCHED_NAME={0x7, 0x6, 'lc\x00'}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x2}, @IPVS_SVC_ATTR_SCHED_NAME={0x7, 0x6, 'rr\x00'}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x1}]}, @IPVS_CMD_ATTR_DAEMON={0x20, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'wg0\x00'}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x6, 0x4, 0xaaa}]}, @IPVS_CMD_ATTR_DEST={0x44, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_U_THRESH={0x8}, @IPVS_DEST_ATTR_TUN_FLAGS={0x6, 0xf, 0xe9}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x10000}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x9}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x1ff}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0xfffffffa}, @IPVS_DEST_ATTR_TUN_PORT={0x6, 0xe, 0x4e20}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x3ff}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8}]}, 0xcc}, 0x1, 0x0, 0x0, 0x42044}, 0x20000011)
openat(r0, &(0x7f0000000000)='./file0\x00', 0x412cc2, 0x51)
write$binfmt_aout(r4, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r4, 0xffffffffffffffff, 0x0, 0xfffffdef)

[ 2971.959516] loop4: detected capacity change from 0 to 40
00:21:22 executing program 2:
chdir(&(0x7f0000000140)='./file0\x00')
openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
creat(&(0x7f0000000000)='./file1\x00', 0x100)

00:21:22 executing program 0:
perf_event_open(&(0x7f0000000080)={0x0, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r1, &(0x7f0000000100), 0x0, 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r0, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r2, 0x280000, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0x0, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r1, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:21:22 executing program 6:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 97)

[ 2972.004120] loop5: detected capacity change from 0 to 40
[ 2972.006785] loop6: detected capacity change from 0 to 40
[ 2972.060251] loop3: detected capacity change from 0 to 40
[ 2972.064808] syz-executor.6: attempt to access beyond end of device
[ 2972.064808] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2972.065760] Buffer I/O error on dev loop6, logical block 10, lost async page write
[ 2972.088798] FAT-fs (loop3): invalid media value (0x00)
[ 2972.089626] FAT-fs (loop3): Can't find a valid FAT filesystem
[ 2972.138072] syz-executor.5: attempt to access beyond end of device
[ 2972.138072] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40
00:21:22 executing program 6:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 98)

[ 2972.140014] Buffer I/O error on dev loop5, logical block 10, lost async page write
00:21:22 executing program 1:
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}}, 0x0, 0x6, 0xffffffffffffffff, 0xb)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
r1 = gettid()
rt_sigqueueinfo(0x0, 0x0, 0x0)
r2 = pidfd_getfd(0xffffffffffffffff, r0, 0x0)
perf_event_open(&(0x7f0000000040)={0x5, 0x80, 0x40, 0x71, 0x2, 0x0, 0x0, 0x8000, 0x20, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, @perf_config_ext={0xff}, 0x0, 0x9b5, 0xfa, 0xd, 0x0, 0x8000, 0x55, 0x0, 0x0, 0x0, 0x3ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000400)={0x2, 0x80, 0x2a, 0x81, 0xe0, 0x40, 0x0, 0x63c5ef1c, 0x80, 0x3, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x7, 0x2, @perf_config_ext={0xf2, 0x6}, 0x0, 0x5, 0xfffffff8, 0x0, 0x1, 0x0, 0x1b6, 0x0, 0x6}, 0x0, 0xd, 0xffffffffffffffff, 0x0)
rt_sigqueueinfo(0x0, 0x0, &(0x7f0000000000))
setsockopt$sock_timeval(r0, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10)
bind$packet(r2, &(0x7f00000000c0)={0x11, 0xfe, 0x0, 0x1, 0xfb, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}}, 0x14)
perf_event_open(&(0x7f0000000100)={0x0, 0x80, 0xff, 0x8, 0x4, 0x1, 0x0, 0x4, 0x684, 0x4, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0xdbc, 0x0, @perf_config_ext={0xd03, 0x80000000}, 0x800, 0x3, 0x3, 0x5, 0x300000000000000, 0x7, 0x7ff, 0x0, 0x0, 0x0, 0x5}, r1, 0x0, 0xffffffffffffffff, 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r3, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
openat(r3, &(0x7f0000000180)='\x00', 0x400040, 0x80)
rt_sigqueueinfo(0x0, 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f0000000240)={'ip6_vti0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x4, 0x0, 0x7f, 0x40, 0xb, @local, @mcast1, 0x88, 0x20, 0x8, 0x2}})

00:21:22 executing program 2:
chdir(&(0x7f0000000140)='./file0\x00')
openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
creat(&(0x7f0000000000)='./file1\x00', 0x100)

00:21:22 executing program 5:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 96)

00:21:22 executing program 3:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000", 0x15}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r0, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)

[ 2972.272834] loop6: detected capacity change from 0 to 40
[ 2972.320263] loop5: detected capacity change from 0 to 40
[ 2972.362953] syz-executor.5: attempt to access beyond end of device
[ 2972.362953] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2972.364061] Buffer I/O error on dev loop5, logical block 10, lost async page write
[ 2972.394858] loop3: detected capacity change from 0 to 40
[ 2972.412514] FAT-fs (loop3): invalid media value (0x00)
[ 2972.412932] FAT-fs (loop3): Can't find a valid FAT filesystem
[ 2972.440332] syz-executor.6: attempt to access beyond end of device
[ 2972.440332] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2972.442186] Buffer I/O error on dev loop6, logical block 10, lost async page write
00:21:41 executing program 6:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 99)

00:21:41 executing program 0:
perf_event_open(&(0x7f0000000080)={0x0, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r1, &(0x7f0000000100), 0x0, 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r0, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r2, 0x280600, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0x0, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r1, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:21:41 executing program 3:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f8", 0x16}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r0, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)

00:21:41 executing program 5:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 97)

00:21:41 executing program 4:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0xaaaaaaaaaaaaab0, &(0x7f00000003c0)=[{&(0x7f0000000240)="04000000646f7366d8a02b00080101000440002000f8011f3aa66fabd57aeb97479d196ba90244133bccc2297dbe9400bb1e3edfc7c0dfab398f6b2642268530fc554b08ab38e19aa45d50606dbb3a40f1c243dba2b9c1dd54b48cee937b31cc481f8c2ce493f4cce15dfec76b2a16bf81a3234e963b41c31444d933aba03be6f09c3d2503eeee6f48960d7e35303539b6bdc1846fcc91e2c7bd3b09351b459fd33f9ebdc41c6869723b297f6d12d9cd63d0196d8b8ce4186cdf560df519b1b024205ad6ed8391b3453a0a3a65713b5c7763415367c05fa1b42ac8", 0xdb}, {0x0, 0x0, 0x2800}, {&(0x7f0000000180)="430700555802df19c1498eb9c8b85c044a76b4c8679f12a9cc10152c580bb66f4397611b083c17eb63f46ebaf47fd83649a7fa3b33ef24be520073df1d012d0028615553011ed5939f8c616d", 0x0, 0x3ff}, {&(0x7f0000000340)="e71d0135803c79f18015eb371b18af244fdc6b4784c2e50ae66c563f3c2eb2aee0cb22c564779d9d9fc936c1642549aa62b0d5f1b0e619715540e89c7737b45afc6b0b51b1d7386063b0070113459f112513c5a4a50f20803cabf611af", 0x0, 0x8}], 0x410, &(0x7f0000000040)=ANY=[@ANYRES64])
chdir(&(0x7f0000000140)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
openat(r0, &(0x7f0000000000)='./file0\x00', 0x604040, 0x40)
syz_mount_image$tmpfs(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r2, r1, 0x0, 0xfffffdef)

00:21:41 executing program 2:
syz_mount_image$vfat(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
creat(&(0x7f0000000000)='./file1\x00', 0x100)

00:21:41 executing program 1:
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}}, 0x0, 0x6, 0xffffffffffffffff, 0xb)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
r1 = gettid()
rt_sigqueueinfo(0x0, 0x0, 0x0)
r2 = pidfd_getfd(0xffffffffffffffff, r0, 0x0)
perf_event_open(&(0x7f0000000040)={0x5, 0x80, 0x40, 0x71, 0x2, 0x0, 0x0, 0x8000, 0x20, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, @perf_config_ext={0xff}, 0x0, 0x9b5, 0xfa, 0xd, 0x0, 0x8000, 0x55, 0x0, 0x0, 0x0, 0x3ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000400)={0x2, 0x80, 0x2a, 0x81, 0xe0, 0x40, 0x0, 0x63c5ef1c, 0x80, 0x3, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x7, 0x2, @perf_config_ext={0xf2, 0x6}, 0x0, 0x5, 0xfffffff8, 0x0, 0x1, 0x0, 0x1b6, 0x0, 0x6}, 0x0, 0xd, 0xffffffffffffffff, 0x0)
rt_sigqueueinfo(0x0, 0x0, &(0x7f0000000000))
setsockopt$sock_timeval(r0, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10)
bind$packet(r2, &(0x7f00000000c0)={0x11, 0xfe, 0x0, 0x1, 0xfb, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}}, 0x14)
perf_event_open(&(0x7f0000000100)={0x0, 0x80, 0xff, 0x8, 0x4, 0x1, 0x0, 0x4, 0x684, 0x4, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0xdbc, 0x0, @perf_config_ext={0xd03, 0x80000000}, 0x800, 0x3, 0x3, 0x5, 0x300000000000000, 0x7, 0x7ff, 0x0, 0x0, 0x0, 0x5}, r1, 0x10, 0xffffffffffffffff, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r3, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
openat(r3, &(0x7f0000000180)='\x00', 0x400040, 0x80)
rt_sigqueueinfo(0x0, 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f0000000240)={'ip6_vti0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x4, 0x0, 0x7f, 0x40, 0xb, @local, @mcast1, 0x88, 0x20, 0x8, 0x2}})

00:21:41 executing program 7:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684fd2981c8409820000080000000000000000"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x100d}], 0x5fe, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

[ 2991.267019] loop3: detected capacity change from 0 to 40
[ 2991.267787] loop2: detected capacity change from 0 to 40
00:21:41 executing program 0:
perf_event_open(&(0x7f0000000080)={0x0, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r1, &(0x7f0000000100), 0x0, 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r0, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r2, 0x300000, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0x0, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r1, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

[ 2991.295478] loop5: detected capacity change from 0 to 40
[ 2991.299016] FAT-fs (loop3): bogus number of FAT sectors
[ 2991.299840] FAT-fs (loop3): Can't find a valid FAT filesystem
[ 2991.334343] loop6: detected capacity change from 0 to 40
[ 2991.352794] syz-executor.5: attempt to access beyond end of device
[ 2991.352794] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2991.353954] Buffer I/O error on dev loop5, logical block 10, lost async page write
00:21:42 executing program 2:
syz_mount_image$vfat(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
creat(&(0x7f0000000000)='./file1\x00', 0x100)

00:21:42 executing program 5:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 98)

00:21:42 executing program 1:
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}}, 0x0, 0x6, 0xffffffffffffffff, 0xb)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
r1 = gettid()
rt_sigqueueinfo(0x0, 0x0, 0x0)
r2 = pidfd_getfd(0xffffffffffffffff, r0, 0x0)
perf_event_open(&(0x7f0000000040)={0x5, 0x80, 0x40, 0x71, 0x2, 0x0, 0x0, 0x8000, 0x20, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, @perf_config_ext={0xff}, 0x0, 0x9b5, 0xfa, 0xd, 0x0, 0x8000, 0x55, 0x0, 0x0, 0x0, 0x3ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000400)={0x2, 0x80, 0x2a, 0x81, 0xe0, 0x40, 0x0, 0x63c5ef1c, 0x80, 0x3, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x7, 0x2, @perf_config_ext={0xf2, 0x6}, 0x0, 0x5, 0xfffffff8, 0x0, 0x1, 0x0, 0x1b6, 0x0, 0x6}, 0x0, 0xd, 0xffffffffffffffff, 0x0)
rt_sigqueueinfo(0x0, 0x0, &(0x7f0000000000))
setsockopt$sock_timeval(r0, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10)
bind$packet(r2, &(0x7f00000000c0)={0x11, 0xfe, 0x0, 0x1, 0xfb, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}}, 0x14)
perf_event_open(&(0x7f0000000100)={0x0, 0x80, 0xff, 0x8, 0x4, 0x1, 0x0, 0x4, 0x684, 0x4, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0xdbc, 0x0, @perf_config_ext={0xd03, 0x80000000}, 0x800, 0x3, 0x3, 0x5, 0x300000000000000, 0x7, 0x7ff, 0x0, 0x0, 0x0, 0x5}, r1, 0x10, 0xffffffffffffffff, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r3, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
openat(r3, &(0x7f0000000180)='\x00', 0x400040, 0x80)
rt_sigqueueinfo(0x0, 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f0000000240)={'ip6_vti0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x4, 0x0, 0x7f, 0x40, 0xb, @local, @mcast1, 0x88, 0x20, 0x8, 0x2}})

[ 2991.500276] syz-executor.6: attempt to access beyond end of device
[ 2991.500276] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2991.502179] Buffer I/O error on dev loop6, logical block 10, lost async page write
00:21:42 executing program 3:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f8", 0x16}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r0, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)

[ 2991.525852] loop5: detected capacity change from 0 to 40
[ 2991.588761] FAULT_INJECTION: forcing a failure.
[ 2991.588761] name failslab, interval 1, probability 0, space 0, times 0
[ 2991.589611] CPU: 0 PID: 14234 Comm: syz-executor.5 Not tainted 6.1.0-rc8-next-20221208 #1
[ 2991.590205] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
[ 2991.590794] Call Trace:
[ 2991.590992]  <TASK>
[ 2991.591183]  dump_stack_lvl+0x8f/0xb7
[ 2991.591478]  should_fail_ex.cold+0x5/0xa
[ 2991.591793]  should_failslab+0x9/0x20
[ 2991.592089]  __kmem_cache_alloc_node+0x5b/0x400
[ 2991.592442]  ? iter_file_splice_write+0x169/0xcb0
[ 2991.592814]  ? iter_file_splice_write+0x169/0xcb0
[ 2991.593185]  __kmalloc+0x46/0xc0
[ 2991.593454]  iter_file_splice_write+0x169/0xcb0
[ 2991.593806]  ? generic_file_read_iter+0x330/0x550
[ 2991.594189]  ? generic_file_splice_read+0x1bc/0x4d0
[ 2991.594554]  ? __pfx_iter_file_splice_write+0x10/0x10
[ 2991.594945]  ? __pfx_generic_file_splice_read+0x10/0x10
[ 2991.595358]  ? inode_security+0x105/0x140
[ 2991.595686]  ? security_file_permission+0xb5/0xe0
[ 2991.596057]  ? __pfx_iter_file_splice_write+0x10/0x10
[ 2991.596443]  direct_splice_actor+0x113/0x180
[ 2991.596773]  splice_direct_to_actor+0x33a/0x8c0
[ 2991.597128]  ? __pfx_direct_splice_actor+0x10/0x10
[ 2991.597503]  ? __pfx_splice_direct_to_actor+0x10/0x10
[ 2991.597896]  ? security_file_permission+0xb5/0xe0
[ 2991.598270]  do_splice_direct+0x1bc/0x290
[ 2991.598582]  ? __pfx_do_splice_direct+0x10/0x10
[ 2991.598931]  ? lock_is_held_type+0xdb/0x130
[ 2991.599275]  do_sendfile+0xb1d/0x1280
[ 2991.599582]  ? __pfx_do_sendfile+0x10/0x10
[ 2991.599923]  ? lock_is_held_type+0xdb/0x130
[ 2991.600256]  __x64_sys_sendfile64+0x248/0x2a0
[ 2991.600591]  ? trace_rcu_dyntick+0x1a7/0x250
[ 2991.600934]  ? __pfx___x64_sys_sendfile64+0x10/0x10
[ 2991.601308]  ? syscall_enter_from_user_mode+0x21/0x50
[ 2991.601680]  ? syscall_enter_from_user_mode+0x21/0x50
[ 2991.602055]  do_syscall_64+0x3f/0x90
[ 2991.602341]  entry_SYSCALL_64_after_hwframe+0x72/0xdc
[ 2991.602716] RIP: 0033:0x7f5e74c67b19
[ 2991.602994] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
[ 2991.604281] RSP: 002b:00007f5e721dd188 EFLAGS: 00000246 ORIG_RAX: 0000000000000028
[ 2991.604819] RAX: ffffffffffffffda RBX: 00007f5e74d7af60 RCX: 00007f5e74c67b19
[ 2991.605329] RDX: 0000000000000000 RSI: 0000000000000003 RDI: 0000000000000004
[ 2991.605840] RBP: 00007f5e721dd1d0 R08: 0000000000000000 R09: 0000000000000000
[ 2991.606350] R10: 00000000fffffdef R11: 0000000000000246 R12: 0000000000000002
[ 2991.606858] R13: 00007ffd3dbd647f R14: 00007f5e721dd300 R15: 0000000000022000
[ 2991.607407]  </TASK>
[ 2991.689990] loop2: detected capacity change from 0 to 40
00:21:42 executing program 0:
perf_event_open(&(0x7f0000000080)={0x0, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r1, &(0x7f0000000100), 0x0, 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r0, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r2, 0x380000, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0x0, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r1, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:21:42 executing program 6:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 100)

[ 2991.799130] loop3: detected capacity change from 0 to 40
[ 2991.822892] FAT-fs (loop3): bogus number of FAT sectors
[ 2991.823354] FAT-fs (loop3): Can't find a valid FAT filesystem
00:21:42 executing program 5:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 99)

[ 2992.039238] loop6: detected capacity change from 0 to 40
[ 2992.094224] loop5: detected capacity change from 0 to 40
[ 2992.158642] syz-executor.6: attempt to access beyond end of device
[ 2992.158642] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2992.159754] Buffer I/O error on dev loop6, logical block 10, lost async page write
[ 2992.205808] syz-executor.5: attempt to access beyond end of device
[ 2992.205808] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 2992.206890] Buffer I/O error on dev loop5, logical block 10, lost async page write
00:21:59 executing program 1:
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}}, 0x0, 0x6, 0xffffffffffffffff, 0xb)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
r1 = gettid()
rt_sigqueueinfo(0x0, 0x0, 0x0)
r2 = pidfd_getfd(0xffffffffffffffff, r0, 0x0)
perf_event_open(&(0x7f0000000040)={0x5, 0x80, 0x40, 0x71, 0x2, 0x0, 0x0, 0x8000, 0x20, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, @perf_config_ext={0xff}, 0x0, 0x9b5, 0xfa, 0xd, 0x0, 0x8000, 0x55, 0x0, 0x0, 0x0, 0x3ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000400)={0x2, 0x80, 0x2a, 0x81, 0xe0, 0x40, 0x0, 0x63c5ef1c, 0x80, 0x3, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x7, 0x2, @perf_config_ext={0xf2, 0x6}, 0x0, 0x5, 0xfffffff8, 0x0, 0x1, 0x0, 0x1b6, 0x0, 0x6}, 0x0, 0xd, 0xffffffffffffffff, 0x0)
rt_sigqueueinfo(0x0, 0x0, &(0x7f0000000000))
setsockopt$sock_timeval(r0, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10)
bind$packet(r2, &(0x7f00000000c0)={0x11, 0xfe, 0x0, 0x1, 0xfb, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}}, 0x14)
perf_event_open(&(0x7f0000000100)={0x0, 0x80, 0xff, 0x8, 0x4, 0x1, 0x0, 0x4, 0x684, 0x4, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0xdbc, 0x0, @perf_config_ext={0xd03, 0x80000000}, 0x800, 0x3, 0x3, 0x5, 0x300000000000000, 0x7, 0x7ff, 0x0, 0x0, 0x0, 0x5}, r1, 0x10, 0xffffffffffffffff, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r3, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
openat(r3, &(0x7f0000000180)='\x00', 0x400040, 0x80)
rt_sigqueueinfo(0x0, 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f0000000240)={'ip6_vti0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x4, 0x0, 0x7f, 0x40, 0xb, @local, @mcast1, 0x88, 0x20, 0x8, 0x2}})

00:21:59 executing program 2:
syz_mount_image$vfat(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
creat(&(0x7f0000000000)='./file1\x00', 0x100)

00:21:59 executing program 3:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f8", 0x16}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r0, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)

00:21:59 executing program 0:
perf_event_open(&(0x7f0000000080)={0x0, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r1, &(0x7f0000000100), 0x0, 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r0, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r2, 0x400000, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0x0, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r1, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:21:59 executing program 7:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684fd2981c8409820000080000000000000000"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x100d}], 0x604, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:21:59 executing program 6:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef)

00:21:59 executing program 5:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef) (fail_nth: 100)

00:21:59 executing program 4:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
fallocate(0xffffffffffffffff, 0x2a, 0x2, 0x6)
r2 = syz_mount_image$tmpfs(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
io_uring_register$IORING_REGISTER_FILES_UPDATE(0xffffffffffffffff, 0x6, &(0x7f0000001900)={0x5, 0x0, &(0x7f00000018c0)=[0xffffffffffffffff, r2, 0xffffffffffffffff, 0xffffffffffffffff]}, 0x4)
mknod$loop(&(0x7f0000000040)='./file0\x00', 0x401, 0x1)
link(&(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='.\x00')
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
stat(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, <r4=>0x0})
setresuid(0x0, r4, 0x0)
r5 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0x76, 0x0, 0x0, 0x40, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x8, 0x1}, 0x40, 0x100}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r6 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fstat(r5, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, <r7=>0x0})
fsetxattr$system_posix_acl(r6, &(0x7f0000000440)='system.posix_acl_access\x00', &(0x7f0000000340)=ANY=[@ANYBLOB="020000003707040000eeffff01000000bcca3b6a1df9d1e13691487b6717ff", @ANYRES32=0x0, @ANYBLOB="02000500", @ANYRES32=0x0, @ANYBLOB="040003000000000008000600", @ANYRES32=r7, @ANYBLOB="100004000000000020"], 0x3c, 0x0)
fchownat(r0, &(0x7f00000001c0)='./file1\x00', r4, r7, 0x1000)
write$binfmt_aout(r3, &(0x7f0000001180)=ANY=[], 0x220)
r8 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
ioctl$EXT4_IOC_SWAP_BOOT(r8, 0x6611)
setsockopt$bt_BT_POWER(r8, 0x112, 0x9, &(0x7f0000000180)=0x3, 0x1)
sendfile(r3, r1, 0x0, 0xfffffdef)

[ 3008.631436] loop3: detected capacity change from 0 to 40
[ 3008.636488] loop4: detected capacity change from 0 to 40
[ 3008.637750] loop6: detected capacity change from 0 to 40
[ 3008.638605] loop5: detected capacity change from 0 to 40
[ 3008.640773] loop2: detected capacity change from 0 to 40
[ 3008.644070] FAT-fs (loop3): bogus number of FAT sectors
[ 3008.644469] FAT-fs (loop3): Can't find a valid FAT filesystem
[ 3008.696602] syz-executor.6: attempt to access beyond end of device
[ 3008.696602] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 3008.697632] Buffer I/O error on dev loop6, logical block 10, lost async page write
[ 3008.713254] syz-executor.5: attempt to access beyond end of device
[ 3008.713254] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 3008.714378] Buffer I/O error on dev loop5, logical block 10, lost async page write
00:21:59 executing program 1:
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}}, 0x0, 0x6, 0xffffffffffffffff, 0xb)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
r1 = gettid()
rt_sigqueueinfo(0x0, 0x0, 0x0)
r2 = pidfd_getfd(0xffffffffffffffff, r0, 0x0)
perf_event_open(&(0x7f0000000040)={0x5, 0x80, 0x40, 0x71, 0x2, 0x0, 0x0, 0x8000, 0x20, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, @perf_config_ext={0xff}, 0x0, 0x9b5, 0xfa, 0xd, 0x0, 0x8000, 0x55, 0x0, 0x0, 0x0, 0x3ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000400)={0x2, 0x80, 0x2a, 0x81, 0xe0, 0x40, 0x0, 0x63c5ef1c, 0x80, 0x3, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x7, 0x2, @perf_config_ext={0xf2, 0x6}, 0x0, 0x5, 0xfffffff8, 0x0, 0x1, 0x0, 0x1b6, 0x0, 0x6}, 0x0, 0xd, 0xffffffffffffffff, 0x0)
rt_sigqueueinfo(0x0, 0x0, &(0x7f0000000000))
setsockopt$sock_timeval(r0, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10)
bind$packet(r2, &(0x7f00000000c0)={0x11, 0xfe, 0x0, 0x1, 0xfb, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}}, 0x14)
perf_event_open(&(0x7f0000000100)={0x0, 0x80, 0xff, 0x8, 0x4, 0x1, 0x0, 0x4, 0x684, 0x4, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0xdbc, 0x0, @perf_config_ext={0xd03, 0x80000000}, 0x800, 0x3, 0x3, 0x5, 0x300000000000000, 0x7, 0x7ff, 0x0, 0x0, 0x0, 0x5}, r1, 0x10, 0xffffffffffffffff, 0x2)
r3 = openat(0xffffffffffffff9c, 0x0, 0x141042, 0x0)
pwritev(r3, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
openat(r3, &(0x7f0000000180)='\x00', 0x400040, 0x80)
rt_sigqueueinfo(0x0, 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f0000000240)={'ip6_vti0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x4, 0x0, 0x7f, 0x40, 0xb, @local, @mcast1, 0x88, 0x20, 0x8, 0x2}})

00:21:59 executing program 0:
perf_event_open(&(0x7f0000000080)={0x0, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r1, &(0x7f0000000100), 0x0, 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r0, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r2, 0x480000, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0x0, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r1, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:21:59 executing program 3:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r0, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)

00:21:59 executing program 2:
syz_mount_image$vfat(&(0x7f0000000080), 0x0, 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
creat(&(0x7f0000000000)='./file1\x00', 0x100)

00:21:59 executing program 5:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef)

00:21:59 executing program 6:
r0 = syz_open_dev$tty1(0xc, 0x4, 0x1)
writev(r0, &(0x7f0000000000)=[{&(0x7f0000000140)="02b2dccad213e1e6cf54b7a797f8f22a47f25b7658fb110b2e76f95b0f318b8fa745e6ffba4414d29a42bfab524bc5bffb17decc4540a6f00b9772f5f9789a9525790df8d989b23530d0a1398f2ad734c7ff47961be476ffeec81efa3d3aa64b8ea329261dfc2e1047a68670f0e5950d6a5414956bddd09e101b5b66e5742fe843413e065e3b86a242b37bc58c68153a45015f6f1ea67762c302e461e0c84bbb7f8d464f5a72d9fad56dac0c5028a4012a93dbc7da640786e3c9898cdd8fe091b166bfcd66e6257abc923ceaf90e994deded3fe8a59c2105f5caf366d32170ef51299dbf441bc3cddda352a2e07375fb44e75fed8082f3e960015d9bcddb0c834feda68d113a9a9fc0d1c30153685caf43b176219b666d74e67b6192cfd8a561c6c4aadcc80ed8c469bc41b028f1db515d699e45ad3379f9b1edb8de4bb2f8615d6716297baac7e45073fcecf31e51ec78c40edd78f245bced04414f849fb961fbbe79ff2ed7c48ec1b5331f9755d7094986fc8da198ce4a12f9ddfb43e565bc4fed618da9a693d03c3e7ec4b3014dfc022103e277c1b12efb03ef8b197f3a931f6cbe238cf8a4e7639b409b4586f66da41b94eed69d52ba9fde5aa1ee774d4e626932dc3511b10ae3bc3e8688a7a83b0467dfbf92951747396735c9f47ad4552e7bdf4f8e7998a1266a360beb2ec1527390452139f9ab91ee250efcf3413e72a6b2688d8b6a4748ccc165bbf886573ccdd03bd93f32a866cd878ec246e06f31d4d7f7ec9836b7305ee0c1b9fa75cd6e4ca5cc2f107b654f15a2442cd9c8eaf581d093639fe35e0da49394c5ed66ad29bc2b863649e16c1951d0d3dd6f1048539e558ee1f059d91510a5acd84777ca01545635d2fb40e2f205bb11435023e47e4e2f85b6d1b56b688dd1a4304708a561d32dbaa6cd4f969e67af33773d4e9772751019dc6c2af7e2fe9d3c7eb6f1b401926603d90802f792b081957dd5ebd18410cd42b2ea05ae9a61254e4b878384b8a376fe9eba06afc1253f2224fab88feb7c426e3dfb19385afbb42cc13209b419568eeafdf505dc5ca30acc17d337e941e0badf9f9413f381fe9a315e2597426805827943f193f02a12554d434bd91708a28d9da1bf64ad64f80a7287d1e02d5d1f14bf9d89ba3badfa524694db6a651e97ea64104ad34942f36745259f4ec32fdce0bd13e693ccbe0e012e61a1fae9fc1662b99871e3812cea14d12646ccc08b0514762a475ecdbf9071377bb1ecd891c6fe32fde1d3044caf466b3a342b7541e8ed7432e94baf1d5546aff0e23f6a03c9ea5635519533e712639c27958e3a0f3684ed91cfb2e6e4", 0x3b8}], 0x1)
ioctl$TIOCL_GETSHIFTSTATE(r0, 0x541c, &(0x7f0000000040)={0x6, 0x1})
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x101042, 0x91)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./file1\x00', 0x2a0182, 0xd)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r2, r1, 0x0, 0xfffffdef)

[ 3008.811733] loop2: detected capacity change from 0 to 40
[ 3008.858302] loop3: detected capacity change from 0 to 40
[ 3008.870619] loop5: detected capacity change from 0 to 40
00:21:59 executing program 2:
syz_mount_image$vfat(&(0x7f0000000080), 0x0, 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
creat(&(0x7f0000000000)='./file1\x00', 0x100)

00:21:59 executing program 7:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684fd2981c8409820000080000000000000000"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x100d}], 0x60d, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:21:59 executing program 1:
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}}, 0x0, 0x6, 0xffffffffffffffff, 0xb)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
r1 = gettid()
rt_sigqueueinfo(0x0, 0x0, 0x0)
r2 = pidfd_getfd(0xffffffffffffffff, r0, 0x0)
perf_event_open(&(0x7f0000000040)={0x5, 0x80, 0x40, 0x71, 0x2, 0x0, 0x0, 0x8000, 0x20, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, @perf_config_ext={0xff}, 0x0, 0x9b5, 0xfa, 0xd, 0x0, 0x8000, 0x55, 0x0, 0x0, 0x0, 0x3ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000400)={0x2, 0x80, 0x2a, 0x81, 0xe0, 0x40, 0x0, 0x63c5ef1c, 0x80, 0x3, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x7, 0x2, @perf_config_ext={0xf2, 0x6}, 0x0, 0x5, 0xfffffff8, 0x0, 0x1, 0x0, 0x1b6, 0x0, 0x6}, 0x0, 0xd, 0xffffffffffffffff, 0x0)
rt_sigqueueinfo(0x0, 0x0, &(0x7f0000000000))
setsockopt$sock_timeval(r0, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10)
bind$packet(r2, &(0x7f00000000c0)={0x11, 0xfe, 0x0, 0x1, 0xfb, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}}, 0x14)
perf_event_open(&(0x7f0000000100)={0x0, 0x80, 0xff, 0x8, 0x4, 0x1, 0x0, 0x4, 0x684, 0x4, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0xdbc, 0x0, @perf_config_ext={0xd03, 0x80000000}, 0x800, 0x3, 0x3, 0x5, 0x300000000000000, 0x7, 0x7ff, 0x0, 0x0, 0x0, 0x5}, r1, 0x10, 0xffffffffffffffff, 0x2)
r3 = openat(0xffffffffffffff9c, 0x0, 0x141042, 0x0)
pwritev(r3, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
openat(r3, &(0x7f0000000180)='\x00', 0x400040, 0x80)
rt_sigqueueinfo(0x0, 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f0000000240)={'ip6_vti0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x4, 0x0, 0x7f, 0x40, 0xb, @local, @mcast1, 0x88, 0x20, 0x8, 0x2}})

[ 3008.999111] loop6: detected capacity change from 0 to 40
[ 3009.006693] syz-executor.5: attempt to access beyond end of device
[ 3009.006693] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 3009.007681] Buffer I/O error on dev loop5, logical block 10, lost async page write
00:21:59 executing program 3:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r0, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)

[ 3009.020265] FAT-fs (loop6): Unrecognized mount option "�������T�����*G�[vX�.v�[1���E���DҚB��RKſ���E@���r��x��%y�ى�50С9�*�4��G��v����=:�K��)&�.G��p��jT�k�О�t/�CA>^;��B�{Ōh:E
_o�wb��a��K��FOZr���m�P(�
*����d��ɉ�ݏ��" or missing value
[ 3009.035879] loop2: detected capacity change from 0 to 40
[ 3009.099487] loop6: detected capacity change from 0 to 40
[ 3009.108841] FAT-fs (loop6): Unrecognized mount option "./file0" or missing value
[ 3009.134911] loop3: detected capacity change from 0 to 40
00:22:18 executing program 0:
perf_event_open(&(0x7f0000000080)={0x0, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r1, &(0x7f0000000100), 0x0, 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r0, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r2, 0x500000, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0x0, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r1, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:22:18 executing program 2:
syz_mount_image$vfat(&(0x7f0000000080), 0x0, 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
creat(&(0x7f0000000000)='./file1\x00', 0x100)

00:22:18 executing program 4:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_mount_image$tmpfs(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
r2 = openat(r1, &(0x7f0000000040)='./file0\x00', 0x28000, 0x2)
r3 = openat(r2, &(0x7f0000000100)='./file0\x00', 0x101042, 0x0)
sendfile(r0, r1, 0x0, 0xf029)
openat(r1, &(0x7f0000000000)='./file1\x00', 0x2000, 0x206)
write$binfmt_aout(r3, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r3, r1, 0x0, 0xfffffdef)

00:22:18 executing program 7:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684fd2981c8409820000080000000000000000"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x100d}], 0x612, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

[ 3028.069724] loop2: detected capacity change from 0 to 40
00:22:18 executing program 6:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
write$binfmt_aout(0xffffffffffffffff, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(0xffffffffffffffff, r0, 0x0, 0xfffffdef)
bind$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x4e20, @loopback}, 0x10)

[ 3028.076703] loop4: detected capacity change from 0 to 40
00:22:18 executing program 1:
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}}, 0x0, 0x6, 0xffffffffffffffff, 0xb)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
r1 = gettid()
rt_sigqueueinfo(0x0, 0x0, 0x0)
r2 = pidfd_getfd(0xffffffffffffffff, r0, 0x0)
perf_event_open(&(0x7f0000000040)={0x5, 0x80, 0x40, 0x71, 0x2, 0x0, 0x0, 0x8000, 0x20, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, @perf_config_ext={0xff}, 0x0, 0x9b5, 0xfa, 0xd, 0x0, 0x8000, 0x55, 0x0, 0x0, 0x0, 0x3ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000400)={0x2, 0x80, 0x2a, 0x81, 0xe0, 0x40, 0x0, 0x63c5ef1c, 0x80, 0x3, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x7, 0x2, @perf_config_ext={0xf2, 0x6}, 0x0, 0x5, 0xfffffff8, 0x0, 0x1, 0x0, 0x1b6, 0x0, 0x6}, 0x0, 0xd, 0xffffffffffffffff, 0x0)
rt_sigqueueinfo(0x0, 0x0, &(0x7f0000000000))
setsockopt$sock_timeval(r0, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10)
bind$packet(r2, &(0x7f00000000c0)={0x11, 0xfe, 0x0, 0x1, 0xfb, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}}, 0x14)
perf_event_open(&(0x7f0000000100)={0x0, 0x80, 0xff, 0x8, 0x4, 0x1, 0x0, 0x4, 0x684, 0x4, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0xdbc, 0x0, @perf_config_ext={0xd03, 0x80000000}, 0x800, 0x3, 0x3, 0x5, 0x300000000000000, 0x7, 0x7ff, 0x0, 0x0, 0x0, 0x5}, r1, 0x10, 0xffffffffffffffff, 0x2)
r3 = openat(0xffffffffffffff9c, 0x0, 0x141042, 0x0)
pwritev(r3, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
openat(r3, &(0x7f0000000180)='\x00', 0x400040, 0x80)
rt_sigqueueinfo(0x0, 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f0000000240)={'ip6_vti0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x4, 0x0, 0x7f, 0x40, 0xb, @local, @mcast1, 0x88, 0x20, 0x8, 0x2}})

00:22:18 executing program 5:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef)
openat(r0, &(0x7f0000000040)='./file1\x00', 0x200, 0x100)

[ 3028.119798] loop5: detected capacity change from 0 to 40
00:22:18 executing program 3:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r0, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)

[ 3028.155180] loop6: detected capacity change from 0 to 40
[ 3028.165352] loop3: detected capacity change from 0 to 40
00:22:18 executing program 2:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
creat(&(0x7f0000000000)='./file1\x00', 0x100)

[ 3028.220770] syz-executor.5: attempt to access beyond end of device
[ 3028.220770] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 3028.222379] Buffer I/O error on dev loop5, logical block 10, lost async page write
00:22:18 executing program 0:
perf_event_open(&(0x7f0000000080)={0x0, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r1, &(0x7f0000000100), 0x0, 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r0, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r2, 0x580000, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0x0, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r1, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:22:18 executing program 4:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0xfffffffffffffffe, 0x2, &(0x7f0000000200)=[{&(0x7f0000000240)="0421a5fc1482a3d89ca02b000809011d37b1c9b5ca408ceca8bfb43da2cbf8f1e17879b66cbb33a457482b876bf231a5b740ebeebea5a4297469dbe186968020d32c322cc328eee755b4f303755f4c66d0a11dd642299ca6519534335e4ceb46ece88420b41876280179ab6db6535215f2eadde9bf1a411c69021d0bdb6d5f57647b9ba8c7a8cb04d7bc3c81d493489803036d23190f1c964bdb599af7b2f422296639d8bbaf88762e7b735a49e89124c522987f48f6230351faffffa9b4c1592b7b35fd915fef0eaf8417d2d8ed0f8c6db27a3fce241c7a", 0xd8}, {0x0, 0x0, 0x2805}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_mount_image$tmpfs(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x84000, 0x24)
sendfile(r1, r0, 0x0, 0xfffffdef)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
ioctl$EXT4_IOC_SWAP_BOOT(r2, 0x6611)
openat(r2, &(0x7f0000000040)='./file1\x00', 0x8000, 0x40)

00:22:18 executing program 6:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x105802, 0x40)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef)

00:22:18 executing program 3:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x410, 0x0)
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r0, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)

00:22:18 executing program 1:
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}}, 0x0, 0x6, 0xffffffffffffffff, 0xb)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
r1 = gettid()
rt_sigqueueinfo(0x0, 0x0, 0x0)
r2 = pidfd_getfd(0xffffffffffffffff, r0, 0x0)
perf_event_open(&(0x7f0000000040)={0x5, 0x80, 0x40, 0x71, 0x2, 0x0, 0x0, 0x8000, 0x20, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, @perf_config_ext={0xff}, 0x0, 0x9b5, 0xfa, 0xd, 0x0, 0x8000, 0x55, 0x0, 0x0, 0x0, 0x3ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000400)={0x2, 0x80, 0x2a, 0x81, 0xe0, 0x40, 0x0, 0x63c5ef1c, 0x80, 0x3, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x7, 0x2, @perf_config_ext={0xf2, 0x6}, 0x0, 0x5, 0xfffffff8, 0x0, 0x1, 0x0, 0x1b6, 0x0, 0x6}, 0x0, 0xd, 0xffffffffffffffff, 0x0)
rt_sigqueueinfo(0x0, 0x0, &(0x7f0000000000))
setsockopt$sock_timeval(r0, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10)
bind$packet(r2, &(0x7f00000000c0)={0x11, 0xfe, 0x0, 0x1, 0xfb, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}}, 0x14)
perf_event_open(&(0x7f0000000100)={0x0, 0x80, 0xff, 0x8, 0x4, 0x1, 0x0, 0x4, 0x684, 0x4, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0xdbc, 0x0, @perf_config_ext={0xd03, 0x80000000}, 0x800, 0x3, 0x3, 0x5, 0x300000000000000, 0x7, 0x7ff, 0x0, 0x0, 0x0, 0x5}, r1, 0x10, 0xffffffffffffffff, 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x0, 0x0)
pwritev(r3, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
openat(r3, &(0x7f0000000180)='\x00', 0x400040, 0x80)
rt_sigqueueinfo(0x0, 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f0000000240)={'ip6_vti0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x4, 0x0, 0x7f, 0x40, 0xb, @local, @mcast1, 0x88, 0x20, 0x8, 0x2}})

[ 3028.341695] loop4: detected capacity change from 0 to 264192
[ 3028.359044] FAT-fs (loop4): invalid media value (0x40)
[ 3028.359447] FAT-fs (loop4): Can't find a valid FAT filesystem
[ 3028.428041] loop6: detected capacity change from 0 to 40
[ 3028.468235] loop3: detected capacity change from 0 to 40
[ 3029.164949] loop4: detected capacity change from 0 to 264192
[ 3029.166661] FAT-fs (loop4): Unrecognized mount option "./file0" or missing value
00:22:34 executing program 2:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
creat(&(0x7f0000000000)='./file1\x00', 0x100)

00:22:34 executing program 7:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684fd2981c8409820000080000000000000000"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x100d}], 0x618, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:22:34 executing program 1:
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}}, 0x0, 0x6, 0xffffffffffffffff, 0xb)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
r1 = gettid()
rt_sigqueueinfo(0x0, 0x0, 0x0)
r2 = pidfd_getfd(0xffffffffffffffff, r0, 0x0)
perf_event_open(&(0x7f0000000040)={0x5, 0x80, 0x40, 0x71, 0x2, 0x0, 0x0, 0x8000, 0x20, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, @perf_config_ext={0xff}, 0x0, 0x9b5, 0xfa, 0xd, 0x0, 0x8000, 0x55, 0x0, 0x0, 0x0, 0x3ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000400)={0x2, 0x80, 0x2a, 0x81, 0xe0, 0x40, 0x0, 0x63c5ef1c, 0x80, 0x3, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x7, 0x2, @perf_config_ext={0xf2, 0x6}, 0x0, 0x5, 0xfffffff8, 0x0, 0x1, 0x0, 0x1b6, 0x0, 0x6}, 0x0, 0xd, 0xffffffffffffffff, 0x0)
rt_sigqueueinfo(0x0, 0x0, &(0x7f0000000000))
setsockopt$sock_timeval(r0, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10)
bind$packet(r2, &(0x7f00000000c0)={0x11, 0xfe, 0x0, 0x1, 0xfb, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}}, 0x14)
perf_event_open(&(0x7f0000000100)={0x0, 0x80, 0xff, 0x8, 0x4, 0x1, 0x0, 0x4, 0x684, 0x4, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0xdbc, 0x0, @perf_config_ext={0xd03, 0x80000000}, 0x800, 0x3, 0x3, 0x5, 0x300000000000000, 0x7, 0x7ff, 0x0, 0x0, 0x0, 0x5}, r1, 0x10, 0xffffffffffffffff, 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x0, 0x0)
pwritev(r3, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
openat(r3, &(0x7f0000000180)='\x00', 0x400040, 0x80)
rt_sigqueueinfo(0x0, 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f0000000240)={'ip6_vti0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x4, 0x0, 0x7f, 0x40, 0xb, @local, @mcast1, 0x88, 0x20, 0x8, 0x2}})

00:22:34 executing program 5:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f5066d8a02b02080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x100040, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
ioctl$F2FS_IOC_SET_PIN_FILE(r1, 0x4004f50d, &(0x7f0000000040)=0x1)
sendfile(r1, r0, 0x0, 0xfffffdef)

00:22:34 executing program 0:
perf_event_open(&(0x7f0000000080)={0x0, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r1, &(0x7f0000000100), 0x0, 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r0, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r2, 0x600000, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0x0, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r1, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:22:34 executing program 3:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x410, 0x0)
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r0, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)

00:22:34 executing program 6:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r2, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
mknodat$loop(r2, &(0x7f0000000040)='./file1\x00', 0x40, 0x1)

00:22:34 executing program 4:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f00000001c0)=[{&(0x7f0000000180)="1f5a", 0x2, 0x3}, {&(0x7f0000001240)="9443268a986bdfaad26be100d12f2ea769b44dd1cc38fbf9aed98ac49f0ea63f170bf63a03e981db551aae46abde9319b61280453481a63f4c153cb7093f3429b51fd7bbb852c0cc0313f720af48b60fc1de29cce061812d0c3a296fd2c3eade7fd8d1ace3f919b53ebac0dfa90ceed795e9faf7a4165c70d84e8162b0413a6989f26c0c19c2107a35b297cdb0154d51a94b7f7de5bf66d597507bd2146a41d787af8eea8e11b36470937c79474c34df19efce3373b41a0752358c26d176271deb8feb264619a1a33d06344467a802101759c350b8376605371d17fff4", 0xdd, 0x401}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
setxattr$incfs_size(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040), &(0x7f00000000c0)=0x4, 0x8, 0x1)
ftruncate(r0, 0x61)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_dev$tty1(0xc, 0x4, 0x1)
writev(r3, &(0x7f0000000000)=[{&(0x7f0000000140)="02b2dccad213e1e6cf54b7a797f8f22a47f25b7658fb110b2e76f95b0f318b8fa745e6ffba4414d29a42bfab524bc5bffb17decc4540a6f00b9772f5f9789a9525790df8d989b23530d0a1398f2ad734c7ff47961be476ffeec81efa3d3aa64b8ea329261dfc2e1047a68670f0e5950d6a5414956bddd09e101b5b66e5742fe843413e065e3b86a242b37bc58c68153a45015f6f1ea67762c302e461e0c84bbb7f8d464f5a72d9fad56dac0c5028a4012a93dbc7da640786e3c9898cdd8fe091b166bfcd66e6257abc923ceaf90e994deded3fe8a59c2105f5caf366d32170ef51299dbf441bc3cddda352a2e07375fb44e75fed8082f3e960015d9bcddb0c834feda68d113a9a9fc0d1c30153685caf43b176219b666d74e67b6192cfd8a561c6c4aadcc80ed8c469bc41b028f1db515d699e45ad3379f9b1edb8de4bb2f8615d6716297baac7e45073fcecf31e51ec78c40edd78f245bced04414f849fb961fbbe79ff2ed7c48ec1b5331f9755d7094986fc8da198ce4a12f9ddfb43e565bc4fed618da9a693d03c3e7ec4b3014dfc022103e277c1b12efb03ef8b197f3a931f6cbe238cf8a4e7639b409b4586f66da41b94eed69d52ba9fde5aa1ee774d4e626932dc3511b10ae3bc3e8688a7a83b0467dfbf92951747396735c9f47ad4552e7bdf4f8e7998a1266a360beb2ec1527390452139f9ab91ee250efcf3413e72a6b2688d8b6a4748ccc165bbf886573ccdd03bd93f32a866cd878ec246e06f31d4d7f7ec9836b7305ee0c1b9fa75cd6e4ca5cc2f107b654f15a2442cd9c8eaf581d093639fe35e0da49394c5ed66ad29bc2b863649e16c1951d0d3dd6f1048539e558ee1f059d91510a5acd84777ca01545635d2fb40e2f205bb11435023e47e4e2f85b6d1b56b688dd1a4304708a561d32dbaa6cd4f969e67af33773d4e9772751019dc6c2af7e2fe9d3c7eb6f1b401926603d90802f792b081957dd5ebd18410cd42b2ea05ae9a61254e4b878384b8a376fe9eba06afc1253f2224fab88feb7c426e3dfb19385afbb42cc13209b419568eeafdf505dc5ca30acc17d337e941e0badf9f9413f381fe9a315e2597426805827943f193f02a12554d434bd91708a28d9da1bf64ad64f80a7287d1e02d5d1f14bf9d89ba3badfa524694db6a651e97ea64104ad34942f36745259f4ec32fdce0bd13e693ccbe0e012e61a1fae9fc1662b99871e3812cea14d12646ccc08b0514762a475ecdbf9071377bb1ecd891c6fe32fde1d3044caf466b3a342b7541e8ed7432e94baf1d5546aff0e23f6a03c9ea5635519533e712639c27958e3a0f3684ed91cfb2e6e4", 0x3b8}], 0x1)
write$binfmt_aout(0xffffffffffffffff, &(0x7f0000001340)=ANY=[@ANYRESHEX=r2, @ANYRES32=r3, @ANYRESDEC=r0, @ANYRES64, @ANYRESHEX, @ANYRES64=r3], 0x220)
write(r1, &(0x7f0000000240)="b0d41ee896e2bba80a83eeb828b016faf0800c4ff6f6c424560c970df0d8f3bfd31be5a6d1179df08dbf0a61a1b25af0e0bd4cc7922b3186ebb2c469ea52e37260406c2e8ca00e2a97cc79e52d4dd89aae8f5594da4aec5b04d2a130b76cdabf63e241cef4836ad9e71dd53941127722118d5bba6c706b5c4ae2dc7c188a8cdcb79dae2f6cd6d8ff7b3a4dd405506a90672d2d45fd83e7c14800fbbe5629dde857399b75c2860413160c775c8c3b492e5743385197cd86fa99176264ea24991c7d2d4c685fa818849b15ec68ce947d70d1c8f26bf3c86c43b992ca0b2bea42006ee37306b1275470b50fdc05243eeb7c43e35e764bf5d2769b7087954c87cd00f177baeecd716cde913179e6621709f10f79f2e69c249df5175c4bff559cf82ea85b95057168e71407e72d281ebcfd326fe3d9dae0e93b7168d27dab65ef52f906658f9a106abb2f9a191743598fcc47398faa750bd338f82065de97a5e3ccb5c3fba4fc41fae927ab7b9e2697afc04d1b4a38adf2fa891efd073ad3a269592104d161019c968df5b6fe57f013082364ba3afd4ecd4047d4b61d261a0770b3a260afd516eddd494e50e92df99ed37b04d7388636cbba04b4862dfb51c79f104a05b91790b37ba17a20e39b10d7841bfa0817a3c8c19536d2b80589940e0dd60b5a6aed9297cf298126f811d2e8f2c622b1a317f266143dcd36c003a897605e95003bdb6dabf3b12321f12fbfd3abfe528fedf9f1dd0c2fbf928a7b544f74c6b845d624d90fb474573f5f6231672aef2b8d33ea9ce66c1af09ca8e5e0dbfbf5eeea24f2dc33f60267f095b464444808d4cef73923bf1ed37bea178513b338327c1c58774157c67c427c0e1d0648bbddbd36cf4a9af2061e403343888efe8a6e946800f10ac48fea16de0769db85fd5939de5198f32ccd1c78a87b684143f67a83a4266889efdc6bdfa02f025368df0b6231b543b060da394d20f219e5657993dee719067ab93694ebd15b673c633ec221d8617383001ed8ec5dfd60b39b6360d298b646109e9995b10c06d98ee5799e3e3887b0eb167f90718222b667fbc5db1e5b4c19da796a2754d9ad1c90e4e08eb6d9388c723b31ee4b3b84551ae36dc77c7fdb56589af591cad47ff24ae9cde59781384117a17bf82eea0a6a8d1caa2a5e0f00399cc43bddd00078ae0a1ec77738d2489a3ed1056d9ed7772a01ec1148f94b89e507942bfc65ad63fde82bbc2a41f50e3e1465f4bc949fc70d73a241e98619cbd4bb02d91a2627616ba74afcbdde7841dad1f3ff0153e95bb2cecbd8f65f9f6eeba95ee7fcb792bfbec1d00f3eb4134f9b745d27d48b447ec7a7363495ce5dd5b185aa4a02e5c8bf18b19426c6ae291fc6f975435491f30c2e09a5bc60c6f3396210198e148febb4ed73bcbec81a0d95051450e66d4bcf3320e0ff981bffed0e9e9dc85fcde15baf1b553b76cab356e183e5947e1fae81d4ffe42ff42b9470f0c93feeddab0f2ed7952d9efe67d09323a317edd0c84acf5e130158c0d83f026ecad9e6cafd1f26fbdc5380e2cddc0227f3a0b0020813900321456a7d5d7773adb6453183298f8f0737feacea63d7e7447ac313c4ea8ff028b84d5cf174701819e74dc8da4cfcf301f8749e926c77b90368bb281dcab7ce0d4247a340eba7026b1d0dc8f566f1e89dc0f616d3acc557d992aac83163e6ce18d371fa038c5a0c8b90f33bd96a509961840f6214f1cb9da770a48bc98b3628514d173c03bb2eaf1a2a8a88605932995ce8b406fef63e188c2d8fdd3607bc0a53f5306a36416c41761ff4f0bcc50d7ad18788c00afa4db430beff7802aceed3749481cfce55b1cc5d5c3d1b2869f109e8106222f11603f5e474c95ec6ca090c8e8b3091ffd10086d93342b18282d550a9edf87af6fe11c7b25ae058773c7f41dd62d8195b0128291b016d0bd856e2c1ad930526f83436b0001ff17620ce6513e5211a6b7467e3b33d9d15b9a58ebf0fe273a21b4189f5a8593189c8c10936065e8e151fc8f17c77f3a02cf605edca2f7c17610e1a78bdf09ca9ef1336943e69129eac085fcdf74e3ce027d6c597114acc00fe2e254482684a9ff6e7f86d0918a6d526514c9a0b977263727da5efb39793f99813f9e133708aec1d8a89b4428e4b2bb38cfd5e96ad04358b77daed997bc915c640a8eb55bbddea7c1cc447098c4279bdbd56d9582366b5684a7ae775adeb2528a8967d7ed19256d28070ba5dfd38f2b61f82b8093d58f48e577255b5bdf90147ef591ade958bed84281fcd5108718aec9196f5eb1f6550233f2658972e5d339e4fe40e570aac0096eb2b87d7b7c091c3fa528ca42779400dcf222ffc3da912bf19d344fa0656558be581ef5d1d22e4cb62f4818b6472331754c5e03031e3b20ff7eca5f3a36b94512fff187ece51c281de6b92ec6aa6e1db723dc52345a0104a976b37b43cc900f3ebc0558739021a5df0a3955d9c509868d034f4610a111b73b9bec3540f002d8c90475dbec0d9da9cd8fea1e39e8d98b513f17b9ce04f42428738c2b56f3faffebddbc0bcb24e3b0fc9cc03f7e04cd125558615e16b1052dbd1af217600930b4131d5b00fc7fb02622b64c52c99fb1ddf33daa353bae5ecf9b516c1d1956ae7d1c45e2e6009b32a6c7e31c55b54b47fdd40ed2d48238ffa4af78ce3aa1cde65c825ec152b0cc2df036ca496dab567ea1cbf551c90c0c822b4b4105582889b439ed4992b3b8bc8daa3bfead3cad43999060e68563f070b1b5fc16006483ebf538b8e9044210e94bccb6af915ce0fa5d89f2a85e1d92b6257e97a13a243ed8a9858fb41a2d90866bb7cbffe4feaf2d9deb9987980646aada4359f79993eb7cdd96029da6afbbf99263b3caa3a3b48af2d23917e128d3bd83ae8b751bc917f487dabeba82fe4ae7ffc4ba1542f10f24f6685c354ec0b88b24d69340e4e6c427f42b81dc38f2d874137a3286cbab9e8640688e7218948a3c094165b0c9735b68519a768e71d329fe59979f613ac6ed5cbf55fabb2f8aa291e796a14698681393f319ca288f7b98a9c4db7a1d0e40611d247af430d62c21732eb8799ea23676d0b3a6b8c79b31ac9b37e42366d1a93da7c2a9b102a4fe9358d10c9fcd9c96855c2bec125dcba5fb191f8adf5b74c26ae8ee293b2e728737f41320baf7950207b103bc4cab15d9899bd25513b07b7c9bd2d98687a2a3edf821b26d44f03f955414765c43b88d69e874e78072a2005feb0eae52d260a0a9bdf71a81e28e19edea6dc005c23a9fce0defd591954493d26386123efe9b0cb7485bfca93b7d9086cd9f243514618db260da30f3d0cca6beabcdae713ec12249a3fa3b4f161ebc0c9b916f097d044df49227d5c6c15fcef36c34e3a2d98e383fe81e12720b1b8c91cad85c9b23a6c6eaaf9652e4236176066cd0a658722b86962c9dc781f67c247e59a1c137985f41c29be199416ec5e16bc638aea6e452fcc6d00b6ac3358f83eb0fdc24eeefa3f8b599c5ff98efbc2351e1dd59ffeaf5224ddefabdcef39d862690414570880c71234355e459faf46540588652cfa19e7411d60bc71da629189406500cb6d02a666c9a85cbfe5bf23cdcd8fda4d732c91c8dda9a2ae3a67306943bd047674be6b2c182f9b3d13173db0ae837e7b2ae10483284235e7d42cf68d2bb0d1b91f318c89d4db403c899206c3fa46b8acdccbc67c46d3b2d9aeb7a50822b7953a11ed570ee43365def19b9b260979e6398115e3d11b215d6614bed18e6f7e40fa26d6c7c8327d7d2cc974e1c9bc6c140a8d072677f75d46ce63508483a2e610c3824ab2e6f1a3017fa08b227b3049a1a4fa9a0e3dc0ea5230ef228394cd417d32535563616b52992fa3470566147bf322faa1f2eab47815c90df781436e5d4f724287a60baf793c637dc01edf733c4bc39a15e28a2a6620e6de89d2adc111c2d0b873cc010bd0dfffa8477d2464bd8f9cdc97528f9b57b826bbbf888b238f4d9c7250e6f1796fa150a3f1b45617d2a097285be6deab5a62a6ed8d685e2bbebe4346db3e9d1de5688722dbe4bf4a584939344a6f6c0cf001148b8c8c5b0541ab7ce765a16404954bb903cfbda3b90c9cc3611bf7f2ed56dc8306d33a7acde579425d2b12c3af197b77ba5dfcf7c6d1a230e3d6a23c4df24811e3a27d4ea2aeb06550a6e34c859a6d84db2ebb6f407cce23b0956f4c259458f2e18b4ceb35463938753f7a585f3d47bf45ec12ba571b7cabca36d961e34d7ab9e15b1122149945a65c660f9de31aa658002558e81178c2d694faf009d58cf15bca4008037a8f50c5498f320c4843fb37d23d9f8f114cfc3016e8403a01c17d1258a0862d22270b7e961c22ab2bfb5046217ef4a7a9f92f4b4bc575c4e0254b918a7c531e5a2b29a918f06e1a14099f015633e16de690eab95d2d1d5cfeda5642e9b36525254b23b63bdab0391468afe7d4ae5a5aeadf8f1fa9792d7f0da643852133380161be821081cc4810228994ef9a4483e8fd4b61a42361ae3b06e50050a4b1ea27a8978ac161706076178e2ed1a4e96577945b5a8c301723291f38731b3c8136dd26d6b7df1007a3547f8a73498e7db255651b80bb4e5810957abda45b7d167a82399816a38192ff0cdf607a432ec325cd8e28a3d2ad83de07fb2ae80aa885a9fbce213c452147e1e1add60c91e7ecbc384d1b344b5f57ccf2f69a74eb5a56d16cd18e7e4f86794aac8c9af1205a5d069aa81549061f8906d72441c55e3ea2c26205f86b72d2f2d0243d1c88c852a85cc75aa6efc4bffa7a988135f07d8a29e1a37fa961a32d2a2f292dded9fe8a66d8c9e2b4e7004d8e694c90cd8e6ba65c3a7ee9377c016f906aa7efaff7e677d68a4fd40156ab6c68abf36a8430817c02a2aea7bc8fa78062ffcb206f6c222b8871357ff1d1bf0bd1dc6c6718a2ba5e30456ab940d742f1d27b27bf6bf277ebfa24f0eac39919fb08f991ab5b0e7a1dc8f77f3adf5ddde6601cbfaef5345eb9790e4153dcc8f97a23ce4cfe27725ee5ab11c87b3e8ef47891cf63a268afc43864f4e9789c44ecdb9193067605c9ed1d33d8f17e8653a98adaaf2c303e59b9d76d1029884d3a498660da2df90654d37c6b801b33edbca66c2f26e9f1cb99c584978bd3dbc8cf006dc3fba6b12f7853085aacd656ab6b3853f207c2dc7c6cc2ba2ab8f2f07cda778c6d6430ebabf0319f1093faf0ee327d1c703a9447e014b0e99a04e4771983c7c7e4544acc3a408162cbf4e47bfdab6e9bda83c0fd098586b55e70893f9275ecd59dbffea577b156d690ae9680a3a70d99bc0af1d516007668b98a2f4a485f80bb1f5289ce02f014aa23fc86ae6dd41be643181c1a3f4ba9bea0b1f4cb9c83813f949b23a5af46d910a4a0b6d9de9d2a69da9ae5da2df916484b23a523d6cbbf0b9cbaef9b1684ec456f421bbf307c55f37ee51391e94f576bd0893e0cfe41a1029a7029e9d49ad7cf52ef4ac19ef1bbdc856cba8d734a8396a1380e43d7bf6a294a362114dad5414a2d9359f5170df0474ea4a87dbdc15f40c493f9f18af6cb9020e4fe5d5068c7188b9789816ecb60f1d619f0cbdccb4b8fa6ab3c103af4520622485ed50c3e5253abfd09dde38c56b9980991675503932abf924f8b6bc26a69157204f5ed8610b09602f032a136a21605c6ecdc7f763cbdae5a904a67a3f59b03089abe6481a6d3a3377467c64ace1025c64138c5e968ea3573d08804184084913782a04ac1c8ac614f58b05a4304e43e60bc9211d1716281d920a8", 0x1000)
writev(r1, &(0x7f0000001680)=[{&(0x7f0000001600)="27934eb6f4923cf6a03165a2c0bc72158070dca72a8c69f49ad4637c73ac001a7bab82a27ddb158ed565e92bb7c852903a9386a32bba3ec7f97a3cc52d4a607365d00ef812adf09ffbba8850e5ea2207f3e26a348742f468b642eaad6ca87fcf2cb9568950c26379bedd", 0x6a}], 0x1)
sendfile(r2, r1, 0x0, 0xfffffdef)
r4 = socket$unix(0x1, 0x5, 0x0)
r5 = socket$inet6_udp(0xa, 0x2, 0x0)
dup(r5)
r6 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a)
ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f00000000c0)={'sit0\x00', <r7=>0x0})
sendmmsg$inet(r5, &(0x7f0000002680)=[{{&(0x7f00000016c0)={0x2, 0x4e20, @loopback}, 0x10, &(0x7f0000001700)=[{&(0x7f0000002040)="bc99797719b6a0b8b78665a33504e4411b053480454fc288012bf89deb7734ea57d5ebea16b43a1ba02023441095b57cfff4818b450b1a2514762884dcc991fdb8e5fa3d3fa612c6e474b4f19bf38493a114443f03b2eebe283df0d29e092c0427e2081c885602e48568ef7d66e73bbb104f8ec643a293cf3cfec8dd29ccaae78b4baf69cbb387eeabfc07d4d8b74d48139a94f16c7a8c18e7f87f510e68dde1cb62f35d9d008b9b436eb0c69df4984c465bbb3b06807f443fd9395184a1bef2e7f51f2504f81bcf0b5bef42389e62c16dec13e3d03baa0855109f7753885fa390f47960ed4253ab38cab7a607f2a8", 0xef}, {&(0x7f0000002140)="273593ce5dbc65b588b13d8fe549216dd5ca55881f5923f100d5837043bc1f4f8b3c58d4050290d460f4e61570c993f199f38873b0288d461dfff19beaa71995c5b13cd1dc2deef468638daf2dee469dbf10a360660cb4d16a763e7dcb5a3ede4be9ea59815a07aad63406b4110206c19769d4e5a92a1d315fcd20fae1474497b2fb4007c23bc5c5c8af66c032cd6bb058d8e16f5dfebf85567db64c385abebe1afb0ed3e35c8bb63ddc288c7c8d2074e19893b1e5b4ac35af73e44b5f7e123105b31a10160b0b1f15db5306e93320aad82fe8069afbefc17cb72c9a2f9358", 0xdf}, {&(0x7f0000002240)="ee5689566292fe1bfd77655c3ba9b1412d31af0fd86308b22443275a5e19455f4b104a468da3fe3fe8fb5b5f298b8d93de129d8975bb3fd973a109a426824e1c6cfe48c9928465551cef9cce348ca595426051683ddbcb54156191577f984829cd020d09ebbae24bf131f808d12d5e2e96b520db300d44b0e4f39672223ea15336aad0b73619e1606e876d87f3b75565a08a1239e06c4e0b38ebf52d073a41dcb9976daa5516cf4a4554e5391c2f81c8af7a23635ce809d8451c3c32c1ed3c9ee3fc957175e80a32464749f13fb8fc59a12199c7d13f", 0xd6}, {&(0x7f0000002340)="ac1f1ea264b3e44b816f0df29c084d7c104f86601b4d8d0a1cf59c74fa9d7cc38ec2f983af711bd17cd6d7f9b89fa583d781badf073beb89764534526966d6d24abf79f6d09b1ebbba4a960857b4171b0225f3bd5176e360d6ab8db43e699b338148a1bbe4c793145d57dc63af0cc37b3293f09946a8531587ce532482c79df47fb009bb486f76d1ed68a678dc521fdd7504224cf8f8356c20ad46d3a260ea3d9a189ae8f963f2fdf4728591b8be8240ca3cb7e0f708f6db5603f3a836ee64d1b2448dd77ff4ae39a58da20d41613521", 0xd0}], 0x4, &(0x7f0000001740)=[@ip_tos_int={{0x14, 0x0, 0x1, 0x9}}, @ip_tos_u8={{0x11, 0x0, 0x1, 0x6}}], 0x30}}, {{0x0, 0x0, &(0x7f0000001cc0)=[{&(0x7f0000002440)="cfe2e0be9a8ca81257c54b9787720a83cf81fddfff49084942df5e49b011a188cf8ba2e7b3237ca072a773ad8de1ae26df3ace88c9f5ac8d3f516a28485e57941e13168d95cd58ba623caa033cf65b2eaadb87528b2e7b955d4f3555f2bb313f79f90249bf6cd2d1ea8f468f634fd8dfeed7692fcfa06ff6ccb8cb98627a803724c20590f476e2b7adca1abca21db4684c9313b099af59469ddf66395eaac5ecc2ba1c96aa9edd30e5229dc41559dcebb36c899da880fd4009818e776204cf623b92584446b6673be9d2e149e598f94125768d41059a7de740d0923223496f633a2e1474f5241f95770e8c0b536e8179197c15370e8a0dca7ed8967796b201", 0xff}, {&(0x7f0000001c40)="cafbcc5d73abb4d4be07f2df38ce2d2d117774ba68d81f9c75308a1ee52dc170d5348acf003e622440cdd01e99953f25f14271c55c5c0dc0b2ac98830fb6602116871f37a001a30e9caf7c2e9774c3a0dcc608b830b5a26c15ef1f78281d1be6796b4e20a0f0", 0x66}, {&(0x7f0000002540)="7b9c3cad71f87653a36b5934a3119269173c836d7a44a2bcb4b13fae6193d40647a9b201e152715010adea1357b24a47dd4a64173718bdafe52d6f8652ff3c85e910e065a4f3fda6a60cefd32f9a4cf9700ed4d3d2bb4f8a4558f3170598be99a97a87f88db4b276b81af2441c79536e15ca2e3ab526ed09a19f5c77e0974d940d64", 0x82}], 0x3, &(0x7f0000002600)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {r7, @multicast2, @multicast1}}}, @ip_ttl={{0x14, 0x0, 0x2, 0x7150}}, @ip_tos_int={{0x14, 0x0, 0x1, 0x1ff}}, @ip_tos_u8={{0x11}}], 0x68}}], 0x2, 0x0)
getpeername$packet(r1, &(0x7f0000001d00)={0x11, 0x0, <r8=>0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000001d40)=0x14)
[ 3043.751311] loop6: detected capacity change from 0 to 40
[ 3043.757246] loop4: detected capacity change from 0 to 4
sendmmsg$inet(r4, &(0x7f0000001e00)=[{{&(0x7f00000013c0)={0x2, 0x4e24, @empty}, 0xfffffdec, &(0x7f00000015c0)=[{&(0x7f0000001400)="c9e85ff96c6cecf2e88ec66d314df431f1c39da9d3e24597c1ff5feceeb4f03cdc8944b6ccc9ccce792668f4dcc5c049220fa1fee94c674cbbb2c537f62cc42455ca545bbe206e3c79e70c230be0c06cca794f8b112a6643f9bfe81e4df4a6a088e98b56ca6940022ffffef0968309d9a9f9fc557aa30eb6784f3b8cfc9d5294a6f65b982c806e76cf5e46cdf149d08596f2b5122d784fb63197fab41f914b9385b61fd42726bf0d8972483f8d24ae4aa6af6f545beb2e460f8a3709e294f387367daf593f840308184965f2c3491d04965b800998296190045364b78bfdf670e18ca9", 0xe3}, {&(0x7f0000001500)="d3f4428a4fde957834c76820152c3de098482bb691f664c02f9462dbae12061c30679f3e12c7e0d906fc38a172bfc0fbde589f33b515aea7a5e75e2ccac480edf7371d72beb61eabf471b99016f3ac96c67501c7348b0278bdb3817e0904b3e9c8159a756207790e342d", 0x6a}, {&(0x7f0000001580)="664f479251e2a46a3c1a1609131173cabc7757", 0x13}], 0x3, &(0x7f0000001ec0)=[@ip_ttl={{0x0, 0x0, 0x2, 0x1000}}, @ip_tos_u8={{0x11, 0x0, 0x1, 0x3}}, @ip_retopts={{0x10}}, @ip_tos_int={{0x14}}, @ip_tos_u8={{0x11}}, @ip_tos_int={{0x14, 0x0, 0x1, 0x8}}, @ip_retopts={{0x54, 0x0, 0x7, {[@cipso={0x86, 0x42, 0x1, [{0x5, 0x12, "a008491a2cba6af04958b4d8336cafd6"}, {0x1, 0xd, "91fece6c7c7b2efb527bec"}, {0x0, 0x2}, {0x5, 0x11, "d392228bdab07c91221ce365bc8282"}, {0x7, 0x5, "d4223f"}, {0x1, 0x5, 'd1r'}]}]}}}, @ip_ttl={{0x14, 0x0, 0x2, 0x10000}}, @ip_ttl={{0x14, 0x0, 0x2, 0x1}}, @ip_retopts={{0x6c, 0x0, 0x7, {[@generic={0x89, 0x11, "7f59e6afde562d7ae8084fe5bf4cc0"}, @timestamp_addr={0x44, 0xc, 0x42, 0x1, 0x6, [{@initdev={0xac, 0x1e, 0x0, 0x0}, 0x8}]}, @timestamp={0x44, 0x8, 0x51, 0x0, 0x2, [0x8000]}, @timestamp_prespec={0x44, 0x34, 0x60, 0x3, 0xc, [{@loopback, 0x8}, {@initdev={0xac, 0x1e, 0x0, 0x0}, 0x8}, {@rand_addr=0x64010102, 0x1}, {@initdev={0xac, 0x1e, 0x0, 0x0}, 0x5}, {@rand_addr=0x64010100, 0x5b7}, {@private=0xa010102, 0x299}]}]}}}], 0x180}}, {{&(0x7f0000001780)={0x2, 0x4e22, @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x10, &(0x7f0000001840), 0x1, &(0x7f0000001880)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {r7, @multicast1, @broadcast}}}, @ip_tos_int={{0x14, 0x0, 0x1, 0xffff}}, @ip_retopts={{0x78, 0x0, 0x7, {[@ssrr={0x89, 0x2b, 0x72, [@broadcast, @loopback, @multicast1, @remote, @multicast1, @multicast1, @multicast1, @empty, @private=0xa010100, @empty]}, @rr={0x7, 0x17, 0xf2, [@private=0xa010100, @initdev={0xac, 0x1e, 0x0, 0x0}, @local, @rand_addr=0x64010102, @rand_addr=0x64010101]}, @timestamp_prespec={0x44, 0xc, 0x38, 0x3, 0x1, [{@broadcast, 0x7f}]}, @ra={0x94, 0x4, 0x1}, @generic={0x82, 0x9, "a4a6ea2c60645f"}, @generic={0x7, 0x9, "d8228b8e06876e"}, @generic={0x88, 0x2}]}}}, @ip_ttl={{0x14, 0x0, 0x2, 0x8}}, @ip_tos_int={{0x14, 0x0, 0x1, 0x8e}}], 0xe0}}, {{0x0, 0x0, &(0x7f0000001c00)=[{&(0x7f0000001980)="7466dd371f61fd43efc16aa8e969bc2cdd99f19462e8167f1ded1067d82fcba2a881d98310c1692ebeff4d9444aeb9b72548f0e44b0a80ca75c38176408d1b6d9ad4f36ecf7841479b8ee35d84538eb7648b832026d5977c9b1ddf053558022368331500ef8061067e3aadce14a6eaed9c1ee4dbdb23444f25a07040383b86e725fadff7a12d5c300087457c86d6fa5ba706a4e612f4fcdf1b3dd9d67af475042edfc16d3cf174d87a7ddd24fa6392d3e642bfcf364aae81930abd917242218f8c547ab1cbc393c989a4ff9ba6ec6f86b46ab4753fd3ca3075", 0xd9}, {&(0x7f0000001a80)="27b7a7cf58ccb0e6add37fd6f8b140043cc3174227c213d873da1991379a7ad1b381fc1a726cf85d28563beaecadacb7e58a7a1f2693d60e4bfbff411d47acfc2c66c798ee54f638d65302a98e4dbad03852b3c7f39edb3e24ded384cf29fe88c060c2292da60aef9a94ca99e68e7fbaab7946c1159b34e74205b0d5cd22b462d1eb3dc1fff9590b383b8414b9d94c36230a705a6ebdb59f16e65a1e30dedbd46cdebcae4b7abd165c83e71499c83042d7b6e596457170e77ea0bebcae521bb4ba62c72fe6cf22821d5b874ecfd1fd7649809ffcbf9c1bc1734d358b93094ca01ab5a74c42b87393af43165630f12c6739d54c1ba0783b7ace", 0xf9}, {&(0x7f0000001b80)="5557dda579515813d7c570ad80fbfa50fc8f6e3641c423b179264ab1b6e1c4491b5542619b777a31a500d7ad642c5c943e29150ec35b96b279319e70f4796ac4b6a644c0fc21ca64774316b68691ee4864e33a29a0d251f4f852b3a0d670737a4b733092f2c3e0ba4f62d81d", 0x6c}], 0x3, &(0x7f0000001d80)=[@ip_tos_int={{0x14, 0x0, 0x1, 0x62a}}, @ip_tos_u8={{0x11}}, @ip_pktinfo={{0x1c, 0x0, 0x8, {r8, @multicast1, @local}}}, @ip_tos_int={{0x14, 0x0, 0x1, 0xa}}], 0x68}}], 0x3, 0x40080)

[ 3043.766844] FAT-fs (loop4): bogus number of reserved sectors
[ 3043.767469] FAT-fs (loop4): Can't find a valid FAT filesystem
[ 3043.777163] loop5: detected capacity change from 0 to 40
[ 3043.812802] loop3: detected capacity change from 0 to 40
[ 3043.834692] loop4: detected capacity change from 0 to 4
[ 3043.845459] FAT-fs (loop4): Unrecognized mount option "�������T�����*G�[vX�.v�[1���E���DҚB��RKſ���E@���r��x��Z�ى�50С9�*�4��G��v����=:�K��)&�.G��p��jT�k�О�t/�
" or missing value
00:22:34 executing program 0:
perf_event_open(&(0x7f0000000080)={0x0, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r1, &(0x7f0000000100), 0x0, 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r0, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r2, 0x680000, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0x0, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r1, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

[ 3043.935324] syz-executor.6: attempt to access beyond end of device
[ 3043.935324] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 3043.937544] Buffer I/O error on dev loop6, logical block 10, lost async page write
[ 3044.006560] syz-executor.6: attempt to access beyond end of device
[ 3044.006560] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 3044.008254] Buffer I/O error on dev loop6, logical block 10, lost async page write
00:22:34 executing program 2:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0, 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
creat(&(0x7f0000000000)='./file1\x00', 0x100)

00:22:34 executing program 3:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x410, 0x0)
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r0, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)

00:22:34 executing program 1:
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}}, 0x0, 0x6, 0xffffffffffffffff, 0xb)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
r1 = gettid()
rt_sigqueueinfo(0x0, 0x0, 0x0)
r2 = pidfd_getfd(0xffffffffffffffff, r0, 0x0)
perf_event_open(&(0x7f0000000040)={0x5, 0x80, 0x40, 0x71, 0x2, 0x0, 0x0, 0x8000, 0x20, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, @perf_config_ext={0xff}, 0x0, 0x9b5, 0xfa, 0xd, 0x0, 0x8000, 0x55, 0x0, 0x0, 0x0, 0x3ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000400)={0x2, 0x80, 0x2a, 0x81, 0xe0, 0x40, 0x0, 0x63c5ef1c, 0x80, 0x3, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x7, 0x2, @perf_config_ext={0xf2, 0x6}, 0x0, 0x5, 0xfffffff8, 0x0, 0x1, 0x0, 0x1b6, 0x0, 0x6}, 0x0, 0xd, 0xffffffffffffffff, 0x0)
rt_sigqueueinfo(0x0, 0x0, &(0x7f0000000000))
setsockopt$sock_timeval(r0, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10)
bind$packet(r2, &(0x7f00000000c0)={0x11, 0xfe, 0x0, 0x1, 0xfb, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}}, 0x14)
perf_event_open(&(0x7f0000000100)={0x0, 0x80, 0xff, 0x8, 0x4, 0x1, 0x0, 0x4, 0x684, 0x4, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0xdbc, 0x0, @perf_config_ext={0xd03, 0x80000000}, 0x800, 0x3, 0x3, 0x5, 0x300000000000000, 0x7, 0x7ff, 0x0, 0x0, 0x0, 0x5}, r1, 0x10, 0xffffffffffffffff, 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x0, 0x0)
pwritev(r3, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
openat(r3, &(0x7f0000000180)='\x00', 0x400040, 0x80)
rt_sigqueueinfo(0x0, 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f0000000240)={'ip6_vti0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x4, 0x0, 0x7f, 0x40, 0xb, @local, @mcast1, 0x88, 0x20, 0x8, 0x2}})

00:22:34 executing program 4:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_mount_image$tmpfs(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101843, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef)

00:22:34 executing program 7:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684fd2981c8409820000080000000000000000"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x100d}], 0x620, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:22:34 executing program 6:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef)
setxattr$incfs_id(&(0x7f0000000040)='./file1\x00', &(0x7f00000000c0), &(0x7f0000000180)={'0000000000000000000000000000000', 0x32}, 0x20, 0x7)
r2 = openat$loop_ctrl(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$LOOP_CTL_REMOVE(r2, 0x4c81, 0x0)
r3 = perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000500)=ANY=[@ANYBLOB="010000000100000018000000", @ANYRES32=r3, @ANYBLOB="00000000000000002ed9aeaff9b7f1164083cb1f9bed3f8f5e3000000000c100"])
pwritev(r2, &(0x7f00000005c0)=[{&(0x7f0000000240)="d084e9b7294e4145df5b601a5b84fe1396cb76010a491d32cedb67c42db3dcf997c8801e916bf2f392822c2208f5479012c3ad815d1810dd2a779eced8cfa5a3964da9afde7fee430a10c508a162ad8c69bad9dd63a021da9b0eb994eed8ec9d28a779e595eb644e7b88c520d8eedd8597972c24c9b3e3e2e3e913c4c4a559474ca242ea66ae96afab8bac5c6063b68daba59c7470bfd75421ce52c4613343bb17fd725becc454aba6dbe219bb1cba2c97908373fab1e4788f97fe908d4c5ebd28fef980eb285018c09cbcd8a408622d3074eeb17a551501604e6a9158fc511f1211d9", 0xe3}, {&(0x7f00000001c0)="a0597e35f908b125247c2cab9d2fe76eec759dd7aefde6e8afe64b062b25a1cbfaad6ef59bb926fe134eb1", 0x2b}, {&(0x7f0000000340)="9c77e699e461873583b71f228a6d37732001939d795fcbca000e4fd9a78eacb7150367f7518e8fe265fc2493df05bd9a42b65a7d876f06a8c29334b567f836f41e064ec100eda920d003dbab60e20abe8ed6f4afd2c93b049cb7d4cbb9bcadfab97fb046ed851c8a76020294eeeb5332e12ad76c5641a331a701c8055411", 0x7e}, {&(0x7f00000003c0)="e9ca8dafc0710aedd2ad48fb80cac4b55467c3ddaab4958955f4bc18e0d55d36b732f2deb5f550d3ebb1f40b3d9c6462b3e5e8c69a6bf4ae2d390e847c709cdd72bd55b86ce0e9b019d53c94bf3f3c5cb5601afa48a1b4ea50592e34bf8d039a78cbf844208dc59a04cdf6e977a17034f7b468c5fa05428589594d800735a560100255421bc33bbeeb5c1f91e87be0188b540d4941a3cfecdd858817d16bad5fe71eb3fd0a005ede87d1110faea078c59d9819461411d486091e90484bc7730eba63e241833a", 0xc6}, {&(0x7f00000004c0)="76053950af5f435f4b2d1c610804a5cf167277d6e31508ab08c38b398e68b878b16b943adb3e66ab7243c919a72580be9215579b6cb04bf20801e4f50f7b014da45e52fec0a167b52cd49e75c8126c9b5f1603d55d2d65d72e03d2973ea26d76f31d6391c56b489a06ae7ba4d6ce3eb070498c386266184696c8d2d95e3099077585b1c666d74a742268e164c9404c66a681e23033affb330a81", 0x9a}, {&(0x7f0000000580)="03e72d0c702ba71a79c8ee2471", 0xd}], 0x6, 0x7fffffff, 0xff)

[ 3044.268329] loop3: detected capacity change from 0 to 40
00:22:34 executing program 0:
perf_event_open(&(0x7f0000000080)={0x0, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r1, &(0x7f0000000100), 0x0, 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r0, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r2, 0x700000, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0x0, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r1, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

[ 3044.319506] loop6: detected capacity change from 0 to 40
[ 3044.423587] syz-executor.6: attempt to access beyond end of device
[ 3044.423587] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 3044.424815] Buffer I/O error on dev loop6, logical block 10, lost async page write
[ 3044.454071] syz-executor.6: attempt to access beyond end of device
[ 3044.454071] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 3044.455293] Buffer I/O error on dev loop6, logical block 10, lost async page write
[ 3044.459241] loop4: detected capacity change from 0 to 40
00:22:35 executing program 3:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r0, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)

00:22:35 executing program 6:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000180)="601c6d6b646f7366d8a02b000801010004407ff468002034f801937f99f6362d8cb55cb4d2fbcb3dfd989af1842ad800409de9f612b1840303febdacde88e7b11235f1f412f8bd35ef699773716b3e0968d1d7dd3d61e25ee82701fecf4bd62af9308fa4978bbcc5f2a1e0af4a03169c4881", 0x72}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef)

[ 3044.579923] loop3: detected capacity change from 0 to 40
[ 3044.616243] loop5: detected capacity change from 0 to 40
[ 3044.665566] loop6: detected capacity change from 0 to 40
[ 3044.672136] FAT-fs (loop6): invalid media value (0x00)
[ 3044.672869] FAT-fs (loop6): Can't find a valid FAT filesystem
[ 3044.692518] loop6: detected capacity change from 0 to 40
[ 3044.694731] FAT-fs (loop6): Unrecognized mount option "./file0" or missing value
00:22:49 executing program 0:
perf_event_open(&(0x7f0000000080)={0x0, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r1, &(0x7f0000000100), 0x0, 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r0, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r2, 0x780000, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0x0, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r1, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:22:49 executing program 6:
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r0, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
ioctl$CDROMSTOP(r0, 0x5307)
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
openat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x240, 0x100)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_io_uring_setup(0x97, &(0x7f0000000180)={0x0, 0x6c6b, 0x1, 0x80000, 0x316}, &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000000240), &(0x7f0000000300))
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r2, r1, 0x0, 0xfffffdef)
syz_io_uring_setup(0x52db, &(0x7f0000000340)={0x0, 0xb0eb, 0x10, 0x3, 0x169, 0x0, r0}, &(0x7f0000ff4000/0xc000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f00000003c0), &(0x7f0000000400))
r3 = perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000500)=ANY=[@ANYBLOB="010000000100000018000000", @ANYRES32=r3, @ANYBLOB="00000000000000002ed9aeaff9b7f1164083cb1f9bed3f8f5e3000000000c100"])
ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f00000000c0)={'sit0\x00', <r4=>0x0})
sendmmsg$inet(0xffffffffffffffff, &(0x7f0000005f00)=[{{&(0x7f0000000180)={0x2, 0x4e24, @dev}, 0x10, 0x0}}, {{&(0x7f0000000380)={0x2, 0x4e22, @dev}, 0x10, 0x0, 0x0, &(0x7f00000018c0)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {r4, @loopback, @dev}}}], 0x20}}], 0x2, 0x0)
sendmsg(r1, &(0x7f0000000b00)={&(0x7f0000000440)=@xdp={0x2c, 0x1, r4}, 0x80, &(0x7f00000004c0)=[{&(0x7f0000000540)="4dbf63a6c14f6ee479aa4e1ef056473fd71bf6993d110b6ed662318b98830f56a47733669ec29125651a50cfc202036524cb3d682c482b5838b8f118ef257b97fea535d0b4efc779396a62f68c18ce4c8f55f30e7fbddca0281fbfa4f34ada40ed2f4a5e5c6680681dc5cb28b1aab8572104db903a25d65fee27014124404534936b7a3aff2156e4067b694f58d24524a4ce542477349eb83bc98160c99db7c4ee2beb88327b6c60284e238e49d98424075fe439bad5d8c7ad596fd7662107a823dbdfc03f585987343c33b461cd436a6b78f695af14dc056fb868d427ea23ccc0bd6673cbd1608a6de97a8753cd632978c9", 0xf2}, {&(0x7f0000000640)="e7ccbb990145ea484bfa645d250136ca7646c32e309aeca1f7abed5e2e23045d1952c0456f669e281b6839a50ed95f2ce6d6e56f6a14d93464e70dba4aa1e2114c896afc7f6031e10c5b7ec29f4ad48be1c9e92dac815a20ad1b1756138db05de1bda1a11017e666986bbec91aef3d5a0533a037d3982fa8e8785e34ec4011ad7c6b926272a55be139694831190d7be395f9b9685ed4003e6a855d3b38c37599653135d5e535f741bf3e936c1e07c5b425bda8dac302ff15eb51846fef5d078e0230acdc3d42af99e779ca9d20e081", 0xcf}, {&(0x7f0000000740)="1c90b542a40b66543c9b793bb1742003427f42ff00a892709bdbc4732aa4205e55112d2d8dcf0a5f8136b40037f7b465767795ad173d8b818132a82e5a18e5458becf08d3517fe19aa4ed527abd13cd1481b49fdff2de8f3221a0b58f70086090616a8062b3f2e2d22cd855fd343d937cd30a6f99b9bba30944fd5c7d46e85d6f18b4222190365702bb4ee52a2f5b126205976645a26bd9f69d6b9ba4f00ccc6364cf02f073caed742d9c0b42d4f66740a02695e31b3b83e1cd56853ded3", 0xbe}, {&(0x7f0000000800)="adb341675de59e8e146e8239c40eee31715a76c325ba0184027109786460df6aa038dbc10f100bcde8602c878291c5e5c79967f649ef2c3eb3b94eb96d0f6a4e71a765f45a523f9bcf79b01aa61945ac4391f767e4519ae7a716b43bd2cb040abde89258d3eeb7146a30e8eb5e43d8991f928df72a86cf4eac223d33b263158ec49b23f6f0c2af88e017e2e92ff0acf3e55bc7f4561fa73c862d9566042bc405844ffe5fcd70525e9a11a0080cdd8b79be7e7c2e1662fbeee033f82aa5a463a5b7aa2e4c69fee3a95eea4897bb3a406f", 0xd0}], 0x4, &(0x7f0000000900)=[{0x28, 0x119, 0x1, "3b745551f3630652d1aafe97f9be1768538c0ca6b28e5823"}, {0xf8, 0xea28c8e7cca645c5, 0x400, "75174393969bc6f967774a642b5ca89e500de42374b963612d5e420d1b8df81cdef2b4967141d15897902267592202807bb71e42597bced5e8d79e878db631fdb960c910dec24e602bf3cafb36d8a1ccc01603472dc39b70b4dcf593b09fd2ae0a189236d269aed5206b8b4da10400daf0f2e0d3171281243371f69d101becb35d2291a3e27b0b3e3d0a29cb35e30ff2cb074abdde6a8c4da9c19825cfee0c3da928ffd25bab5c43b6c2de0a87086d43488450a7f13d0c2e230e3b45286b339da6ec0c4c3876e331a3e06bf0df0a1adb3a65c16cd7ea8016518c44617c01c62c60800645"}, {0xa0, 0x10a, 0x7fff, "9f4ef390ee45f4c509f0f1bf9d7259a3b4acdecd8751c7b502b08662ba4bf47b8a6eb2de4dc62f15ce2f4bb9ea014e34e17226e888e5e4184f7f0037bf42ae5193424ddb5410aaa81251df223320584e70abbe5af031bda7959d05eded02c1346717917dc91ddf24c97ed29e3ad8a94f7f027e612ccc51b0de3716b9a29fd1440881dbb8f0d4eeb14729e4f0ad806fa0"}, {0x40, 0x115, 0x3, "d501b34dc519db930ebabef78bc497dba031819a30fba50f1d055bc65adc3f3f149b50cfa08fe424f59204596afdb1"}], 0x200}, 0xc0)
socket$inet6_udp(0xa, 0x2, 0x0)
open_by_handle_at(r3, &(0x7f0000000040)=@FILEID_UDF_WITHOUT_PARENT={0xc, 0x51, {0x8, 0x7fff, 0xff, 0x101}}, 0x2c0)

00:22:49 executing program 2:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
creat(&(0x7f0000000000)='./file1\x00', 0x100)

00:22:49 executing program 7:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684fd2981c8409820000080000000000000000"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x100d}], 0x63b, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:22:49 executing program 4:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
stat(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, <r1=>0x0})
setresuid(0x0, r1, 0x0)
syz_open_dev$tty20(0xc, 0x4, 0x0)
syz_mount_image$tmpfs(&(0x7f0000000000), &(0x7f0000000040)='./file0\x00', 0x3, 0x1, &(0x7f00000000c0)=[{&(0x7f0000000240)="896fe553c1490c61578509385bf214a45c5e2244b575d3ffe57d444acbb21a93004d429820ed5a2e9b3672bd73e89ecff3c6469be37d0abb2cfb9fdf0886a1f80a57dcc5b613c17d024af15810fed5362e2f4b856c94c33da2bab210f0052a54969311cb8f52876380689a3aad61423b3fad05b6dd1cacae4615873ce8aa799c235cdba16bc684012b541f7d450a0a1fe53071b5a4d5f6e4e321104889ba583f3a8244fc30f97acdc108a93f3cff5cb55dd2d428d416eb6031eebb498e44604b3ab1df042009070d3cee055bdb2f00b8f12b305996ac", 0xd6, 0x7}], 0x80a1, &(0x7f0000000340)={[{@huge_advise}, {@nr_inodes={'nr_inodes', 0x3d, [0x67, 0x31, 0x74, 0x6b, 0x32, 0x67, 0x33, 0x74]}}, {@nr_inodes={'nr_inodes', 0x3d, [0x47]}}, {@size={'size', 0x3d, [0x0, 0x6b]}}, {@huge_always}], [{@dont_measure}, {@fsuuid={'fsuuid', 0x3d, {[0xc, 0x66, 0x35, 0x31, 0x39, 0x62, 0x33, 0x31], 0x2d, [0x39, 0x66, 0x31, 0x65], 0x2d, [0x32, 0x37, 0x33, 0x30], 0x2d, [0x37, 0x38, 0x64, 0x36], 0x2d, [0x64, 0x37, 0x62, 0x38, 0x38, 0x38, 0x33, 0x37]}}}, {@fowner_gt={'fowner>', r1}}, {@uid_lt={'uid<', 0xffffffffffffffff}}, {@measure}, {@dont_hash}]})
syz_mount_image$tmpfs(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r2, r0, 0x0, 0xfffffdef)

00:22:49 executing program 3:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r0, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)

00:22:49 executing program 5:
r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r4 = perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000500)=ANY=[@ANYBLOB="010000000100000018000000", @ANYRES32=r4, @ANYBLOB="00000000000000002ed9aeaff9b7f1164083cb1f9bed3f8f5e3000000000c100"])
r5 = openat$loop_ctrl(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$LOOP_CTL_REMOVE(r5, 0x4c81, 0x0)
r6 = ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82)
r7 = perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000500)=ANY=[@ANYBLOB="010000000100000018000000", @ANYRES32=<r8=>r7, @ANYBLOB="00000000000000002ed9aeaff9b7f1164083cb1f9bed3f8f5e3000000000c100"])
ioctl$AUTOFS_DEV_IOCTL_READY(r8, 0xc0189376, &(0x7f0000000040)={{0x1, 0x1, 0x18, <r9=>r5, {0x4f95}}, './file0\x00'})
ioctl$LOOP_CTL_REMOVE(r9, 0x4c81, r6)
write$binfmt_aout(r3, &(0x7f0000000300)=ANY=[@ANYRES64=r2, @ANYRES32=r0, @ANYRES32=r1, @ANYRESDEC, @ANYRES64=r0, @ANYRESHEX=r4, @ANYRES64, @ANYRES16=r6, @ANYBLOB="69cf67ac303e1c0c5ecd6277a5b62d4227ce1471c6b6814dd125777c0647ac27defcb9e67ca8d3b3b43fb29f0e1b12788a920d90f66a9847c571fbd0d566ecfbb44603c2a28311f53a39834bf9b2f392f7f7b6c530a0c46dbead8a78d97290e967ea12a0db4f3889e6d71daa6f24d9cb725dfa586e45c0b92ad2cfd1cefc8fbdc14fe7d917bf3907cfe031c1decfa19f", @ANYRES32=r6], 0x220)
sendfile(r3, r1, 0x0, 0xfffffdef)

00:22:49 executing program 1:
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}}, 0x0, 0x6, 0xffffffffffffffff, 0xb)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
r1 = gettid()
rt_sigqueueinfo(0x0, 0x0, 0x0)
r2 = pidfd_getfd(0xffffffffffffffff, r0, 0x0)
perf_event_open(&(0x7f0000000040)={0x5, 0x80, 0x40, 0x71, 0x2, 0x0, 0x0, 0x8000, 0x20, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, @perf_config_ext={0xff}, 0x0, 0x9b5, 0xfa, 0xd, 0x0, 0x8000, 0x55, 0x0, 0x0, 0x0, 0x3ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000400)={0x2, 0x80, 0x2a, 0x81, 0xe0, 0x40, 0x0, 0x63c5ef1c, 0x80, 0x3, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x7, 0x2, @perf_config_ext={0xf2, 0x6}, 0x0, 0x5, 0xfffffff8, 0x0, 0x1, 0x0, 0x1b6, 0x0, 0x6}, 0x0, 0xd, 0xffffffffffffffff, 0x0)
rt_sigqueueinfo(0x0, 0x0, &(0x7f0000000000))
setsockopt$sock_timeval(r0, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10)
bind$packet(r2, &(0x7f00000000c0)={0x11, 0xfe, 0x0, 0x1, 0xfb, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}}, 0x14)
perf_event_open(&(0x7f0000000100)={0x0, 0x80, 0xff, 0x8, 0x4, 0x1, 0x0, 0x4, 0x684, 0x4, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0xdbc, 0x0, @perf_config_ext={0xd03, 0x80000000}, 0x800, 0x3, 0x3, 0x5, 0x300000000000000, 0x7, 0x7ff, 0x0, 0x0, 0x0, 0x5}, r1, 0x10, 0xffffffffffffffff, 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(0xffffffffffffffff, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
openat(r3, &(0x7f0000000180)='\x00', 0x400040, 0x80)
rt_sigqueueinfo(0x0, 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f0000000240)={'ip6_vti0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x4, 0x0, 0x7f, 0x40, 0xb, @local, @mcast1, 0x88, 0x20, 0x8, 0x2}})

[ 3059.226637] loop5: detected capacity change from 0 to 40
[ 3059.227927] loop3: detected capacity change from 0 to 40
[ 3059.233754] loop4: detected capacity change from 0 to 40
[ 3059.255771] FAT-fs (loop2): bogus number of reserved sectors
[ 3059.256252] FAT-fs (loop2): Can't find a valid FAT filesystem
[ 3059.268783] loop6: detected capacity change from 0 to 40
00:22:50 executing program 2:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
creat(&(0x7f0000000000)='./file1\x00', 0x100)

00:22:50 executing program 0:
perf_event_open(&(0x7f0000000080)={0x0, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r1, &(0x7f0000000100), 0x0, 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r0, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r2, 0x800000, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0x0, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r1, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

[ 3059.402721] syz-executor.5: attempt to access beyond end of device
[ 3059.402721] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 3059.404129] Buffer I/O error on dev loop5, logical block 10, lost async page write
[ 3059.412274] syz-executor.4: attempt to access beyond end of device
[ 3059.412274] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 3059.414370] Buffer I/O error on dev loop4, logical block 10, lost async page write
00:22:50 executing program 3:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r0, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)

[ 3059.456610] syz-executor.6: attempt to access beyond end of device
[ 3059.456610] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 3059.458654] Buffer I/O error on dev loop6, logical block 10, lost async page write
[ 3059.460811] FAT-fs (loop2): bogus number of reserved sectors
[ 3059.461645] FAT-fs (loop2): Can't find a valid FAT filesystem
[ 3059.541542] syz-executor.6: attempt to access beyond end of device
[ 3059.541542] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 3059.542481] Buffer I/O error on dev loop6, logical block 10, lost async page write
[ 3059.560505] loop3: detected capacity change from 0 to 40
00:23:07 executing program 5:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000240)='./file1\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat$hpet(0xffffffffffffff9c, &(0x7f0000000040), 0x1090c3, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r3, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
ioctl$AUTOFS_DEV_IOCTL_CATATONIC(r3, 0xc0189379, &(0x7f0000000180)={{0x1, 0x1, 0x18, r0}, './file1\x00'})
openat(r2, &(0x7f00000000c0)='./file1\x00', 0x800, 0x1)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef)

[ 3076.770069] loop5: detected capacity change from 0 to 40
00:23:07 executing program 1:
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}}, 0x0, 0x6, 0xffffffffffffffff, 0xb)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
r1 = gettid()
rt_sigqueueinfo(0x0, 0x0, 0x0)
r2 = pidfd_getfd(0xffffffffffffffff, r0, 0x0)
perf_event_open(&(0x7f0000000040)={0x5, 0x80, 0x40, 0x71, 0x2, 0x0, 0x0, 0x8000, 0x20, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, @perf_config_ext={0xff}, 0x0, 0x9b5, 0xfa, 0xd, 0x0, 0x8000, 0x55, 0x0, 0x0, 0x0, 0x3ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000400)={0x2, 0x80, 0x2a, 0x81, 0xe0, 0x40, 0x0, 0x63c5ef1c, 0x80, 0x3, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x7, 0x2, @perf_config_ext={0xf2, 0x6}, 0x0, 0x5, 0xfffffff8, 0x0, 0x1, 0x0, 0x1b6, 0x0, 0x6}, 0x0, 0xd, 0xffffffffffffffff, 0x0)
rt_sigqueueinfo(0x0, 0x0, &(0x7f0000000000))
setsockopt$sock_timeval(r0, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10)
bind$packet(r2, &(0x7f00000000c0)={0x11, 0xfe, 0x0, 0x1, 0xfb, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}}, 0x14)
perf_event_open(&(0x7f0000000100)={0x0, 0x80, 0xff, 0x8, 0x4, 0x1, 0x0, 0x4, 0x684, 0x4, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0xdbc, 0x0, @perf_config_ext={0xd03, 0x80000000}, 0x800, 0x3, 0x3, 0x5, 0x300000000000000, 0x7, 0x7ff, 0x0, 0x0, 0x0, 0x5}, r1, 0x10, 0xffffffffffffffff, 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(0xffffffffffffffff, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
openat(r3, &(0x7f0000000180)='\x00', 0x400040, 0x80)
rt_sigqueueinfo(0x0, 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f0000000240)={'ip6_vti0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x4, 0x0, 0x7f, 0x40, 0xb, @local, @mcast1, 0x88, 0x20, 0x8, 0x2}})

00:23:07 executing program 3:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, 0x0, 0x141042, 0x0)
pwritev(r0, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)

00:23:07 executing program 6:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x22, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef)

00:23:07 executing program 2:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
creat(&(0x7f0000000000)='./file1\x00', 0x100)

00:23:07 executing program 4:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x8)
syz_mount_image$tmpfs(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file1\x00', 0x301c42, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef)

00:23:07 executing program 0:
perf_event_open(&(0x7f0000000080)={0x0, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r1, &(0x7f0000000100), 0x0, 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r0, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r2, 0x980500, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0x0, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r1, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:23:07 executing program 7:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684fd2981c8409820000080000000000000000"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x100d}], 0x645, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

[ 3076.788530] loop4: detected capacity change from 0 to 40
[ 3076.791456] loop3: detected capacity change from 0 to 40
[ 3076.811936] loop6: detected capacity change from 0 to 40
[ 3076.866198] FAT-fs (loop2): bogus number of reserved sectors
[ 3076.867211] FAT-fs (loop2): Can't find a valid FAT filesystem
00:23:07 executing program 3:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, 0x0, 0x141042, 0x0)
pwritev(r0, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)

00:23:07 executing program 4:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_mount_image$tmpfs(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef)

00:23:07 executing program 1:
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}}, 0x0, 0x6, 0xffffffffffffffff, 0xb)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
r1 = gettid()
rt_sigqueueinfo(0x0, 0x0, 0x0)
r2 = pidfd_getfd(0xffffffffffffffff, r0, 0x0)
perf_event_open(&(0x7f0000000040)={0x5, 0x80, 0x40, 0x71, 0x2, 0x0, 0x0, 0x8000, 0x20, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, @perf_config_ext={0xff}, 0x0, 0x9b5, 0xfa, 0xd, 0x0, 0x8000, 0x55, 0x0, 0x0, 0x0, 0x3ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000400)={0x2, 0x80, 0x2a, 0x81, 0xe0, 0x40, 0x0, 0x63c5ef1c, 0x80, 0x3, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x7, 0x2, @perf_config_ext={0xf2, 0x6}, 0x0, 0x5, 0xfffffff8, 0x0, 0x1, 0x0, 0x1b6, 0x0, 0x6}, 0x0, 0xd, 0xffffffffffffffff, 0x0)
rt_sigqueueinfo(0x0, 0x0, &(0x7f0000000000))
setsockopt$sock_timeval(r0, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10)
bind$packet(r2, &(0x7f00000000c0)={0x11, 0xfe, 0x0, 0x1, 0xfb, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}}, 0x14)
perf_event_open(&(0x7f0000000100)={0x0, 0x80, 0xff, 0x8, 0x4, 0x1, 0x0, 0x4, 0x684, 0x4, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0xdbc, 0x0, @perf_config_ext={0xd03, 0x80000000}, 0x800, 0x3, 0x3, 0x5, 0x300000000000000, 0x7, 0x7ff, 0x0, 0x0, 0x0, 0x5}, r1, 0x10, 0xffffffffffffffff, 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(0xffffffffffffffff, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
openat(r3, &(0x7f0000000180)='\x00', 0x400040, 0x80)
rt_sigqueueinfo(0x0, 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f0000000240)={'ip6_vti0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x4, 0x0, 0x7f, 0x40, 0xb, @local, @mcast1, 0x88, 0x20, 0x8, 0x2}})

[ 3076.932327] syz-executor.6: attempt to access beyond end of device
[ 3076.932327] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 3076.933337] Buffer I/O error on dev loop6, logical block 10, lost async page write
[ 3076.964829] loop3: detected capacity change from 0 to 40
[ 3077.032568] loop4: detected capacity change from 0 to 40
00:23:07 executing program 2:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
creat(&(0x7f0000000000)='./file1\x00', 0x100)

00:23:07 executing program 0:
perf_event_open(&(0x7f0000000080)={0x0, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r1, &(0x7f0000000100), 0x0, 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r0, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r2, 0xa00500, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0x0, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r1, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:23:07 executing program 3:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, 0x0, 0x141042, 0x0)
pwritev(r0, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)

00:23:07 executing program 7:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684fd2981c8409820000080000000000000000"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x100d}], 0x64b, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

[ 3077.146365] FAT-fs (loop2): bogus number of reserved sectors
[ 3077.146793] FAT-fs (loop2): Can't find a valid FAT filesystem
00:23:07 executing program 6:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r1 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r2, r0, 0x0, 0xfffffdef)
getsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040), &(0x7f00000000c0)=0x14)
r3 = openat$loop_ctrl(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$LOOP_CTL_REMOVE(r3, 0x4c81, 0x0)
r4 = perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000300)={0x1, 0x80, 0x80, 0x81, 0x20, 0x9, 0x0, 0x2, 0xaa00, 0x8, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x3, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x2, @perf_bp={&(0x7f0000000180), 0xb}, 0x10202, 0x1, 0x1f, 0x2, 0x1, 0x8609, 0x47, 0x0, 0x706, 0x0, 0xfffffffffffffff8}, 0xffffffffffffffff, 0x4, r2, 0x0)
ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000500)=ANY=[@ANYBLOB="010000000100000018000000", @ANYRES32=<r5=>r4, @ANYBLOB="00000000000000002ed9aeaff9b7f1164083cb1f9bed3f8f5e3000000000c100"])
ioctl$AUTOFS_DEV_IOCTL_READY(r5, 0xc0189376, &(0x7f0000000040)={{0x1, 0x1, 0x18, r3, {0x4f95}}, './file0\x00'})
sendfile(r3, r1, 0x0, 0x2fc)

[ 3077.256733] loop3: detected capacity change from 0 to 40
[ 3077.259448] loop6: detected capacity change from 0 to 40
[ 3077.370056] syz-executor.6: attempt to access beyond end of device
[ 3077.370056] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 3077.370925] Buffer I/O error on dev loop6, logical block 10, lost async page write
00:23:25 executing program 0:
perf_event_open(&(0x7f0000000080)={0x0, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r1, &(0x7f0000000100), 0x0, 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r0, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r2, 0xa80500, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0x0, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r1, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:23:25 executing program 5:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x6}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
ioctl$EXT4_IOC_SWAP_BOOT(r1, 0x6611)
r2 = openat$urandom(0xffffffffffffff9c, &(0x7f00000000c0), 0x2040, 0x0)
ioctl$AUTOFS_DEV_IOCTL_OPENMOUNT(r1, 0xc0189374, &(0x7f0000000180)={{0x1, 0x1, 0x18, r2, {0x20}}, './file1\x00'})
chdir(&(0x7f0000000040)='./file0\x00')
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r3, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r3, r0, 0x0, 0xfffffdef)
stat(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000240))

00:23:25 executing program 7:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684fd2981c8409820000080000000000000000"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x100d}], 0x651, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:23:25 executing program 2:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
creat(&(0x7f0000000000)='./file1\x00', 0x100)

00:23:25 executing program 3:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x0, 0x0)
pwritev(r0, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)

00:23:25 executing program 6:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef)
ioctl$F2FS_IOC_MOVE_RANGE(r0, 0xc020f509, &(0x7f0000000040)={r1, 0x800000000000000, 0x2000000000, 0x80000001})

00:23:25 executing program 4:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000000)="04000000646f7366d8a02b00080101000440002000f801", 0x17, 0x5}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x101042, 0x39)
syz_mount_image$tmpfs(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
r1 = openat$full(0xffffffffffffff9c, &(0x7f00000000c0), 0x20000, 0x0)
mknodat$loop(r1, &(0x7f0000000180)='./file0\x00', 0xc000, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r2, r0, 0x0, 0xfffffdef)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r3, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
openat(r3, &(0x7f00000001c0)='./file1\x00', 0x80c00, 0x0)

00:23:25 executing program 1:
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}}, 0x0, 0x6, 0xffffffffffffffff, 0xb)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
r1 = gettid()
rt_sigqueueinfo(0x0, 0x0, 0x0)
r2 = pidfd_getfd(0xffffffffffffffff, r0, 0x0)
perf_event_open(&(0x7f0000000040)={0x5, 0x80, 0x40, 0x71, 0x2, 0x0, 0x0, 0x8000, 0x20, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, @perf_config_ext={0xff}, 0x0, 0x9b5, 0xfa, 0xd, 0x0, 0x8000, 0x55, 0x0, 0x0, 0x0, 0x3ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000400)={0x2, 0x80, 0x2a, 0x81, 0xe0, 0x40, 0x0, 0x63c5ef1c, 0x80, 0x3, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x7, 0x2, @perf_config_ext={0xf2, 0x6}, 0x0, 0x5, 0xfffffff8, 0x0, 0x1, 0x0, 0x1b6, 0x0, 0x6}, 0x0, 0xd, 0xffffffffffffffff, 0x0)
rt_sigqueueinfo(0x0, 0x0, &(0x7f0000000000))
setsockopt$sock_timeval(r0, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10)
bind$packet(r2, &(0x7f00000000c0)={0x11, 0xfe, 0x0, 0x1, 0xfb, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}}, 0x14)
perf_event_open(&(0x7f0000000100)={0x0, 0x80, 0xff, 0x8, 0x4, 0x1, 0x0, 0x4, 0x684, 0x4, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0xdbc, 0x0, @perf_config_ext={0xd03, 0x80000000}, 0x800, 0x3, 0x3, 0x5, 0x300000000000000, 0x7, 0x7ff, 0x0, 0x0, 0x0, 0x5}, r1, 0x10, 0xffffffffffffffff, 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r3, 0x0, 0x0, 0x0, 0x0)
openat(r3, &(0x7f0000000180)='\x00', 0x400040, 0x80)
rt_sigqueueinfo(0x0, 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f0000000240)={'ip6_vti0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x4, 0x0, 0x7f, 0x40, 0xb, @local, @mcast1, 0x88, 0x20, 0x8, 0x2}})

[ 3094.953379] loop4: detected capacity change from 0 to 40
[ 3094.962283] FAT-fs (loop4): bogus number of FAT structure
[ 3094.962720] FAT-fs (loop4): Can't find a valid FAT filesystem
[ 3094.981421] loop3: detected capacity change from 0 to 40
[ 3095.009314] loop6: detected capacity change from 0 to 40
[ 3095.022181] FAT-fs (loop2): bogus number of reserved sectors
[ 3095.022809] FAT-fs (loop2): Can't find a valid FAT filesystem
00:23:25 executing program 0:
perf_event_open(&(0x7f0000000080)={0x0, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r1, &(0x7f0000000100), 0x0, 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r0, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r2, 0xb00500, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0x0, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r1, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:23:25 executing program 1:
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}}, 0x0, 0x6, 0xffffffffffffffff, 0xb)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
r1 = gettid()
rt_sigqueueinfo(0x0, 0x0, 0x0)
r2 = pidfd_getfd(0xffffffffffffffff, r0, 0x0)
perf_event_open(&(0x7f0000000040)={0x5, 0x80, 0x40, 0x71, 0x2, 0x0, 0x0, 0x8000, 0x20, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, @perf_config_ext={0xff}, 0x0, 0x9b5, 0xfa, 0xd, 0x0, 0x8000, 0x55, 0x0, 0x0, 0x0, 0x3ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000400)={0x2, 0x80, 0x2a, 0x81, 0xe0, 0x40, 0x0, 0x63c5ef1c, 0x80, 0x3, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x7, 0x2, @perf_config_ext={0xf2, 0x6}, 0x0, 0x5, 0xfffffff8, 0x0, 0x1, 0x0, 0x1b6, 0x0, 0x6}, 0x0, 0xd, 0xffffffffffffffff, 0x0)
rt_sigqueueinfo(0x0, 0x0, &(0x7f0000000000))
setsockopt$sock_timeval(r0, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10)
bind$packet(r2, &(0x7f00000000c0)={0x11, 0xfe, 0x0, 0x1, 0xfb, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}}, 0x14)
perf_event_open(&(0x7f0000000100)={0x0, 0x80, 0xff, 0x8, 0x4, 0x1, 0x0, 0x4, 0x684, 0x4, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0xdbc, 0x0, @perf_config_ext={0xd03, 0x80000000}, 0x800, 0x3, 0x3, 0x5, 0x300000000000000, 0x7, 0x7ff, 0x0, 0x0, 0x0, 0x5}, r1, 0x10, 0xffffffffffffffff, 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r3, 0x0, 0x0, 0x0, 0x0)
openat(r3, &(0x7f0000000180)='\x00', 0x400040, 0x80)
rt_sigqueueinfo(0x0, 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f0000000240)={'ip6_vti0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x4, 0x0, 0x7f, 0x40, 0xb, @local, @mcast1, 0x88, 0x20, 0x8, 0x2}})

[ 3095.059578] FAT-fs (loop5): bogus number of reserved sectors
[ 3095.060211] FAT-fs (loop5): Can't find a valid FAT filesystem
00:23:25 executing program 3:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x0, 0x0)
pwritev(r0, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)

[ 3095.111899] syz-executor.6: attempt to access beyond end of device
[ 3095.111899] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 3095.113830] Buffer I/O error on dev loop6, logical block 10, lost async page write
[ 3095.202731] loop3: detected capacity change from 0 to 40
00:23:25 executing program 2:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
creat(&(0x7f0000000000)='./file1\x00', 0x100)

00:23:25 executing program 3:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x0, 0x0)
pwritev(r0, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)

00:23:25 executing program 6:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440692034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r0, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
r1 = openat(r0, &(0x7f0000000040)='./file0\x00', 0x204180, 0xdc)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r2, r1, 0x0, 0xfffffdef)

[ 3095.348895] FAT-fs (loop2): bogus number of reserved sectors
[ 3095.350014] FAT-fs (loop2): Can't find a valid FAT filesystem
00:23:26 executing program 0:
perf_event_open(&(0x7f0000000080)={0x0, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r1, &(0x7f0000000100), 0x0, 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r0, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r2, 0xb80500, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0x0, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r1, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

[ 3095.426580] loop3: detected capacity change from 0 to 40
[ 3095.458465] loop6: detected capacity change from 0 to 40
[ 3095.502134] FAT-fs (loop6): Directory bread(block 10) failed
[ 3095.514212] FAT-fs (loop6): Directory bread(block 11) failed
[ 3095.520678] FAT-fs (loop6): Directory bread(block 12) failed
00:23:26 executing program 1:
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}}, 0x0, 0x6, 0xffffffffffffffff, 0xb)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
r1 = gettid()
rt_sigqueueinfo(0x0, 0x0, 0x0)
r2 = pidfd_getfd(0xffffffffffffffff, r0, 0x0)
perf_event_open(&(0x7f0000000040)={0x5, 0x80, 0x40, 0x71, 0x2, 0x0, 0x0, 0x8000, 0x20, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, @perf_config_ext={0xff}, 0x0, 0x9b5, 0xfa, 0xd, 0x0, 0x8000, 0x55, 0x0, 0x0, 0x0, 0x3ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000400)={0x2, 0x80, 0x2a, 0x81, 0xe0, 0x40, 0x0, 0x63c5ef1c, 0x80, 0x3, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x7, 0x2, @perf_config_ext={0xf2, 0x6}, 0x0, 0x5, 0xfffffff8, 0x0, 0x1, 0x0, 0x1b6, 0x0, 0x6}, 0x0, 0xd, 0xffffffffffffffff, 0x0)
rt_sigqueueinfo(0x0, 0x0, &(0x7f0000000000))
setsockopt$sock_timeval(r0, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10)
bind$packet(r2, &(0x7f00000000c0)={0x11, 0xfe, 0x0, 0x1, 0xfb, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}}, 0x14)
perf_event_open(&(0x7f0000000100)={0x0, 0x80, 0xff, 0x8, 0x4, 0x1, 0x0, 0x4, 0x684, 0x4, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0xdbc, 0x0, @perf_config_ext={0xd03, 0x80000000}, 0x800, 0x3, 0x3, 0x5, 0x300000000000000, 0x7, 0x7ff, 0x0, 0x0, 0x0, 0x5}, r1, 0x10, 0xffffffffffffffff, 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r3, 0x0, 0x0, 0x0, 0x0)
openat(r3, &(0x7f0000000180)='\x00', 0x400040, 0x80)
rt_sigqueueinfo(0x0, 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f0000000240)={'ip6_vti0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x4, 0x0, 0x7f, 0x40, 0xb, @local, @mcast1, 0x88, 0x20, 0x8, 0x2}})

[ 3095.530750] FAT-fs (loop6): Directory bread(block 13) failed
[ 3095.535609] FAT-fs (loop6): Directory bread(block 14) failed
[ 3095.542383] FAT-fs (loop6): Directory bread(block 15) failed
[ 3095.550697] FAT-fs (loop6): Directory bread(block 16) failed
[ 3095.557828] FAT-fs (loop6): Directory bread(block 17) failed
[ 3095.562535] FAT-fs (loop6): Directory bread(block 18) failed
[ 3095.575232] FAT-fs (loop6): Directory bread(block 19) failed
00:23:26 executing program 2:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
creat(&(0x7f0000000000)='./file1\x00', 0x100)

[ 3095.666350] loop2: detected capacity change from 0 to 40
[ 3095.668465] FAT-fs (loop2): bogus number of reserved sectors
[ 3095.669073] FAT-fs (loop2): Can't find a valid FAT filesystem
[ 3095.796363] loop4: detected capacity change from 0 to 40
[ 3095.798638] FAT-fs (loop4): bogus number of FAT structure
[ 3095.799082] FAT-fs (loop4): Can't find a valid FAT filesystem
[ 3095.885134] FAT-fs (loop5): Unrecognized mount option "./file0" or missing value
00:23:42 executing program 5:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r1 = syz_mount_image$msdos(&(0x7f00000000c0), &(0x7f0000000180)='./file0\x00', 0x100000001, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000240)="0599a3ed4e25d0d109169c64644e2b939a80b5d0da822a2c79d1a6a88f34adfa75d314bf68c0ddcdf40e7dd02e1b2598316ad5811b95e27ec4d7c9354678e698316c74f37a4c98b83a5b55fd7ccc4993eeee9cb5a45fa52fd3704312e56f5d68fc66e101474e1ca9b37ee31eb75242f5eb104d71a62256391338d3a568c5bf1e55056b962f8819e65c49e0508f1d416e636185b135d10bf386f7ccb8fdf0c9fbb5fd4716464d9b1e34f9a4d3b02f1ec8ac57276dac57e449d7e236c6b97664abf701a33183abe8154a834b", 0xcb, 0x6}], 0x40000, &(0x7f0000000400)=ANY=[@ANYBLOB="6673636f6e746578743d756e636f6e66696e65645fbd1adeadafdf601a9c91cecb478a752c66736e616d653d76666174002c7375626a5f726f6c653df42a2b2f2f2b2d5e4026265c2c736d61636b66736861743d76666174002c00"])
renameat(r0, &(0x7f0000000040)='./file1\x00', r1, &(0x7f00000003c0)='./file0\x00')
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r2 = memfd_secret(0x80000)
r3 = openat(r2, &(0x7f0000000100)='./file0\x00', 0x101042, 0x0)
write$binfmt_aout(r3, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r3, r0, 0x0, 0xfffffdef)

00:23:42 executing program 4:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_mount_image$tmpfs(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef)
r2 = getuid()
syz_mount_image$nfs4(&(0x7f0000000000), &(0x7f0000000040)='./file0\x00', 0x9ab, 0x1, &(0x7f00000000c0)=[{&(0x7f0000000240)="f1c4f1a2f3e5c316ac0618fc420f2e6eedc3772ae03eff5413ab1b70f9ca457f8aea4199995c85a2f251f4bcff04d921aee1fedb7c515ec86a78990f0aef609def9e011165cf204fa34121d2e556ea949bdbf1b68be75adc2013e032479e89d3a70a02171ae980b3b8bdc08b758968208047322302b3a0f65d788ec64847f0fff17d3ac9d566f38dc69c7c8b05dc1aac04494414cf6785e68ac602ae188e9db433e9227a88b9034fa839bfbfc561b1b90f6d2a025c3e24095d329250f325c7863bee355c70182efcc427c72192e3237f968179ca0e5fc1f0e99db73f30f3ee83d60e16100f67dc", 0xe7, 0x8}], 0x2024, &(0x7f0000000180)={[{}, {'(#'}, {}, {'vfat\x00'}, {'vfat\x00'}, {'vfat\x00'}, {'vfat\x00'}], [{@permit_directio}, {@uid_eq={'uid', 0x3d, r2}}, {@obj_user={'obj_user', 0x3d, '\x89:%p'}}, {@measure}]})

00:23:42 executing program 3:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(0xffffffffffffffff, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)

00:23:42 executing program 7:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684fd2981c8409820000080000000000000000"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x100d}], 0x65a, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:23:42 executing program 1:
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}}, 0x0, 0x6, 0xffffffffffffffff, 0xb)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
r1 = gettid()
rt_sigqueueinfo(0x0, 0x0, 0x0)
r2 = pidfd_getfd(0xffffffffffffffff, r0, 0x0)
perf_event_open(&(0x7f0000000040)={0x5, 0x80, 0x40, 0x71, 0x2, 0x0, 0x0, 0x8000, 0x20, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, @perf_config_ext={0xff}, 0x0, 0x9b5, 0xfa, 0xd, 0x0, 0x8000, 0x55, 0x0, 0x0, 0x0, 0x3ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000400)={0x2, 0x80, 0x2a, 0x81, 0xe0, 0x40, 0x0, 0x63c5ef1c, 0x80, 0x3, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x7, 0x2, @perf_config_ext={0xf2, 0x6}, 0x0, 0x5, 0xfffffff8, 0x0, 0x1, 0x0, 0x1b6, 0x0, 0x6}, 0x0, 0xd, 0xffffffffffffffff, 0x0)
rt_sigqueueinfo(0x0, 0x0, &(0x7f0000000000))
setsockopt$sock_timeval(r0, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10)
bind$packet(r2, &(0x7f00000000c0)={0x11, 0xfe, 0x0, 0x1, 0xfb, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}}, 0x14)
perf_event_open(&(0x7f0000000100)={0x0, 0x80, 0xff, 0x8, 0x4, 0x1, 0x0, 0x4, 0x684, 0x4, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0xdbc, 0x0, @perf_config_ext={0xd03, 0x80000000}, 0x800, 0x3, 0x3, 0x5, 0x300000000000000, 0x7, 0x7ff, 0x0, 0x0, 0x0, 0x5}, r1, 0x10, 0xffffffffffffffff, 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r3, &(0x7f0000000140), 0x0, 0x0, 0x0)
openat(r3, &(0x7f0000000180)='\x00', 0x400040, 0x80)
rt_sigqueueinfo(0x0, 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f0000000240)={'ip6_vti0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x4, 0x0, 0x7f, 0x40, 0xb, @local, @mcast1, 0x88, 0x20, 0x8, 0x2}})

00:23:42 executing program 2:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
creat(&(0x7f0000000000)='./file1\x00', 0x100)

[ 3111.804605] loop5: detected capacity change from 0 to 40
[ 3111.810127] loop3: detected capacity change from 0 to 40
00:23:42 executing program 0:
perf_event_open(&(0x7f0000000080)={0x0, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r1, &(0x7f0000000100), 0x0, 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r0, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r2, 0xc00500, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0x0, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r1, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

[ 3111.815211] loop4: detected capacity change from 0 to 40
00:23:42 executing program 6:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0, 0xd1)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef)

[ 3111.858726] loop6: detected capacity change from 0 to 40
[ 3111.872549] loop2: detected capacity change from 0 to 40
[ 3111.896431] FAT-fs (loop2): bogus number of reserved sectors
[ 3111.897478] FAT-fs (loop2): Can't find a valid FAT filesystem
[ 3111.901287] syz-executor.4: attempt to access beyond end of device
[ 3111.901287] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 3111.902201] Buffer I/O error on dev loop4, logical block 10, lost async page write
[ 3111.922257] syz-executor.6: attempt to access beyond end of device
[ 3111.922257] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 3111.923289] Buffer I/O error on dev loop6, logical block 10, lost async page write
00:23:42 executing program 3:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(0xffffffffffffffff, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)

00:23:42 executing program 1:
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}}, 0x0, 0x6, 0xffffffffffffffff, 0xb)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
r1 = gettid()
rt_sigqueueinfo(0x0, 0x0, 0x0)
r2 = pidfd_getfd(0xffffffffffffffff, r0, 0x0)
perf_event_open(&(0x7f0000000040)={0x5, 0x80, 0x40, 0x71, 0x2, 0x0, 0x0, 0x8000, 0x20, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, @perf_config_ext={0xff}, 0x0, 0x9b5, 0xfa, 0xd, 0x0, 0x8000, 0x55, 0x0, 0x0, 0x0, 0x3ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000400)={0x2, 0x80, 0x2a, 0x81, 0xe0, 0x40, 0x0, 0x63c5ef1c, 0x80, 0x3, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x7, 0x2, @perf_config_ext={0xf2, 0x6}, 0x0, 0x5, 0xfffffff8, 0x0, 0x1, 0x0, 0x1b6, 0x0, 0x6}, 0x0, 0xd, 0xffffffffffffffff, 0x0)
rt_sigqueueinfo(0x0, 0x0, &(0x7f0000000000))
setsockopt$sock_timeval(r0, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10)
bind$packet(r2, &(0x7f00000000c0)={0x11, 0xfe, 0x0, 0x1, 0xfb, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}}, 0x14)
perf_event_open(&(0x7f0000000100)={0x0, 0x80, 0xff, 0x8, 0x4, 0x1, 0x0, 0x4, 0x684, 0x4, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0xdbc, 0x0, @perf_config_ext={0xd03, 0x80000000}, 0x800, 0x3, 0x3, 0x5, 0x300000000000000, 0x7, 0x7ff, 0x0, 0x0, 0x0, 0x5}, r1, 0x10, 0xffffffffffffffff, 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r3, &(0x7f0000000140), 0x0, 0x0, 0x0)
openat(r3, &(0x7f0000000180)='\x00', 0x400040, 0x80)
rt_sigqueueinfo(0x0, 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f0000000240)={'ip6_vti0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x4, 0x0, 0x7f, 0x40, 0xb, @local, @mcast1, 0x88, 0x20, 0x8, 0x2}})

[ 3111.957593] syz-executor.4: attempt to access beyond end of device
[ 3111.957593] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 3111.959217] Buffer I/O error on dev loop4, logical block 10, lost async page write
00:23:42 executing program 5:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = syz_mount_image$tmpfs(&(0x7f00000000c0), &(0x7f0000000180)='./file0\x00', 0xfffffffffffffff8, 0x6, &(0x7f00000014c0)=[{&(0x7f0000000300)="9bea3290b8f974aa6d795465258ffb05287b90e32c4efbe1c6d0243bc0ae3213ff2ff2badadb58d72409c9392868774c0504cc88c6a2fa66082a6d51c28b9f9ae824e5db521a2468e3527d1dc31499", 0x4f, 0x3ff}, {&(0x7f00000001c0)="e45ee60072f8fe961aa6b187c1e102968dbf2f283f91b4afa88ce2c02681543eac3b180645e6e1668ef0c4845cc5cdfac4e2437cb48a3d", 0x37, 0x1ff}, {&(0x7f0000000380)="81e8b114c879ffc24a8e6282fe244edb09e01230232a501e8aa60c1d71166574fc4df325d5228fc55bbdc4ec3b97167bffbd808bf88b4deb2fc670cd91c760577da796c46e41e3fc19826a91ac2443", 0x4f, 0x18}, {&(0x7f0000000400)="995eb7554a6c16c357818fe5845ab2a36240263f5754de0944c8345951ee4812756cbc3ba6545dd8f8980cefe5da60d58752a709b4d3f68b1574ca990fd56e9ad4ddfce6c8", 0x45, 0x8000}, {&(0x7f0000000480)="ea92e1e783905f8fd840dfeec29ebd367f1ae781dc1f37a818a1342de66c0b60c93eddcc735a2c76a73fa642c7e36753f945e536506505a500bae9cfb51a398c035ad1ffc5f6f8f926bd046c596e0bb17c10eea7d621ce3d165d180650a6dd393c73402a58c1e165f1e73f4ae467111090460fe6ad967ba3f8fe0b28a8be874a98fc756fefe300a8dc1feb61f8eb267854127143d30e70863da78aa62e96607db03c202358a9b88bdac2238796d5979e6ad88b4c85df5b4af276e9d8f84e40910ebec78c7e1c30f0c22ba2e9974c6347a8694a25cd25fd2ddbad7485ed750fcee77c7c620c7a5585020db759b3a980b4a6a75fe533d30e93bfa7fffce0f48664684a4ed903848652ac76d596f9276d543c1f014a246441e53e35a933a60dfa81861b0419119419ab52851a89920cfb0665f1b96dafa0a928576d0fcb7d88919967f974d7f12a415e7c25c3b309dd83b0d9095f9e878c98f25f2fe771bd1cf9ab4b6535d382293bf2a5f9b0962314ba77b763b7c7e68b553b9dd645264b565f0fa6abedc16d6e787e3a85be3b50e7503bf94089582f166455e6895a04673ed108dee20236c830d33d81028acd22e2219eeccfa15a0df1e2a2db5cabd49b5e4f9760b466edce8404aa26fb57fb091c7991af9964d3aaf0339565bf78960f6c6ff30c03270e1208bd13a9da6af410e5015db91742ec309e42b6dc80b54d1d21ea64b1bf2aca76e0f7514f8f7599e7223e1eaa02a8062e4ef09c1604f8657b7d8120f89f6028897bb91fef83fdde8df7fb4393fc87c055b8e977834a1e277878e65bdbed44617764749fb36ce2da658c5d00333cd771bdb982ede46f6f65aeacda6d42bbf0e22fe71c71323f1daa107b5378c532e611f3bad15394da2796022e7483b694302a221301fc7b43180d09b2aa59548ce23d2773137838235573558a745496cb404f4e280f8b12ebf6b47273f04e18cd89d957966de99b9908db74001b5e112cf9f91cef57d3891ba78f3bac6fdfde6f9a14834a27fca83223ffba9066118e250853b7aa9910b45020708235e5c4057e46fa1d828ffbbb3381988b7162b199d93a9a96e82a1c79ff074b23b4c0543c3c0bb0aad12be9c838686ee728b34ddc728f27225e3fb3c7b9ed90b2dfc52a8a43c42e4e86a894cc6308ea549cc6e3bf105e943aaa3dec843ba4d1d0f92d8c033bd2783485f83347b369c3cfebf0c64a8215daf5430c2f64ba05698d1c01178d4405154670cd5aa6dc72c3b70afcd994ca4cf7a60d6523d9ae63baa2fe34da757001dfcbcb3b586a8a0f96959b4b1252c963d36768d1909dfbd75e51d93a4d5df56ac8dbe71b6fbaf95cb4d06b1e3cb34ea10c02938913e34b2f2bef2e78d2c1c8f4e084712af4aacf41f2e69bbc168acb310883fbc86181676d74e70bcc6052177d37691bff80990f5487af533ec3a708b40e2bf1c011fd4501a47bad0f4f803a34478c798b057924d4a3aa724c2009a329da34af7b51e51f34718a60b963e64145391855f4a4723f4ffdfd21d2d22db151d6370c9a516f375818d055fa80fb02fd8e327c61196c3989c1f3bb5dde4b2e0648582cd747c3bc4c51e60e0a9bc9f3884428e6df22335d1f80e70f3cfab6ee6d8f900090bddea3bbffbbb34e90d51b8aa1af9084e96ef7d6dc33895a10c7bad178433f6beec54d657423f39b7f4f2a3a218cea56b6ff0d61850b2b477c094ed799aff7584daed7a36d2f23e4e36e995f94c7d3e71ded0be1325a64b22f67f1f317f3856ea638c2dd4ba591f510a26c08587b97740085d6dbc3fe5c5f632c9266cc6079a6116b90c3c7fa9fa1569131e20ca599da5baa052175a5970b207c7a345036e34d142020b4105019512a90a4b7ad255bab2484091eee02f1724788ee94fde3b165a9f592b0d132e2e6d85074ac6e59c7075685f0d0e4893306945a359d94775c99da197484ac76b4109a1b57deb11a8316a07f2b2b33799a5be70d581baaa36899a7db21edd260ac39c63d7b1cbb1539955d20e68e0f9c81970da034afc54ced7c082412c9a7d560155e4c993206fe3b73b2a12f10345f14bae601640430659919ba700476eea10c43d5c00e631e0a7d52fe2a219b5b782cfd78adbb9106a12cf7c0cc50c583318f3e289f68d1bfe22fded930475872e6f1a448da063f70c14c2711fc5c342c9d39aabd58965a41b37be9610bc844933218db54a5323ee49f2eacbea6da3110a31e6acde9705bb8c261d8f7e462139bab0c30dcf6c2ac3ba9edbd2c8cf27e06facf51c45f0526fe18e331ffb84a195f2571a68de10583d75f19d8059c86944c91998287cf8e7d290d026113ffed182f1ec2d5193d4432126096d5fbbfb39db59433fd412853923300970c0be62b1eeaf3327e66788f5153c8b08b049579ff5e65960192109dc3e142ad06e942add4bd62323f618c53e28b32d683366fee81f6426aaf83d989a92d1645bb4d1890855efede07f9c32d9df31e9a3a30a2e521560fc6bcd394385c4096261665b8a22cf80c8c9f06e271e115fe4d1ea42696bb7c668170f3721527cc5b1702271f5ee23f58e4b5b30b2f2f0a390cc99839af3574b717fc4aee04c605b8874c99c9870d8b74564dd1bfdd874f3e310710bac1adb82da01dd248ff1a27d21dee430268b67c6259327d57c5d28678bff59c8f7b1114ffc7c737bec31228703a75830bbdfc39e39cbafe0203dfb30d5b178233b4fd684870ed65bef5f2576e0bba5a04dea2a0a7077b8530bd5076e56541019e96fd51cdda0acfda24feab1ad00610f5665d89916c2a5bc7ad313a3edc88205ec75a4a7172cc5ab96a04fd0f497603629a22fb909e51bcdcf4344c95b0ec976e0562e50b37a44475dfe9b32db3f85b1730f5bdd7a7d45c0743fea82e132f3b788149025822eaeca01577e0517100bfd436cb1b902167715876458c6575d2732b964d844c9bb976c16e4e39888b0bf3bad40bada1b490aa057f0b6832af4718ea8f0b3e1ab27eec3a909c6a7e1c0b3858133493a9d1e9f7d9886fdb74f92feba0379453b60c168b13b207850162210064d40f442ddb1c6c6afca8b2561df91b5d3ccda0574d6aa36f5dbba115e652fce4464fa975784ce3286a309b452c38474c82e49d6ff8ccda8b56bc69591765f94cb8f622c27467ecd55dfc5ec5f3d5a39789b2ee2214f3f9e944d73f3da0ef870d76f6780d468c0a9fec7d6593e44435b7ff50b72e8ddf790f6e2834e3a2bcd2c38cf05618899e1cd4c733b264b8b88dd4168e5a54d939e4faca25405634fc71e94c3eac349884773f82a0aab7d4a86fae552c0e853fa441fb01a45cd121c2ea03b1f44b6253957ca45f626dd4c3bbadd9db2b1a745d8725e262c0a28e481500bb178718cabab9605e1ca59bb89cc131cf138f9b1519c55b0d0155caf377204e498277ec386bbf22bb43bd4092cbfa5aaf9a49c65c29260a7131026039a2b6c3a36ac842f6a51f2980f7adf9d31df60dbd91ff7c4a924b95e3429202b9336f3baf03ff46f6a276239f5edd34294eb4f4755dccf6ea8aab26afe7866d993a76e06094c3958bdc12f6fdc9f8e59a5522233b0bde3fe9faac4bff9143eb714e3e491459a0f7bea9130f375fe40e9a24a45a69c1ddbd3023597941d2724e826ac9adf331a020c67f3401922c05631dde555b394396b01f00f23ee1437faff32ed70a09d050bdacd6fb81362f4d390cbeb930f06697ff8307980a5c8e128f20cc1ed3dece9902c148ba8f68e00aeeb5be838e810519e03bb5a65975d5fdf70cb85c95689a2e1fbc7d8b1dd1528ebb3fc6eb4ce59607c388f1e28190097d45cc9dbeb42ebb48ea7becd32c8a7d99341081bba052afa8e3f4749259b91d622b16de554e20f225a84e338a251e521e06fce91e0f724456b5530d2d8ad5a7e3df964a4f19c985a1f9d206f715235799dc8a9256d31d2d341be3f5808254b86b0ecbed51076a8bb553b835ded4b5302d8817a9958bccf8f60ff08a839f66f3c83e25ff1ef0135fe49f31980f2ed63e303741570e6037a620c234ba791e466a6c43040c6562d12fbca3f6ac0a912a5ea9139438648e0a59877f4a8b500aef5f6331dbc9907dbce0bcaf8921236cd190407647d95af3e96d29eddbfb2db45a8e216023b22f6cdac0b14d78c02ce5dc167fb4ccb4280aea95a8b35e60be861f75af60dc01b1eefed9e269171d6e86e0f3765108884b988f59d5bc470311b68e4b1f287d268177b8d9c7739daed4f0755fb81ac8d8102462b08d3ac2138e9726731d127e1d376892ea318e21132fe8ce93e876aa90a4feb3124bfd22f810694625b7d27f4156f93ee66f2ac1021e017a01b23e2bc2fa0f99690700e603cbc1174833e6bc86e4448ecc3fedb266ae23fd4327f18cd9f4944ddf56ce2addbebe165cabc972b7386ef4fb3bab9f47b176e73f5006982630a16eb06ea59ea2f70a236e4a1a61d38178e8aa5145285e9b876ad46dfd567f24f93e9a9eecd2e39a653f44dec2e110864d24898df06d10fdc0e15ff23f3f780d68af7170d04e6afe0e295cc673e3a3bf32db3b52548a5ae2f5b56dafbc1e9632a15495d96570b028cb15f382971d275b2966285c970502927a97993ad5e600b4027cd1ba032844074ac57357c4d3256d79bf90cf49b74d3160eab42e5dd869691dfe99aeb9800494c0f24bd8b4136845d2bafbfcc7eaf6249be6e05ac8543be2a8a9e7c9649e535bd81edc2dc81d80111b01be1256347029e914364f2fcfdb965788e58292fbdff184cbe122bd3bdcf2bd19efd928d421f3e115af39365cc88b569c29171fa120ca052e524d1cf4e92e9a2c240426db7d77ad3a50f761c3f65e4e71dfba41d0acfe017a321292fd74703759223ad084e11271a36f7b1f1af071bdf3454cc1abe62e432b4da2f64ca5dbdf986c15667d59fc296dd26f5aab4732ca8c62ba9de0da64d154199f8b85ae13ef8211456386941dfa5b566aca70771a45969016389332b7ec09b8fa5e87166d8fc32d1f32c3552ae36145272379fb30580e67442eaa76d351d699140b5f8a5868f7e003c5d7ef8b75b3689ce13d5f00d52c90b844cafcacb3e60509d7eed5b29a82705a67127344d138d6f7f6a12ea573cb8ff8d46ac3084f5c3148cd4c07432942b973a4a62bc8bf17b357cc4ee0dba6cf65ecfc21e58a3a07cd82b978b2c2c93d0c53d821c0214407e19178deeef9c7033425ea2aa63e8ef56d37b3e8a83bed1ab0cd6da87ed0fb44a1249f6cf108bd17b0f064ad43a028ce4f39eed7535e66b92ff1ec095c5c15827b543a1d7c464a8f0711b40974641f97b7ecd02d2dc01b75dda8e3fc7c61cfa6c116f50ba9a8528920fe174620f95c3e39194cdaf6c53fce2481834890f2984bfbf739d6957f1d0033fe6e9dc163543f27b90bc7392d0b9461bccf888c6b88bf865533a1912cadfdd046737600baa0683500ba08988867fe8827bd465c77434c21daf0d7a2d82e6c3c7383ac1abe0a448f9bca1b0fa765049bd9b0229c24f2048a8f2137b62542c2f073f4a83aebba0aef686b3594b295a1cc2cd7f24680701b6195d7f45a5a6bb10770f12c7d983f2034aaaef9ef0afb85168a595b538f52c4449d078e7f00c4d29c43c84c9a029bdd675f607b5fae22acf0d9c485a125b6d8088695b663a9fa8fd04e920dd3628b68d09748244b16736f932dec3181219f708f19b0c78c7b31fb2f1f798ffa7ddc01b854136a7be10274c4f082f959929dcbba59333c4cb4b9851be62c6977d41de5eef243deb274178916997bc89aebd0", 0x1000, 0x8}, {&(0x7f0000001480)="b96e4e", 0x3, 0x149e}], 0x92, &(0x7f0000001580)={[{@huge_within_size}, {@nr_inodes={'nr_inodes', 0x3d, [0x32]}}, {@huge_advise}, {@huge_always}, {@huge_advise}, {@huge_never}], [{@euid_lt={'euid<', 0xee00}}, {@dont_appraise}, {@smackfsroot={'smackfsroot', 0x3d, 'vfat\x00'}}]})
r1 = openat(r0, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
llistxattr(&(0x7f0000000040)='./file0\x00', &(0x7f0000000240)=""/180, 0xb4)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r2, r1, 0x0, 0xfffffdef)

[ 3112.023846] loop3: detected capacity change from 0 to 40
00:23:42 executing program 6:
r0 = syz_open_dev$tty1(0xc, 0x4, 0x1)
writev(r0, &(0x7f0000000000)=[{&(0x7f0000000140)="02b2dccad213e1e6cf54b7a797f8f22a47f25b7658fb110b2e76f95b0f318b8fa745e6ffba4414d29a42bfab524bc5bffb17decc4540a6f00b9772f5f9789a9525790df8d989b23530d0a1398f2ad734c7ff47961be476ffeec81efa3d3aa64b8ea329261dfc2e1047a68670f0e5950d6a5414956bddd09e101b5b66e5742fe843413e065e3b86a242b37bc58c68153a45015f6f1ea67762c302e461e0c84bbb7f8d464f5a72d9fad56dac0c5028a4012a93dbc7da640786e3c9898cdd8fe091b166bfcd66e6257abc923ceaf90e994deded3fe8a59c2105f5caf366d32170ef51299dbf441bc3cddda352a2e07375fb44e75fed8082f3e960015d9bcddb0c834feda68d113a9a9fc0d1c30153685caf43b176219b666d74e67b6192cfd8a561c6c4aadcc80ed8c469bc41b028f1db515d699e45ad3379f9b1edb8de4bb2f8615d6716297baac7e45073fcecf31e51ec78c40edd78f245bced04414f849fb961fbbe79ff2ed7c48ec1b5331f9755d7094986fc8da198ce4a12f9ddfb43e565bc4fed618da9a693d03c3e7ec4b3014dfc022103e277c1b12efb03ef8b197f3a931f6cbe238cf8a4e7639b409b4586f66da41b94eed69d52ba9fde5aa1ee774d4e626932dc3511b10ae3bc3e8688a7a83b0467dfbf92951747396735c9f47ad4552e7bdf4f8e7998a1266a360beb2ec1527390452139f9ab91ee250efcf3413e72a6b2688d8b6a4748ccc165bbf886573ccdd03bd93f32a866cd878ec246e06f31d4d7f7ec9836b7305ee0c1b9fa75cd6e4ca5cc2f107b654f15a2442cd9c8eaf581d093639fe35e0da49394c5ed66ad29bc2b863649e16c1951d0d3dd6f1048539e558ee1f059d91510a5acd84777ca01545635d2fb40e2f205bb11435023e47e4e2f85b6d1b56b688dd1a4304708a561d32dbaa6cd4f969e67af33773d4e9772751019dc6c2af7e2fe9d3c7eb6f1b401926603d90802f792b081957dd5ebd18410cd42b2ea05ae9a61254e4b878384b8a376fe9eba06afc1253f2224fab88feb7c426e3dfb19385afbb42cc13209b419568eeafdf505dc5ca30acc17d337e941e0badf9f9413f381fe9a315e2597426805827943f193f02a12554d434bd91708a28d9da1bf64ad64f80a7287d1e02d5d1f14bf9d89ba3badfa524694db6a651e97ea64104ad34942f36745259f4ec32fdce0bd13e693ccbe0e012e61a1fae9fc1662b99871e3812cea14d12646ccc08b0514762a475ecdbf9071377bb1ecd891c6fe32fde1d3044caf466b3a342b7541e8ed7432e94baf1d5546aff0e23f6a03c9ea5635519533e712639c27958e3a0f3684ed91cfb2e6e4", 0x3b8}], 0x1)
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200), 0x40000, &(0x7f00000000c0)=ANY=[@ANYRESOCT, @ANYRESHEX=r0])
chdir(&(0x7f0000000140)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r2, r1, 0x0, 0xfffffdef)

00:23:42 executing program 2:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
creat(&(0x7f0000000000)='./file1\x00', 0x100)

00:23:42 executing program 0:
perf_event_open(&(0x7f0000000080)={0x0, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r1, &(0x7f0000000100), 0x0, 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r0, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r2, 0xc80500, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0x0, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r1, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:23:42 executing program 4:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a)
ioctl$sock_TIOCOUTQ(r1, 0x5411, &(0x7f0000006800))
syz_mount_image$tmpfs(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r2, r0, 0x0, 0xfffffdef)

[ 3112.088032] loop5: detected capacity change from 0 to 40
00:23:42 executing program 3:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(0xffffffffffffffff, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)

[ 3112.140640] loop4: detected capacity change from 0 to 40
[ 3112.183230] loop2: detected capacity change from 0 to 40
[ 3112.196450] syz-executor.4: attempt to access beyond end of device
[ 3112.196450] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 3112.198635] Buffer I/O error on dev loop4, logical block 10, lost async page write
[ 3112.210183] FAT-fs (loop2): bogus number of reserved sectors
[ 3112.210610] FAT-fs (loop2): Can't find a valid FAT filesystem
[ 3112.214331] loop3: detected capacity change from 0 to 40
00:23:42 executing program 1:
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}}, 0x0, 0x6, 0xffffffffffffffff, 0xb)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
r1 = gettid()
rt_sigqueueinfo(0x0, 0x0, 0x0)
r2 = pidfd_getfd(0xffffffffffffffff, r0, 0x0)
perf_event_open(&(0x7f0000000040)={0x5, 0x80, 0x40, 0x71, 0x2, 0x0, 0x0, 0x8000, 0x20, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, @perf_config_ext={0xff}, 0x0, 0x9b5, 0xfa, 0xd, 0x0, 0x8000, 0x55, 0x0, 0x0, 0x0, 0x3ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000400)={0x2, 0x80, 0x2a, 0x81, 0xe0, 0x40, 0x0, 0x63c5ef1c, 0x80, 0x3, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x7, 0x2, @perf_config_ext={0xf2, 0x6}, 0x0, 0x5, 0xfffffff8, 0x0, 0x1, 0x0, 0x1b6, 0x0, 0x6}, 0x0, 0xd, 0xffffffffffffffff, 0x0)
rt_sigqueueinfo(0x0, 0x0, &(0x7f0000000000))
setsockopt$sock_timeval(r0, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10)
bind$packet(r2, &(0x7f00000000c0)={0x11, 0xfe, 0x0, 0x1, 0xfb, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}}, 0x14)
perf_event_open(&(0x7f0000000100)={0x0, 0x80, 0xff, 0x8, 0x4, 0x1, 0x0, 0x4, 0x684, 0x4, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0xdbc, 0x0, @perf_config_ext={0xd03, 0x80000000}, 0x800, 0x3, 0x3, 0x5, 0x300000000000000, 0x7, 0x7ff, 0x0, 0x0, 0x0, 0x5}, r1, 0x10, 0xffffffffffffffff, 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r3, &(0x7f0000000140), 0x0, 0x0, 0x0)
openat(r3, &(0x7f0000000180)='\x00', 0x400040, 0x80)
rt_sigqueueinfo(0x0, 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f0000000240)={'ip6_vti0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x4, 0x0, 0x7f, 0x40, 0xb, @local, @mcast1, 0x88, 0x20, 0x8, 0x2}})

00:23:42 executing program 5:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
syz_mount_image$tmpfs(&(0x7f00000001c0), &(0x7f0000000240)='./file0\x00', 0x1, 0x9, &(0x7f00000006c0)=[{&(0x7f0000000280)="65704fd016172b4bdc9f62d58a7eeaf41c63a3ec840d12ea0fd2a8427e4640e9f415591a4e3533ae4056057d8799edfaa910db2c835bc1fe48782de706e2a970522e17696cf94875371e121aa8947d58936f10160ca8430158027995e1c89cc7f75ff6c27d2658c0047239f8b265289ec6998160ec05a831879ab36ee97608ef89c68c", 0x83, 0x9}, {&(0x7f0000000340)="fd041e9acaa3f02cb98388137faf92121578971731fb190bbd0481b8531d848a080acfbc5a", 0x25, 0xffffffffffffffff}, {&(0x7f0000000380)="da67f763ac447998094ce295947cf48056f7856232ce5bfa0df93c2b3c4609", 0x1f, 0x9}, {&(0x7f00000003c0)="89185210917eac80e14c3780d73d1ced69392c4a9ed317d5", 0x18, 0x8}, {&(0x7f0000000400)="674d1756534be246885015102685d6611a508f1b9d237a935fb1e2465a84046670632f0d914156a877132e49a034146b32f13ae924e0d06409b7a16842f3eba749b370df402a80f78e1932b658a3e3deee77d4d5edeb6e389e17a841654119983032edd8ac23c2d5", 0x68, 0x80}, {&(0x7f0000000480)="2591e962fafbd429dd86d41fb395e5e88b29ae40eb4f5a68739a5e943195423e380815c3eb52f52730824e5ad6996c974c87", 0x32, 0x3}, {&(0x7f00000004c0)="c4463c0d4410a8b690c1f697e8bebdd5ccbd98658d7ccec03f54d47f9fbbf3a8435b271cb1e8c82aa6028020007b836e385f096c9deb4868d7c2a7e40c51ebc86eca7351adc64b1727c2406f51200a92bc2eed0086fc5f213541bf45b3caead59493fe1c73967c280806539ccbdf8c07b31c55582132ed898768f29b42ca0012c5a892c23ad1af3ae755027e3be2c10d02dad9bf503730e83c1e1cd37ff40bdb5d", 0xa1, 0x5}, {&(0x7f0000000580)="aa447f3a91f61cc79ddf5e4d80c0ea5dfb3a453cbc8450c96285e0c716a3161b270a3c500f47e26d94bea4299b4592730f85ffbb144a095d8cc72a25311c7ed586d3be1b18d3b52a71e2d7c2189b25e7a85b44da55bfef70a6b9", 0x5a, 0x7}, {&(0x7f0000000600)="1a6b3429d8d255a21c49b5a326d8447e8821ed5a66e51696d130d15e40e1f75f06ee56df8bc09bdacbf6da8a9a5ed11a2fc80d7899b5ac7df8840670bb86130cc8ef606794656a7800dd89ca45dd7d1341cefd74d2d95eaf41b9f50b56b9ba9c2242af7e03da09b0fb8a61c8b80f153154e9e83148d30d5eaba1b78bef8ee89680a41dd889d3788c139ceabf525bc88df7e7812bbcc40e4582b216db3da06a1587bcf0eb54", 0xa5, 0x6}], 0x90003, &(0x7f00000007c0)={[{@nr_inodes={'nr_inodes', 0x3d, [0x32, 0x67, 0x6b, 0x36, 0x32, 0x32]}}], [{@measure}, {@euid_lt={'euid<', 0xffffffffffffffff}}, {@smackfsroot={'smackfsroot', 0x3d, 'vfat\x00'}}]})
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
lsetxattr$security_ima(&(0x7f0000000040)='./file0\x00', &(0x7f00000000c0), &(0x7f0000000180)=@v1={0x2, "23c5b64ae333af9f23a7d1"}, 0xc, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef)

[ 3112.405836] loop5: detected capacity change from 0 to 40
00:23:43 executing program 2:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{0x0}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
creat(&(0x7f0000000000)='./file1\x00', 0x100)

00:23:43 executing program 3:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r0, 0x0, 0x0, 0x0, 0x0)

00:23:43 executing program 7:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684fd2981c8409820000080000000000000000"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x100d}], 0x65f, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

[ 3112.487381] syz-executor.5: attempt to access beyond end of device
[ 3112.487381] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 3112.488314] Buffer I/O error on dev loop5, logical block 10, lost async page write
00:23:43 executing program 4:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x27fd}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_mount_image$tmpfs(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef)

[ 3112.518024] syz-executor.5: attempt to access beyond end of device
[ 3112.518024] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 3112.518883] Buffer I/O error on dev loop5, logical block 10, lost async page write
00:23:43 executing program 5:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = syz_open_dev$tty1(0xc, 0x4, 0x1)
writev(r2, &(0x7f0000000000)=[{&(0x7f0000000140)="02b2dccad213e1e6cf54b7a797f8f22a47f25b7658fb110b2e76f95b0f318b8fa745e6ffba4414d29a42bfab524bc5bffb17decc4540a6f00b9772f5f9789a9525790df8d989b23530d0a1398f2ad734c7ff47961be476ffeec81efa3d3aa64b8ea329261dfc2e1047a68670f0e5950d6a5414956bddd09e101b5b66e5742fe843413e065e3b86a242b37bc58c68153a45015f6f1ea67762c302e461e0c84bbb7f8d464f5a72d9fad56dac0c5028a4012a93dbc7da640786e3c9898cdd8fe091b166bfcd66e6257abc923ceaf90e994deded3fe8a59c2105f5caf366d32170ef51299dbf441bc3cddda352a2e07375fb44e75fed8082f3e960015d9bcddb0c834feda68d113a9a9fc0d1c30153685caf43b176219b666d74e67b6192cfd8a561c6c4aadcc80ed8c469bc41b028f1db515d699e45ad3379f9b1edb8de4bb2f8615d6716297baac7e45073fcecf31e51ec78c40edd78f245bced04414f849fb961fbbe79ff2ed7c48ec1b5331f9755d7094986fc8da198ce4a12f9ddfb43e565bc4fed618da9a693d03c3e7ec4b3014dfc022103e277c1b12efb03ef8b197f3a931f6cbe238cf8a4e7639b409b4586f66da41b94eed69d52ba9fde5aa1ee774d4e626932dc3511b10ae3bc3e8688a7a83b0467dfbf92951747396735c9f47ad4552e7bdf4f8e7998a1266a360beb2ec1527390452139f9ab91ee250efcf3413e72a6b2688d8b6a4748ccc165bbf886573ccdd03bd93f32a866cd878ec246e06f31d4d7f7ec9836b7305ee0c1b9fa75cd6e4ca5cc2f107b654f15a2442cd9c8eaf581d093639fe35e0da49394c5ed66ad29bc2b863649e16c1951d0d3dd6f1048539e558ee1f059d91510a5acd84777ca01545635d2fb40e2f205bb11435023e47e4e2f85b6d1b56b688dd1a4304708a561d32dbaa6cd4f969e67af33773d4e9772751019dc6c2af7e2fe9d3c7eb6f1b401926603d90802f792b081957dd5ebd18410cd42b2ea05ae9a61254e4b878384b8a376fe9eba06afc1253f2224fab88feb7c426e3dfb19385afbb42cc13209b419568eeafdf505dc5ca30acc17d337e941e0badf9f9413f381fe9a315e2597426805827943f193f02a12554d434bd91708a28d9da1bf64ad64f80a7287d1e02d5d1f14bf9d89ba3badfa524694db6a651e97ea64104ad34942f36745259f4ec32fdce0bd13e693ccbe0e012e61a1fae9fc1662b99871e3812cea14d12646ccc08b0514762a475ecdbf9071377bb1ecd891c6fe32fde1d3044caf466b3a342b7541e8ed7432e94baf1d5546aff0e23f6a03c9ea5635519533e712639c27958e3a0f3684ed91cfb2e6e4", 0x3b8}], 0x1)
r3 = syz_open_dev$tty1(0xc, 0x4, 0x1)
writev(r3, &(0x7f0000000000)=[{&(0x7f0000000140)="02b2dccad213e1e6cf54b7a797f8f22a47f25b7658fb110b2e76f95b0f318b8fa745e6ffba4414d29a42bfab524bc5bffb17decc4540a6f00b9772f5f9789a9525790df8d989b23530d0a1398f2ad734c7ff47961be476ffeec81efa3d3aa64b8ea329261dfc2e1047a68670f0e5950d6a5414956bddd09e101b5b66e5742fe843413e065e3b86a242b37bc58c68153a45015f6f1ea67762c302e461e0c84bbb7f8d464f5a72d9fad56dac0c5028a4012a93dbc7da640786e3c9898cdd8fe091b166bfcd66e6257abc923ceaf90e994deded3fe8a59c2105f5caf366d32170ef51299dbf441bc3cddda352a2e07375fb44e75fed8082f3e960015d9bcddb0c834feda68d113a9a9fc0d1c30153685caf43b176219b666d74e67b6192cfd8a561c6c4aadcc80ed8c469bc41b028f1db515d699e45ad3379f9b1edb8de4bb2f8615d6716297baac7e45073fcecf31e51ec78c40edd78f245bced04414f849fb961fbbe79ff2ed7c48ec1b5331f9755d7094986fc8da198ce4a12f9ddfb43e565bc4fed618da9a693d03c3e7ec4b3014dfc022103e277c1b12efb03ef8b197f3a931f6cbe238cf8a4e7639b409b4586f66da41b94eed69d52ba9fde5aa1ee774d4e626932dc3511b10ae3bc3e8688a7a83b0467dfbf92951747396735c9f47ad4552e7bdf4f8e7998a1266a360beb2ec1527390452139f9ab91ee250efcf3413e72a6b2688d8b6a4748ccc165bbf886573ccdd03bd93f32a866cd878ec246e06f31d4d7f7ec9836b7305ee0c1b9fa75cd6e4ca5cc2f107b654f15a2442cd9c8eaf581d093639fe35e0da49394c5ed66ad29bc2b863649e16c1951d0d3dd6f1048539e558ee1f059d91510a5acd84777ca01545635d2fb40e2f205bb11435023e47e4e2f85b6d1b56b688dd1a4304708a561d32dbaa6cd4f969e67af33773d4e9772751019dc6c2af7e2fe9d3c7eb6f1b401926603d90802f792b081957dd5ebd18410cd42b2ea05ae9a61254e4b878384b8a376fe9eba06afc1253f2224fab88feb7c426e3dfb19385afbb42cc13209b419568eeafdf505dc5ca30acc17d337e941e0badf9f9413f381fe9a315e2597426805827943f193f02a12554d434bd91708a28d9da1bf64ad64f80a7287d1e02d5d1f14bf9d89ba3badfa524694db6a651e97ea64104ad34942f36745259f4ec32fdce0bd13e693ccbe0e012e61a1fae9fc1662b99871e3812cea14d12646ccc08b0514762a475ecdbf9071377bb1ecd891c6fe32fde1d3044caf466b3a342b7541e8ed7432e94baf1d5546aff0e23f6a03c9ea5635519533e712639c27958e3a0f3684ed91cfb2e6e4", 0x3b8}], 0x1)
r4 = perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f00000000c0)=ANY=[@ANYBLOB="08000000000000001fef20895218000000", @ANYRES32=r4, @ANYBLOB="00000000000000002ed9aeaff9b7f1164083cb1f9bed3f8f5e3000000000c100"])
r5 = perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r6 = pidfd_getfd(r1, r2, 0x0)
ioctl$CDROM_SELECT_SPEED(r6, 0x5322, 0x80000001)
ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f00000005c0)=ANY=[@ANYBLOB="010000000100000018000000", @ANYRES32=r5, @ANYBLOB="00000000008f5ea6c065300000000000000000000000000000000000a1b215655c7ff29786b3d071924aa2a9c5521534caaeef5f30e23407"])
write$binfmt_aout(r1, &(0x7f0000000540)=ANY=[@ANYRES16=r2, @ANYRES32=r5, @ANYRESHEX=r3, @ANYRESHEX, @ANYRES64=r0, @ANYRESOCT], 0xfffffffffffffec9)
openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/consoles\x00', 0x0, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef)

[ 3112.621551] loop3: detected capacity change from 0 to 40
00:23:43 executing program 1:
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}}, 0x0, 0x6, 0xffffffffffffffff, 0xb)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
r1 = gettid()
rt_sigqueueinfo(0x0, 0x0, 0x0)
r2 = pidfd_getfd(0xffffffffffffffff, r0, 0x0)
perf_event_open(&(0x7f0000000040)={0x5, 0x80, 0x40, 0x71, 0x2, 0x0, 0x0, 0x8000, 0x20, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, @perf_config_ext={0xff}, 0x0, 0x9b5, 0xfa, 0xd, 0x0, 0x8000, 0x55, 0x0, 0x0, 0x0, 0x3ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000400)={0x2, 0x80, 0x2a, 0x81, 0xe0, 0x40, 0x0, 0x63c5ef1c, 0x80, 0x3, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x7, 0x2, @perf_config_ext={0xf2, 0x6}, 0x0, 0x5, 0xfffffff8, 0x0, 0x1, 0x0, 0x1b6, 0x0, 0x6}, 0x0, 0xd, 0xffffffffffffffff, 0x0)
rt_sigqueueinfo(0x0, 0x0, &(0x7f0000000000))
setsockopt$sock_timeval(r0, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10)
bind$packet(r2, &(0x7f00000000c0)={0x11, 0xfe, 0x0, 0x1, 0xfb, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}}, 0x14)
perf_event_open(&(0x7f0000000100)={0x0, 0x80, 0xff, 0x8, 0x4, 0x1, 0x0, 0x4, 0x684, 0x4, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0xdbc, 0x0, @perf_config_ext={0xd03, 0x80000000}, 0x800, 0x3, 0x3, 0x5, 0x300000000000000, 0x7, 0x7ff, 0x0, 0x0, 0x0, 0x5}, r1, 0x10, 0xffffffffffffffff, 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r3, &(0x7f0000000140)=[{0x0}], 0x1, 0x0, 0x0)
openat(r3, &(0x7f0000000180)='\x00', 0x400040, 0x80)
rt_sigqueueinfo(0x0, 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f0000000240)={'ip6_vti0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x4, 0x0, 0x7f, 0x40, 0xb, @local, @mcast1, 0x88, 0x20, 0x8, 0x2}})

[ 3112.638756] loop2: detected capacity change from 0 to 40
[ 3112.647729] FAT-fs (loop2): bogus number of reserved sectors
[ 3112.648600] FAT-fs (loop2): Can't find a valid FAT filesystem
00:23:43 executing program 0:
perf_event_open(&(0x7f0000000080)={0x0, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r1, &(0x7f0000000100), 0x0, 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r0, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r2, 0xd00500, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0x0, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r1, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:23:43 executing program 3:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r0, 0x0, 0x0, 0x0, 0x0)

00:23:43 executing program 2:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{0x0}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
creat(&(0x7f0000000000)='./file1\x00', 0x100)

[ 3112.795674] loop4: detected capacity change from 0 to 39
[ 3112.829440] loop3: detected capacity change from 0 to 40
[ 3112.839422] loop5: detected capacity change from 0 to 40
[ 3112.906582] loop2: detected capacity change from 0 to 40
[ 3112.917802] FAT-fs (loop2): bogus number of reserved sectors
[ 3112.918381] FAT-fs (loop2): Can't find a valid FAT filesystem
[ 3112.984199] syz-executor.4: attempt to access beyond end of device
[ 3112.984199] loop4: rw=2049, sector=40, nr_sectors = 4 limit=39
[ 3112.984257] Buffer I/O error on dev loop4, logical block 10, lost async page write
[ 3113.047300] syz-executor.4: attempt to access beyond end of device
[ 3113.047300] loop4: rw=2049, sector=40, nr_sectors = 4 limit=39
[ 3113.049181] Buffer I/O error on dev loop4, logical block 10, lost async page write
00:24:03 executing program 6:
connect$unix(0xffffffffffffffff, &(0x7f0000000180)=@abs={0x0, 0x0, 0x4e23}, 0x6e)
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef)

00:24:03 executing program 7:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684fd2981c8409820000080000000000000000"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x100d}], 0x665, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:24:03 executing program 2:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{0x0}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
creat(&(0x7f0000000000)='./file1\x00', 0x100)

00:24:03 executing program 4:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = syz_io_uring_complete(0x0)
inotify_add_watch(r0, &(0x7f0000000040)='./file0\x00', 0x20000005)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = io_uring_register$IORING_REGISTER_PERSONALITY(r1, 0x9, 0x0, 0x0)
openat(0xffffffffffffffff, &(0x7f0000000400)='./file1\x00', 0x82201, 0x7)
syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_RECV=@use_registered_buffer={0x1b, 0x4, 0x0, r1, 0x0, 0x0, 0x0, 0x40, 0x0, {0x3, r2}}, 0x4)
mount$9p_unix(&(0x7f0000000280)='./file0\x00', &(0x7f00000002c0)='./file0\x00', &(0x7f0000000300), 0x2064e2, &(0x7f0000000340)={'trans=unix,', {[{@nodevmap}, {@cachetag={'cachetag', 0x3d, '!'}}, {@access_uid={'access', 0x3d, 0xee01}}], [{@dont_hash}, {@obj_user={'obj_user', 0x3d, '+*.\\'}}, {@smackfsdef={'smackfsdef', 0x3d, '-,\xa8-\\#'}}, {@fsname={'fsname', 0x3d, 'vfat\x00'}}, {@fsname={'fsname', 0x3d, 'vfat\x00'}}]}})
syz_mount_image$tmpfs(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r3, &(0x7f0000001180)=ANY=[], 0x220)
ioctl$AUTOFS_DEV_IOCTL_OPENMOUNT(r3, 0xc0189374, &(0x7f00000000c0)={{0x1, 0x1, 0x18, <r4=>r0, {0x1}}, './file1\x00'})
accept4$unix(r4, &(0x7f0000000180)=@abs, &(0x7f0000000240)=0x6e, 0x80800)
sendfile(r3, r1, 0x0, 0xfffffdef)
syz_io_uring_setup(0x46ac, &(0x7f0000000200), &(0x7f00000a0000)=nil, &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000000100)=<r5=>0x0, &(0x7f0000000140)=<r6=>0x0)
socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, <r7=>0xffffffffffffffff})
syz_io_uring_submit(r5, r6, &(0x7f00000001c0)=@IORING_OP_RECV=@use_registered_buffer={0x1b, 0x0, 0x0, r7}, 0x0)
syz_io_uring_submit(r5, 0x0, &(0x7f00000003c0)=@IORING_OP_READV=@use_registered_buffer={0x1, 0x4, 0x4007, @fd=r4, 0x5, 0x0, 0x0, 0x9, 0x0, {0xfffd, r2}}, 0x6)

00:24:03 executing program 5:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000180)='./file2\x00')
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r2, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
r3 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs2/binder-control\x00', 0x802, 0x0)
ioctl$AUTOFS_DEV_IOCTL_ASKUMOUNT(r2, 0xc018937d, &(0x7f00000000c0)={{0x1, 0x1, 0x18, r3, {0x3}}, './file2\x00'})

00:24:03 executing program 3:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r0, 0x0, 0x0, 0x0, 0x0)

00:24:03 executing program 0:
perf_event_open(&(0x7f0000000080)={0x0, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r1, &(0x7f0000000100), 0x0, 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r0, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r2, 0xd80500, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0x0, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r1, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:24:03 executing program 1:
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}}, 0x0, 0x6, 0xffffffffffffffff, 0xb)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
r1 = gettid()
rt_sigqueueinfo(0x0, 0x0, 0x0)
r2 = pidfd_getfd(0xffffffffffffffff, r0, 0x0)
perf_event_open(&(0x7f0000000040)={0x5, 0x80, 0x40, 0x71, 0x2, 0x0, 0x0, 0x8000, 0x20, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, @perf_config_ext={0xff}, 0x0, 0x9b5, 0xfa, 0xd, 0x0, 0x8000, 0x55, 0x0, 0x0, 0x0, 0x3ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000400)={0x2, 0x80, 0x2a, 0x81, 0xe0, 0x40, 0x0, 0x63c5ef1c, 0x80, 0x3, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x7, 0x2, @perf_config_ext={0xf2, 0x6}, 0x0, 0x5, 0xfffffff8, 0x0, 0x1, 0x0, 0x1b6, 0x0, 0x6}, 0x0, 0xd, 0xffffffffffffffff, 0x0)
rt_sigqueueinfo(0x0, 0x0, &(0x7f0000000000))
setsockopt$sock_timeval(r0, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10)
bind$packet(r2, &(0x7f00000000c0)={0x11, 0xfe, 0x0, 0x1, 0xfb, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}}, 0x14)
perf_event_open(&(0x7f0000000100)={0x0, 0x80, 0xff, 0x8, 0x4, 0x1, 0x0, 0x4, 0x684, 0x4, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0xdbc, 0x0, @perf_config_ext={0xd03, 0x80000000}, 0x800, 0x3, 0x3, 0x5, 0x300000000000000, 0x7, 0x7ff, 0x0, 0x0, 0x0, 0x5}, r1, 0x10, 0xffffffffffffffff, 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r3, &(0x7f0000000140)=[{0x0}], 0x1, 0x0, 0x0)
openat(r3, &(0x7f0000000180)='\x00', 0x400040, 0x80)
rt_sigqueueinfo(0x0, 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f0000000240)={'ip6_vti0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x4, 0x0, 0x7f, 0x40, 0xb, @local, @mcast1, 0x88, 0x20, 0x8, 0x2}})

[ 3132.629376] loop2: detected capacity change from 0 to 40
[ 3132.631468] loop4: detected capacity change from 0 to 40
[ 3132.648782] loop3: detected capacity change from 0 to 40
[ 3132.655427] loop5: detected capacity change from 0 to 40
[ 3132.656185] FAT-fs (loop2): bogus number of reserved sectors
[ 3132.657215] FAT-fs (loop2): Can't find a valid FAT filesystem
[ 3132.661657] loop6: detected capacity change from 0 to 40
[ 3132.754742] syz-executor.4: attempt to access beyond end of device
[ 3132.754742] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 3132.756541] Buffer I/O error on dev loop4, logical block 10, lost async page write
[ 3132.772283] syz-executor.6: attempt to access beyond end of device
[ 3132.772283] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 3132.774016] Buffer I/O error on dev loop6, logical block 10, lost async page write
[ 3132.793598] syz-executor.5: attempt to access beyond end of device
[ 3132.793598] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 3132.795356] Buffer I/O error on dev loop5, logical block 10, lost async page write
00:24:03 executing program 1:
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}}, 0x0, 0x6, 0xffffffffffffffff, 0xb)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
r1 = gettid()
rt_sigqueueinfo(0x0, 0x0, 0x0)
r2 = pidfd_getfd(0xffffffffffffffff, r0, 0x0)
perf_event_open(&(0x7f0000000040)={0x5, 0x80, 0x40, 0x71, 0x2, 0x0, 0x0, 0x8000, 0x20, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, @perf_config_ext={0xff}, 0x0, 0x9b5, 0xfa, 0xd, 0x0, 0x8000, 0x55, 0x0, 0x0, 0x0, 0x3ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000400)={0x2, 0x80, 0x2a, 0x81, 0xe0, 0x40, 0x0, 0x63c5ef1c, 0x80, 0x3, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x7, 0x2, @perf_config_ext={0xf2, 0x6}, 0x0, 0x5, 0xfffffff8, 0x0, 0x1, 0x0, 0x1b6, 0x0, 0x6}, 0x0, 0xd, 0xffffffffffffffff, 0x0)
rt_sigqueueinfo(0x0, 0x0, &(0x7f0000000000))
setsockopt$sock_timeval(r0, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10)
bind$packet(r2, &(0x7f00000000c0)={0x11, 0xfe, 0x0, 0x1, 0xfb, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}}, 0x14)
perf_event_open(&(0x7f0000000100)={0x0, 0x80, 0xff, 0x8, 0x4, 0x1, 0x0, 0x4, 0x684, 0x4, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0xdbc, 0x0, @perf_config_ext={0xd03, 0x80000000}, 0x800, 0x3, 0x3, 0x5, 0x300000000000000, 0x7, 0x7ff, 0x0, 0x0, 0x0, 0x5}, r1, 0x10, 0xffffffffffffffff, 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r3, &(0x7f0000000140)=[{0x0}], 0x1, 0x0, 0x0)
openat(r3, &(0x7f0000000180)='\x00', 0x400040, 0x80)
rt_sigqueueinfo(0x0, 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f0000000240)={'ip6_vti0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x4, 0x0, 0x7f, 0x40, 0xb, @local, @mcast1, 0x88, 0x20, 0x8, 0x2}})

00:24:03 executing program 3:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r0, &(0x7f0000000140), 0x0, 0x0, 0x0)

00:24:03 executing program 2:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
creat(&(0x7f0000000000)='./file1\x00', 0x100)

00:24:03 executing program 0:
perf_event_open(&(0x7f0000000080)={0x0, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r1, &(0x7f0000000100), 0x0, 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r0, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r2, 0xe00500, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0x0, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r1, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

[ 3133.017450] loop2: detected capacity change from 0 to 40
[ 3133.036708] FAT-fs (loop2): bogus number of reserved sectors
[ 3133.037645] FAT-fs (loop2): Can't find a valid FAT filesystem
[ 3133.064779] loop3: detected capacity change from 0 to 40
[ 3148.410291] loop5: detected capacity change from 0 to 40
[ 3148.411666] loop2: detected capacity change from 0 to 40
00:24:19 executing program 0:
perf_event_open(&(0x7f0000000080)={0x0, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r1, &(0x7f0000000100), 0x0, 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r0, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r2, 0xe80500, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0x0, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r1, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:24:19 executing program 6:
r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r2, &(0x7f0000000240)=ANY=[@ANYBLOB="4a19a1ef5e7a171f258ab18d30c3581bc67fa65eec01f0a4c01fbb0f488f4663ed0a6e106f51380ce48ba7220260b17d726d2a05dc0594f1641d667dc130938347757556d5962b0f0200000014290ae879bf355211bfbee9b8930899d9cc1e130ab21fa380671e8861502793b3324d6ba654f9b407f1bc", @ANYRES16=r0, @ANYBLOB="f4d7378bf978c7233ce7ec04ac46faa9a68368687f735090a2b9edcc930f50d6192fb6a1b7cad4c0d009d02b8299afc69a21f6672c2d20438628030611d8fb41554cd205e9f627565070bd6a153af28608ab70ce8cfbb6845f9dfaea21ae80e07baa2795402e46c0923d89af9b8da5d44ac7b4b43b18d1a982b80ed55049cef2c9fefbad3d362611771336303e96fcfd68c007f3858d791707e360c0039f"], 0x220)
sendfile(r2, r1, 0x0, 0xfffffdef)

00:24:19 executing program 7:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684fd2981c8409820000080000000000000000"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x100d}], 0x66d, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:24:19 executing program 1:
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}}, 0x0, 0x6, 0xffffffffffffffff, 0xb)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
r1 = gettid()
rt_sigqueueinfo(0x0, 0x0, 0x0)
r2 = pidfd_getfd(0xffffffffffffffff, r0, 0x0)
perf_event_open(&(0x7f0000000040)={0x5, 0x80, 0x40, 0x71, 0x2, 0x0, 0x0, 0x8000, 0x20, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, @perf_config_ext={0xff}, 0x0, 0x9b5, 0xfa, 0xd, 0x0, 0x8000, 0x55, 0x0, 0x0, 0x0, 0x3ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000400)={0x2, 0x80, 0x2a, 0x81, 0xe0, 0x40, 0x0, 0x63c5ef1c, 0x80, 0x3, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x7, 0x2, @perf_config_ext={0xf2, 0x6}, 0x0, 0x5, 0xfffffff8, 0x0, 0x1, 0x0, 0x1b6, 0x0, 0x6}, 0x0, 0xd, 0xffffffffffffffff, 0x0)
rt_sigqueueinfo(0x0, 0x0, &(0x7f0000000000))
setsockopt$sock_timeval(r0, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10)
bind$packet(r2, &(0x7f00000000c0)={0x11, 0xfe, 0x0, 0x1, 0xfb, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}}, 0x14)
perf_event_open(&(0x7f0000000100)={0x0, 0x80, 0xff, 0x8, 0x4, 0x1, 0x0, 0x4, 0x684, 0x4, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0xdbc, 0x0, @perf_config_ext={0xd03, 0x80000000}, 0x800, 0x3, 0x3, 0x5, 0x300000000000000, 0x7, 0x7ff, 0x0, 0x0, 0x0, 0x5}, r1, 0x10, 0xffffffffffffffff, 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r3, &(0x7f0000000140)=[{}], 0x1, 0x0, 0x0)
openat(r3, &(0x7f0000000180)='\x00', 0x400040, 0x80)
rt_sigqueueinfo(0x0, 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f0000000240)={'ip6_vti0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x4, 0x0, 0x7f, 0x40, 0xb, @local, @mcast1, 0x88, 0x20, 0x8, 0x2}})

00:24:19 executing program 5:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
fsmount(r0, 0x1, 0x74)
write$binfmt_aout(0xffffffffffffffff, &(0x7f0000001180)=ANY=[], 0x23d)
fallocate(r0, 0x41, 0x8, 0x7)
sendfile(r1, r0, 0x0, 0xfffffdef)

00:24:19 executing program 4:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = socket$inet6_udp(0xa, 0x2, 0x0)
getsockopt$inet6_int(r0, 0x29, 0x3e, 0x0, &(0x7f0000000340))
accept4(r0, &(0x7f0000000240)=@pppoe={0x18, 0x0, {0x0, @random}}, &(0x7f00000001c0)=0x80, 0x80000)
r1 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/cgroup', 0x101000, 0x10)
clock_gettime(0x0, &(0x7f00000000c0)={<r2=>0x0, <r3=>0x0})
utimensat(r1, &(0x7f0000000040)='./file0\x00', &(0x7f0000000180)={{}, {r2, r3/1000+60000}}, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x583042, 0x65)
syz_mount_image$tmpfs(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r5, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r5, r4, 0x0, 0xfffffdef)

00:24:19 executing program 2:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
creat(&(0x7f0000000000)='./file1\x00', 0x100)

00:24:19 executing program 3:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r0, &(0x7f0000000140), 0x0, 0x0, 0x0)

[ 3148.428537] FAT-fs (loop2): bogus number of reserved sectors
[ 3148.429001] FAT-fs (loop2): Can't find a valid FAT filesystem
[ 3148.478861] loop4: detected capacity change from 0 to 40
[ 3148.485943] loop3: detected capacity change from 0 to 40
[ 3148.488686] loop6: detected capacity change from 0 to 40
00:24:19 executing program 2:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
creat(&(0x7f0000000000)='./file1\x00', 0x100)

[ 3148.564551] syz-executor.6: attempt to access beyond end of device
[ 3148.564551] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 3148.565475] Buffer I/O error on dev loop6, logical block 10, lost async page write
[ 3148.590941] loop2: detected capacity change from 0 to 40
[ 3148.595245] FAT-fs (loop2): bogus number of reserved sectors
[ 3148.595715] FAT-fs (loop2): Can't find a valid FAT filesystem
00:24:37 executing program 2:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00", 0xc}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
creat(&(0x7f0000000000)='./file1\x00', 0x100)

00:24:37 executing program 7:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684fd2981c8409820000080000000000000000"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x100d}], 0x688, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:24:37 executing program 6:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file1\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000040)="60daa9165070c1121ca02b00080139000440002034f801", 0x17}, {0x0, 0xfffffffffffffc66, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
ioctl$EXT4_IOC_SWAP_BOOT(r0, 0x6611)
r1 = openat(r0, &(0x7f0000000180)='./file0\x00', 0x8000, 0x18a)
chdir(&(0x7f0000000140)='./file0\x00')
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_io_uring_submit(0x0, 0x0, &(0x7f00000001c0)=@IORING_OP_ASYNC_CANCEL={0xe, 0x1, 0x0, 0x0, 0x0, 0x12345}, 0x6)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
ioctl$EXT4_IOC_SWAP_BOOT(r3, 0x6611)
mount$9p_fd(0x0, &(0x7f0000000280)='./file0\x00', &(0x7f00000002c0), 0x2, &(0x7f0000000300)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {}, 0x2c, {[{@afid}, {@loose}], [{@audit}, {@func={'func', 0x3d, 'CREDS_CHECK'}}, {@appraise_type}]}})
openat(r3, &(0x7f0000000240)='./file1\x00', 0x400000, 0x14c)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r4, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r4, r2, 0x0, 0xfffffdef)
openat(r4, &(0x7f00000000c0)='./file0\x00', 0x400000, 0x62)

00:24:37 executing program 1:
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}}, 0x0, 0x6, 0xffffffffffffffff, 0xb)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
r1 = gettid()
rt_sigqueueinfo(0x0, 0x0, 0x0)
r2 = pidfd_getfd(0xffffffffffffffff, r0, 0x0)
perf_event_open(&(0x7f0000000040)={0x5, 0x80, 0x40, 0x71, 0x2, 0x0, 0x0, 0x8000, 0x20, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, @perf_config_ext={0xff}, 0x0, 0x9b5, 0xfa, 0xd, 0x0, 0x8000, 0x55, 0x0, 0x0, 0x0, 0x3ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000400)={0x2, 0x80, 0x2a, 0x81, 0xe0, 0x40, 0x0, 0x63c5ef1c, 0x80, 0x3, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x7, 0x2, @perf_config_ext={0xf2, 0x6}, 0x0, 0x5, 0xfffffff8, 0x0, 0x1, 0x0, 0x1b6, 0x0, 0x6}, 0x0, 0xd, 0xffffffffffffffff, 0x0)
rt_sigqueueinfo(0x0, 0x0, &(0x7f0000000000))
setsockopt$sock_timeval(r0, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10)
bind$packet(r2, &(0x7f00000000c0)={0x11, 0xfe, 0x0, 0x1, 0xfb, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}}, 0x14)
perf_event_open(&(0x7f0000000100)={0x0, 0x80, 0xff, 0x8, 0x4, 0x1, 0x0, 0x4, 0x684, 0x4, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0xdbc, 0x0, @perf_config_ext={0xd03, 0x80000000}, 0x800, 0x3, 0x3, 0x5, 0x300000000000000, 0x7, 0x7ff, 0x0, 0x0, 0x0, 0x5}, r1, 0x10, 0xffffffffffffffff, 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r3, &(0x7f0000000140)=[{}], 0x1, 0x0, 0x0)
openat(r3, &(0x7f0000000180)='\x00', 0x400040, 0x80)
rt_sigqueueinfo(0x0, 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f0000000240)={'ip6_vti0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x4, 0x0, 0x7f, 0x40, 0xb, @local, @mcast1, 0x88, 0x20, 0x8, 0x2}})

00:24:37 executing program 3:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r0, &(0x7f0000000140), 0x0, 0x0, 0x0)

[ 3166.603779] loop3: detected capacity change from 0 to 40
00:24:37 executing program 4:
syz_mount_image$vfat(&(0x7f0000000280), &(0x7f0000000100)='./file0\x00', 0x0, 0xaaaab8a, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a000080101000440002000f80100", 0x17, 0x94}, {0x0, 0x0, 0x2800}], 0x2, &(0x7f0000000000)=ANY=[@ANYRESDEC])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r1 = signalfd4(r0, &(0x7f0000000040)={[0x3]}, 0x8, 0x0)
openat(r1, &(0x7f00000000c0)='./file1\x00', 0x2100, 0xa)
r2 = syz_mount_image$tmpfs(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r2, &(0x7f0000000180))
write$binfmt_aout(0xffffffffffffffff, &(0x7f0000001180)=ANY=[], 0x220)
getsockopt$bt_sco_SCO_OPTIONS(r1, 0x11, 0x1, &(0x7f00000001c0)=""/30, &(0x7f0000000240)=0x1e)
sendfile(0xffffffffffffffff, r0, 0x0, 0xfffffdef)

00:24:37 executing program 0:
perf_event_open(&(0x7f0000000080)={0x0, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r1, &(0x7f0000000100), 0x0, 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r0, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r2, 0xf00500, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0x0, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r1, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:24:37 executing program 5:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r2, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
mknodat(r2, &(0x7f0000000040)='./file1\x00', 0x2, 0x1)

[ 3166.673536] loop5: detected capacity change from 0 to 40
[ 3166.692084] loop2: detected capacity change from 0 to 40
[ 3166.696598] FAT-fs (loop6): bogus number of reserved sectors
[ 3166.697502] FAT-fs (loop6): Can't find a valid FAT filesystem
[ 3166.714139] FAT-fs (loop2): bogus number of reserved sectors
[ 3166.714944] FAT-fs (loop2): Can't find a valid FAT filesystem
[ 3166.748612] FAT-fs (loop6): Unrecognized mount option "./file0" or missing value
00:24:37 executing program 3:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r0, &(0x7f0000000140)=[{0x0}], 0x1, 0x0, 0x0)

[ 3166.814454] syz-executor.5: attempt to access beyond end of device
[ 3166.814454] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 3166.816088] Buffer I/O error on dev loop5, logical block 10, lost async page write
00:24:37 executing program 1:
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}}, 0x0, 0x6, 0xffffffffffffffff, 0xb)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
r1 = gettid()
rt_sigqueueinfo(0x0, 0x0, 0x0)
r2 = pidfd_getfd(0xffffffffffffffff, r0, 0x0)
perf_event_open(&(0x7f0000000040)={0x5, 0x80, 0x40, 0x71, 0x2, 0x0, 0x0, 0x8000, 0x20, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, @perf_config_ext={0xff}, 0x0, 0x9b5, 0xfa, 0xd, 0x0, 0x8000, 0x55, 0x0, 0x0, 0x0, 0x3ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000400)={0x2, 0x80, 0x2a, 0x81, 0xe0, 0x40, 0x0, 0x63c5ef1c, 0x80, 0x3, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x7, 0x2, @perf_config_ext={0xf2, 0x6}, 0x0, 0x5, 0xfffffff8, 0x0, 0x1, 0x0, 0x1b6, 0x0, 0x6}, 0x0, 0xd, 0xffffffffffffffff, 0x0)
rt_sigqueueinfo(0x0, 0x0, &(0x7f0000000000))
setsockopt$sock_timeval(r0, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10)
bind$packet(r2, &(0x7f00000000c0)={0x11, 0xfe, 0x0, 0x1, 0xfb, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}}, 0x14)
perf_event_open(&(0x7f0000000100)={0x0, 0x80, 0xff, 0x8, 0x4, 0x1, 0x0, 0x4, 0x684, 0x4, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0xdbc, 0x0, @perf_config_ext={0xd03, 0x80000000}, 0x800, 0x3, 0x3, 0x5, 0x300000000000000, 0x7, 0x7ff, 0x0, 0x0, 0x0, 0x5}, r1, 0x10, 0xffffffffffffffff, 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r3, &(0x7f0000000140)=[{}], 0x1, 0x0, 0x0)
openat(r3, &(0x7f0000000180)='\x00', 0x400040, 0x80)
rt_sigqueueinfo(0x0, 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f0000000240)={'ip6_vti0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x4, 0x0, 0x7f, 0x40, 0xb, @local, @mcast1, 0x88, 0x20, 0x8, 0x2}})

[ 3166.873913] syz-executor.5: attempt to access beyond end of device
[ 3166.873913] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 3166.875663] Buffer I/O error on dev loop5, logical block 10, lost async page write
00:24:37 executing program 0:
perf_event_open(&(0x7f0000000080)={0x0, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r1, &(0x7f0000000100), 0x0, 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r0, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r2, 0xf80500, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0x0, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r1, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:24:37 executing program 2:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00", 0xc}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
creat(&(0x7f0000000000)='./file1\x00', 0x100)

00:24:37 executing program 6:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
openat(0xffffffffffffffff, &(0x7f0000000040)='./file0/../file0\x00', 0x22000, 0x10)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
r2 = perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x1, 0xffffffffffffffff, 0x0)
ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000500)=ANY=[@ANYBLOB="010000000100000018000000", @ANYRES32=r2, @ANYBLOB="00000000000000002ed9aeaff9b7f1164083cb1f9bed3f8f5e3000000000c100"])
readahead(r2, 0x92, 0x0)
sendfile(r1, r0, 0x0, 0xfffffdef)

[ 3166.951744] loop3: detected capacity change from 0 to 40
00:24:37 executing program 5:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef)
r2 = syz_open_dev$ttys(0xc, 0x2, 0x0)
ioctl$BTRFS_IOC_QUOTA_RESCAN(r2, 0x4040942c, &(0x7f0000000040)={0x0, 0x100, [0x200, 0xf863fac, 0xa35, 0x100000001, 0x80000001, 0x2000]})

[ 3167.082153] loop6: detected capacity change from 0 to 40
00:24:37 executing program 3:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r0, &(0x7f0000000140)=[{0x0}], 0x1, 0x0, 0x0)

[ 3167.102695] loop2: detected capacity change from 0 to 40
[ 3167.120149] FAT-fs (loop2): bogus number of reserved sectors
[ 3167.120917] FAT-fs (loop2): Can't find a valid FAT filesystem
00:24:37 executing program 1:
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}}, 0x0, 0x6, 0xffffffffffffffff, 0xb)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
r1 = gettid()
rt_sigqueueinfo(0x0, 0x0, 0x0)
r2 = pidfd_getfd(0xffffffffffffffff, r0, 0x0)
perf_event_open(&(0x7f0000000040)={0x5, 0x80, 0x40, 0x71, 0x2, 0x0, 0x0, 0x8000, 0x20, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, @perf_config_ext={0xff}, 0x0, 0x9b5, 0xfa, 0xd, 0x0, 0x8000, 0x55, 0x0, 0x0, 0x0, 0x3ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000400)={0x2, 0x80, 0x2a, 0x81, 0xe0, 0x40, 0x0, 0x63c5ef1c, 0x80, 0x3, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x7, 0x2, @perf_config_ext={0xf2, 0x6}, 0x0, 0x5, 0xfffffff8, 0x0, 0x1, 0x0, 0x1b6, 0x0, 0x6}, 0x0, 0xd, 0xffffffffffffffff, 0x0)
rt_sigqueueinfo(0x0, 0x0, &(0x7f0000000000))
setsockopt$sock_timeval(r0, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10)
bind$packet(r2, &(0x7f00000000c0)={0x11, 0xfe, 0x0, 0x1, 0xfb, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}}, 0x14)
perf_event_open(&(0x7f0000000100)={0x0, 0x80, 0xff, 0x8, 0x4, 0x1, 0x0, 0x4, 0x684, 0x4, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0xdbc, 0x0, @perf_config_ext={0xd03, 0x80000000}, 0x800, 0x3, 0x3, 0x5, 0x300000000000000, 0x7, 0x7ff, 0x0, 0x0, 0x0, 0x5}, r1, 0x10, 0xffffffffffffffff, 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r3, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
openat(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x400040, 0x80)
rt_sigqueueinfo(0x0, 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f0000000240)={'ip6_vti0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x4, 0x0, 0x7f, 0x40, 0xb, @local, @mcast1, 0x88, 0x20, 0x8, 0x2}})

[ 3167.142313] loop5: detected capacity change from 0 to 40
[ 3167.195847] syz-executor.6: attempt to access beyond end of device
[ 3167.195847] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 3167.197459] Buffer I/O error on dev loop6, logical block 10, lost async page write
[ 3167.220775] loop3: detected capacity change from 0 to 40
[ 3167.234929] syz-executor.5: attempt to access beyond end of device
[ 3167.234929] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 3167.236345] Buffer I/O error on dev loop5, logical block 10, lost async page write
[ 3167.251679] syz-executor.6: attempt to access beyond end of device
[ 3167.251679] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 3167.253182] Buffer I/O error on dev loop6, logical block 10, lost async page write
00:24:37 executing program 7:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684fd2981c8409820000080000000000000000"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x100d}], 0x692, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:24:52 executing program 2:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00", 0xc}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
creat(&(0x7f0000000000)='./file1\x00', 0x100)

00:24:52 executing program 4:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_mount_image$tmpfs(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000180), 0x801, 0x0)
r3 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000001c0), 0x1, 0x0)
ioctl$AUTOFS_DEV_IOCTL_SETPIPEFD(r1, 0xc0189378, &(0x7f0000000240)={{0x1, 0x1, 0x18, r2, {r3}}, './file1\x00'})
setxattr$security_capability(&(0x7f0000000000)='./file1\x00', &(0x7f0000000040), &(0x7f00000000c0)=@v2={0x2000000, [{0x7ff, 0x1c7}, {0x4, 0x9}]}, 0x14, 0x2)
sendfile(r1, r0, 0x0, 0xfffffdef)

00:24:52 executing program 7:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684fd2981c8409820000080000000000000000"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x100d}], 0x698, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:24:52 executing program 5:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef)
r2 = perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000500)=ANY=[@ANYBLOB="010000000100000018000000", @ANYRES32=r2, @ANYBLOB="00000000000000002ed9aeaff9b7f1164083cb1f9bed3f8f5e3000000000c100"])
ioctl$EXT4_IOC_GET_ES_CACHE(r2, 0xc020662a, &(0x7f0000000040)={0x7fffffff, 0x101, 0x4, 0x4})

00:24:52 executing program 0:
perf_event_open(&(0x7f0000000080)={0x0, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r1, &(0x7f0000000100), 0x0, 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r0, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r2, 0x1000000, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0x0, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r1, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:24:52 executing program 3:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r0, &(0x7f0000000140)=[{0x0}], 0x1, 0x0, 0x0)

00:24:52 executing program 6:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
ioctl$EXT4_IOC_SWAP_BOOT(r0, 0x6611)
r1 = openat(r0, &(0x7f0000000100)='./file1\x00', 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
ioctl$EXT4_IOC_SWAP_BOOT(r2, 0x6611)
openat(r2, &(0x7f0000000340)='./file0\x00', 0x801, 0x9cae86b253249857)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
syz_mount_image$vfat(&(0x7f0000000040), &(0x7f00000000c0)='./file0\x00', 0x4800232a, 0x1, &(0x7f0000000180)=[{&(0x7f0000000240)="827699e73582cdfee4a15313c7b57423bcf50f7c7556ccf129e7e7322742ba7e9f9fb46929c4019ca2363aeda7d9128658a18097d02b685d1e7dc4ab5bc99d3cac5b0c273fc62326a893653ec5acc7ae8f37490c40e27f03b736ad3903bddf749140d4bcbfccdf23a5104de4f3af94e74d389a025a61d920eeb05cc7c350d711f939ffb6733afc3775fa54b21bfeb865d2018320a843089c180ecf4da9bcf3af7698a88a54ab273d35b11df1058eb73b55c35e85007ac90e263b2ecce1a69ca3294d946d520346c6f9cfe4cb340ec7d63e244d30743c03bf04f1", 0xda, 0x7ff}], 0xc050, &(0x7f00000001c0)=ANY=[@ANYBLOB="73686f72746e616d653d6c6f7765722c6e6e6f6e75807461696c3d312c636f6e746578743d757365725f752c61707072616973652c00"])
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r3, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r3, r1, 0x0, 0xfffffdef)

00:24:52 executing program 1:
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}}, 0x0, 0x6, 0xffffffffffffffff, 0xb)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
r1 = gettid()
rt_sigqueueinfo(0x0, 0x0, 0x0)
r2 = pidfd_getfd(0xffffffffffffffff, r0, 0x0)
perf_event_open(&(0x7f0000000040)={0x5, 0x80, 0x40, 0x71, 0x2, 0x0, 0x0, 0x8000, 0x20, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, @perf_config_ext={0xff}, 0x0, 0x9b5, 0xfa, 0xd, 0x0, 0x8000, 0x55, 0x0, 0x0, 0x0, 0x3ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000400)={0x2, 0x80, 0x2a, 0x81, 0xe0, 0x40, 0x0, 0x63c5ef1c, 0x80, 0x3, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x7, 0x2, @perf_config_ext={0xf2, 0x6}, 0x0, 0x5, 0xfffffff8, 0x0, 0x1, 0x0, 0x1b6, 0x0, 0x6}, 0x0, 0xd, 0xffffffffffffffff, 0x0)
rt_sigqueueinfo(0x0, 0x0, &(0x7f0000000000))
setsockopt$sock_timeval(r0, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10)
bind$packet(r2, &(0x7f00000000c0)={0x11, 0xfe, 0x0, 0x1, 0xfb, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}}, 0x14)
perf_event_open(&(0x7f0000000100)={0x0, 0x80, 0xff, 0x8, 0x4, 0x1, 0x0, 0x4, 0x684, 0x4, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0xdbc, 0x0, @perf_config_ext={0xd03, 0x80000000}, 0x800, 0x3, 0x3, 0x5, 0x300000000000000, 0x7, 0x7ff, 0x0, 0x0, 0x0, 0x5}, r1, 0x10, 0xffffffffffffffff, 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r3, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
openat(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x400040, 0x80)
rt_sigqueueinfo(0x0, 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f0000000240)={'ip6_vti0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x4, 0x0, 0x7f, 0x40, 0xb, @local, @mcast1, 0x88, 0x20, 0x8, 0x2}})

[ 3182.081178] loop4: detected capacity change from 0 to 40
[ 3182.128766] loop3: detected capacity change from 0 to 40
[ 3182.132588] loop2: detected capacity change from 0 to 40
[ 3182.135693] loop6: detected capacity change from 0 to 40
[ 3182.145419] loop5: detected capacity change from 0 to 40
[ 3182.182086] FAT-fs (loop2): bogus number of reserved sectors
[ 3182.182877] FAT-fs (loop2): Can't find a valid FAT filesystem
[ 3182.231872] syz-executor.4: attempt to access beyond end of device
[ 3182.231872] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 3182.233669] Buffer I/O error on dev loop4, logical block 10, lost async page write
[ 3182.290936] syz-executor.4: attempt to access beyond end of device
[ 3182.290936] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 3182.292540] Buffer I/O error on dev loop4, logical block 10, lost async page write
[ 3182.332613] syz-executor.5: attempt to access beyond end of device
[ 3182.332613] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 3182.334365] Buffer I/O error on dev loop5, logical block 10, lost async page write
00:24:53 executing program 3:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r0, &(0x7f0000000140)=[{}], 0x1, 0x0, 0x0)

00:24:53 executing program 2:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440", 0x12}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
creat(&(0x7f0000000000)='./file1\x00', 0x100)

00:24:53 executing program 0:
perf_event_open(&(0x7f0000000080)={0x0, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r1, &(0x7f0000000100), 0x0, 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r0, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r2, 0x2000000, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0x0, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r1, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:24:53 executing program 1:
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}}, 0x0, 0x6, 0xffffffffffffffff, 0xb)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
r1 = gettid()
rt_sigqueueinfo(0x0, 0x0, 0x0)
r2 = pidfd_getfd(0xffffffffffffffff, r0, 0x0)
perf_event_open(&(0x7f0000000040)={0x5, 0x80, 0x40, 0x71, 0x2, 0x0, 0x0, 0x8000, 0x20, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, @perf_config_ext={0xff}, 0x0, 0x9b5, 0xfa, 0xd, 0x0, 0x8000, 0x55, 0x0, 0x0, 0x0, 0x3ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000400)={0x2, 0x80, 0x2a, 0x81, 0xe0, 0x40, 0x0, 0x63c5ef1c, 0x80, 0x3, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x7, 0x2, @perf_config_ext={0xf2, 0x6}, 0x0, 0x5, 0xfffffff8, 0x0, 0x1, 0x0, 0x1b6, 0x0, 0x6}, 0x0, 0xd, 0xffffffffffffffff, 0x0)
rt_sigqueueinfo(0x0, 0x0, &(0x7f0000000000))
setsockopt$sock_timeval(r0, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10)
bind$packet(r2, &(0x7f00000000c0)={0x11, 0xfe, 0x0, 0x1, 0xfb, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}}, 0x14)
perf_event_open(&(0x7f0000000100)={0x0, 0x80, 0xff, 0x8, 0x4, 0x1, 0x0, 0x4, 0x684, 0x4, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0xdbc, 0x0, @perf_config_ext={0xd03, 0x80000000}, 0x800, 0x3, 0x3, 0x5, 0x300000000000000, 0x7, 0x7ff, 0x0, 0x0, 0x0, 0x5}, r1, 0x10, 0xffffffffffffffff, 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r3, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
openat(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x400040, 0x80)
rt_sigqueueinfo(0x0, 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f0000000240)={'ip6_vti0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x4, 0x0, 0x7f, 0x40, 0xb, @local, @mcast1, 0x88, 0x20, 0x8, 0x2}})

[ 3182.535271] loop2: detected capacity change from 0 to 40
[ 3182.551792] FAT-fs (loop2): invalid media value (0x00)
[ 3182.552580] FAT-fs (loop2): Can't find a valid FAT filesystem
[ 3182.556238] loop3: detected capacity change from 0 to 40
00:24:53 executing program 6:
r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
openat(r0, &(0x7f00000000c0)='./file1\x00', 0x602c00, 0xa5)
chdir(&(0x7f0000000140)='./file1\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r3, 0xc0189372, &(0x7f0000000180)={{0x1, 0x1, 0x18, <r4=>r2, {0xc99a}}, './file1\x00'})
socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={<r5=>0xffffffffffffffff})
ioctl$FIDEDUPERANGE(r4, 0xc0189436, &(0x7f0000000240)={0x4, 0x401, 0x1, 0x0, 0x0, [{{r5}, 0x3}]})
write$binfmt_aout(r3, &(0x7f0000001180)=ANY=[], 0x220)
openat(r0, &(0x7f0000000040)='./file1\x00', 0x101000, 0x183)
sendfile(r3, r1, 0x0, 0xfffffdef)

[ 3182.636399] loop6: detected capacity change from 0 to 40
00:24:53 executing program 4:
r0 = syz_open_dev$tty1(0xc, 0x4, 0x1)
writev(r0, &(0x7f0000000000)=[{&(0x7f0000000140)="02b2dccad213e1e6cf54b7a797f8f22a47f25b7658fb110b2e76f95b0f318b8fa745e6ffba4414d29a42bfab524bc5bffb17decc4540a6f00b9772f5f9789a9525790df8d989b23530d0a1398f2ad734c7ff47961be476ffeec81efa3d3aa64b8ea329261dfc2e1047a68670f0e5950d6a5414956bddd09e101b5b66e5742fe843413e065e3b86a242b37bc58c68153a45015f6f1ea67762c302e461e0c84bbb7f8d464f5a72d9fad56dac0c5028a4012a93dbc7da640786e3c9898cdd8fe091b166bfcd66e6257abc923ceaf90e994deded3fe8a59c2105f5caf366d32170ef51299dbf441bc3cddda352a2e07375fb44e75fed8082f3e960015d9bcddb0c834feda68d113a9a9fc0d1c30153685caf43b176219b666d74e67b6192cfd8a561c6c4aadcc80ed8c469bc41b028f1db515d699e45ad3379f9b1edb8de4bb2f8615d6716297baac7e45073fcecf31e51ec78c40edd78f245bced04414f849fb961fbbe79ff2ed7c48ec1b5331f9755d7094986fc8da198ce4a12f9ddfb43e565bc4fed618da9a693d03c3e7ec4b3014dfc022103e277c1b12efb03ef8b197f3a931f6cbe238cf8a4e7639b409b4586f66da41b94eed69d52ba9fde5aa1ee774d4e626932dc3511b10ae3bc3e8688a7a83b0467dfbf92951747396735c9f47ad4552e7bdf4f8e7998a1266a360beb2ec1527390452139f9ab91ee250efcf3413e72a6b2688d8b6a4748ccc165bbf886573ccdd03bd93f32a866cd878ec246e06f31d4d7f7ec9836b7305ee0c1b9fa75cd6e4ca5cc2f107b654f15a2442cd9c8eaf581d093639fe35e0da49394c5ed66ad29bc2b863649e16c1951d0d3dd6f1048539e558ee1f059d91510a5acd84777ca01545635d2fb40e2f205bb11435023e47e4e2f85b6d1b56b688dd1a4304708a561d32dbaa6cd4f969e67af33773d4e9772751019dc6c2af7e2fe9d3c7eb6f1b401926603d90802f792b081957dd5ebd18410cd42b2ea05ae9a61254e4b878384b8a376fe9eba06afc1253f2224fab88feb7c426e3dfb19385afbb42cc13209b419568eeafdf505dc5ca30acc17d337e941e0badf9f9413f381fe9a315e2597426805827943f193f02a12554d434bd91708a28d9da1bf64ad64f80a7287d1e02d5d1f14bf9d89ba3badfa524694db6a651e97ea64104ad34942f36745259f4ec32fdce0bd13e693ccbe0e012e61a1fae9fc1662b99871e3812cea14d12646ccc08b0514762a475ecdbf9071377bb1ecd891c6fe32fde1d3044caf466b3a342b7541e8ed7432e94baf1d5546aff0e23f6a03c9ea5635519533e712639c27958e3a0f3684ed91cfb2e6e4", 0x3b8}], 0x1)
ioctl$KDSKBMETA(r0, 0x4b63, &(0x7f0000000180)=0x4)
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file2\x00', 0x50040, 0x20)
syz_mount_image$tmpfs(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
ioctl$EXT4_IOC_SWAP_BOOT(r2, 0x6611)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r3, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
mount_setattr(r2, &(0x7f0000000040)='./file0\x00', 0x1000, &(0x7f00000000c0)={0x4, 0x70, 0x20000, {r3}}, 0x20)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r5 = perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000500)=ANY=[@ANYBLOB="010000000100000018000000", @ANYRES32=<r6=>r5, @ANYBLOB="00000000000000002ed9aeaff9b7f1164083cb1f9bed3f8f5e3000000000c100"])
ioctl$AUTOFS_DEV_IOCTL_READY(r6, 0xc0189376, &(0x7f0000000040)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x4f95}}, './file0\x00'})
syz_io_uring_submit(0x0, 0x0, &(0x7f0000000600)=@IORING_OP_CLOSE={0x13, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x4)
write$binfmt_aout(r4, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r4, r1, 0x0, 0xfffffdef)

00:24:53 executing program 5:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000040)="60010004e80300000000000000a85b70fdbef0dc3070498d58c87b8a98ac6be0345e6c5f230000000004000001d5ef84786589873e050000000000f70000", 0x3e}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
ioctl$EXT4_IOC_SWAP_BOOT(r0, 0x6611)
connect$unix(r0, &(0x7f0000002a00)=@abs={0x1, 0x0, 0x4e22}, 0x6e)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x141042, 0x0)
r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r3, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r2, r1, 0x0, 0xfffffdef)
stat(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, <r4=>0x0})
lsetxattr(&(0x7f0000002940)='./file1\x00', &(0x7f0000002980)=@known='trusted.overlay.nlink\x00', &(0x7f00000029c0)='{%.${\x00', 0x6, 0x2)
setresuid(0x0, r4, 0x0)
syz_mount_image$tmpfs(&(0x7f00000001c0), &(0x7f0000000240)='./file0\x00', 0x3, 0x9, &(0x7f0000002740)=[{&(0x7f0000000280)="e56414afb03f425fb179e2f5910127b22094b4d41fc08eadf8e7e4e07d7a6f60363af8784e0c8059d04af201dd512c254f1864c277cfe0ac572e73fd35273a89f4a9425ed1d654bc69fb0d730c7f5e7a04f10236e918080904af4d79aba69e923147f42260a927facbe7469988d4bc22d6b9aa4f977929098574f54461c6858d56baffaa5ebfccf12bc2f81f4f569c6a6c66eadd958389ce90dec7d727767fa32741eddcb33b33392e6de2e44600bb74b8031f0bb44f2c1fb1998aecf50f2995a6a646c04698bf297b2dd14f803c750c448471bdafac606d8839eb5f3643c78aa44a99cf86", 0xe5, 0x6}, {&(0x7f0000000380)="bbf86a66524dda79e20468b211d0d8f369ee3e80785fe6b6b5b490d358bd9a03a22455292c483fc5dfca7fbb0bba4f060424203eba622bfd4359bca6ffcf86393de9b81098555dc68ecaf197ba83adeae8bdab5aaadea829920ce027cc2475f530e9544f984fc1bf4cf3a5d59e2decb8adc99305707f8c582a68b3d081d04a70a690a50279f9e42aa9aa54256d3362d7bd36366b5bcf04f1cc1a57e846d9e957ed4056649ba39c1f80848f2985d190a07bbf5448d54d9a484a9fe3add91e2ae2f08b67caa04ebdd9e6b760c548f6f761ea20375c35b2c03fb54b7d5df0d2de42ef23e01595ffeb1bafca1025b2026bd64761f0b6f527a9dd56fda449e12ce2a9aff673691c891995894555f4c6acb6c2ab08d8f5fe985ddb25738e93e38eed095018c6be682a5c03a467a3e94465218814852b853eaab7a8de07c340078e11f9e2f90a337cb9ae2b7a5cc2f496a8612a8dbefa03489c11b8ae73c3c4d43fcc44d8567a93c864981e0ee306066abef3bc2312cf3ab4adfe72ff8e52574e80237eb9d57bb49a2453ac18b815acb766b1c7ea16f0db3c727133362903256f5f354029e95b8684c0917cc0adc7ae17b9d61f7e28c94a0edd026ef6d440f82593459c20da3a583ad884846152a8e75d2697d6888f1d981195701d820db12bac8f8f7f35a7420d15e00157b8df5402d1e517400874b036d095a94ada7bbc3ce7ab22bb2de3cb5c1cdf053f60e0cb3528a90409202e9a9aaa0a65cdd1bc7e8362a990fdc3667c91f81ea3112b5293402d6e7ae21879ad6c65aeeaa29b64901e1715b5a1c58992700ab06866553f744b7af2ee473daa84af7e1688359092f2fe61ccfa1d22f7254d512215f4bc1626d494ad32353317d6f2f3ae1a4dd39eb75ec404c295e0793bfc82f373dd3d7f4a5d119e8627a2da133516c6229705d55f147c3d9fefb0a22688309939fffe28c0bea81d491efed44406652ce92488a0d593d38caf0709d2776199d09d4e619baadf26114bf366b3e0aad7c730afec142229b7a7973e662e919791f6bf19c8d7331e5f0f664db66c129edd1ad1cd720fc79adbbb3c04805fd94cda6db429ce6aa4410e774b9d7b812ca1aab7284fde448da553538cf49587f93ae967e34b843181c77a590a7b1efac2b243b85d595da8af83120cb16a06f88f436c50ca996dac89432183ebfc03b6408798b48dbf63f98856785c9b9d3eb013a13898ac117ae687b9aa188fa625faed23e5affe3b674baa0a6382b6834df9d63f1d4fb2beb47788fbc4e58dd61a0cff7aa6399b52e501bf51ec22976921ad0d90eec5f29cf4c8c9f6bcdd672dadaba66f254251e773c1ec94fd7461227478680c6afd4bf8088ea73f52c648d219d80d2b0f98439cddb3f3f960498f05c8e1677bcf2b73496801c0da8f696e81545609cd0a0229f543cbfca27d95508f3611f2975e6e96927b39bede54b2dbbb2c49a9e72adcdbaafe0e63cad453146c77b5d966792e3b89a1862beacceb291483b21f0bd05a856659355d2e560ad940226108d89244101638b2ab8169294cbadeb72f60d8169aa51529e871ee433e19e0ce125c679df3eea02f2eb1007c66bcccd84bbdab9e657dcef96ae9633a16520da18ce54289c0298efb8cd779de65cffdfb663bed07f24d2245969f1079875360ad7c092a0f9ff091594c3943da6ad413a55c8ca677fa822ee7c62bc3b7fa8a24d2f9f8913a360efe9a96814230aa95394b6b5bba844a1f96c0ed6b44145b284c55d48f1f8276801c27110497e77131dfdc167e41f1c3791ec7163c172f581f247bdf3a674302271d038aa5bfc7b34e647a1758c348931f3250cd926b03bae58ea4ab43b8c72b3c46a9ee89db20467a205760b12eaadd279ec4b0e39263298f43154ab1018f744d3d8c53bd3ebd578fac35ffe5f264128326004c863da62ecc19b8030acd8c40690fba6bf6e93ae0b99a0c70bd1390ecd1332dd482048c71fb43c51334258ee9eaae4fc0e4436db6344dd053cf9ea0e21ed23d7e9ee42a486bc78c3ed38cb8a15ffaac88b722fc768a09a03414bdb8ce03ea1ab0c596df78a9852747952452897469b6a07143525d1f8511f6dea78f769d5aa8a4fa03f9b3f88f0f8a89ab6c43ff961fbcb151d2eb76354bcf7bc9bad45b82db79fe272e5092deed6c0543338db741e8bdd21a7f5c05cbcbea047cb92a75e90a98881a21e928c7cc8782550f409cadda901f58b3d6d3be9bcfbbdbfb6308ef39a24ed26a260f5c87d32fdda2f345295e9e3f4c01e57ee64de354b42b85b7193a2ed1528e4d8da19fcc5e5489f68dbce5dea13919615a16c2a02de7a8373e777384404afda6586e7473eaec4f198e585e18a16d2da1f5ae63d0e38eaaf542200b7e17ee1caed89556a8e613aeb61ad07dbfe8c730e42722f7ed17e9275db789e21d77fa611556591cfd9cb1b1a76e3319cbb042fc9c4481d0e5f2338acf576ed3a003ac59a56ac111f7396867b90498e6801ed868c8b0f3f54b78909dba66442cbecd2bd8254b23b154fa8a68ab65b4cf14bdd9920364383b7a127d3eb6bc9e0713808a140a81d8c4c37c3fb2c8280f808bdab8c4b6237333284206a02ed75c9b45d434b4dc2228922aef3d517b8030013e3935439c06ec73061421a11b120d3f9bb66fa4200af9c5874a97b653a3baa3dfee9806ddb108b9f790a6e8a829de8a7749a5f3fef0ffc20558f512e57ee766fc60619178c6b0ce26a294c976b8520842aa0497bde40af914d27302f832cf74c8bdd545ac5a0d943b9b4a2631dd1a1d04fd8ff5fdfedf2601baa329906d71f4d906b1db1ab063c9d9112c9e83da9c079bd03cb3f8df0995040a801c757da72fb8e371628df33a15e095d94a868c421785644921d3903d32c9d83031fcb512cde3e1c9a2622fec58c612b3586c95806594ab9d513b888c7fd09f6506b31f733f7956d3e8348f93cea36a0cb55023d1b47b8ed36cbc4532febcd3af49a0c5f6184c96a71f2b116df80ef3a912acfe5ba9ff666886d67bf358794a47ae585cfaca11b536ccaaecd5e4c90404c22c3dad522bf90f822fa47e903b4c9fe68456036ea9d0fd7cc7bc8bcf7de153591bd5b88ab4cfcb87a1d44e83fe0344880f9f17f1488eabea15a331ed4dc8fdf8ba116cfe451b4b22d34dfadaf2902441b4eec2f9be3e16f15013c08054e963db6808e0f634240458348924d7b4c560462ddb39b4a909fedda9a742da7893b5755f95892547a6001f3a2249e3fbf4439065560a02004c952e48f6872a49b3ff8ee885972f44de42dff9bc4be9f477c35ac79faf4b15d6a83995bd5871710429345d21f3134325af7953f5a08a070bd2c6bae90a52d253f79c1db03b7e764c716ab0e4f1b4e5786fcd6a4fc3c2f2985c557861cd7066d8f86ceb0fb76e6bf688fe6bf7640d4b9cca404e83b0986008b7ccea3bbe392de4bec6a5a3d7a6d241edcebde1f14943dd85d99eef4fb6beba32cfd94bd6f6c4ea12678d8d4755971fa45f9a1cdeb2a7b733ccf40f68b938e57f509b74b54cecde2228d4dc07f16a9978cc6a92783a43643214e14fd5c6d84afb4859506edd5695b57c1ee4584a7a488fd6fe80e37b5faea0bbc1b4a057adeb96ada82f0952e21cecad7a48b7847e461b756d80730fff8f42922c281d89e5eddd90fb5a7a7136f6ba5d905d8525fa2116473563a74a1c518aa0189f525d7bf2219eb20450abf7b4873d6c8e0a8120e1565852fd018fb71b74ca2c5be20556a77e6d1fc2b2d596af1ad1fc56a889d4a5f1c9ebf8c6611b032a34f4778e870dd0fc3c1dde36dd641f84ffd0e15154036dbe08efbcf039c801517a0cd8a1947a828b8d93b4fa3ddfeafdb0eb0ce75daa67cddecd34f4d65d2c70e9e281e5c09fdfcefdbb94e7f068dd84deb9caf432be3ca7ab8e49c7e145fc6151cd526c423e0a80fd226d00220a40e0f9d16c1e53a72ca3161e11db22ac211d56516d68574ebed09e7615712b0a0b98b65ef3a1ee20aae450be152d4f6d2e3fbffb7423aa15a387cf643079324d158193a6eca8727248c84598dc51af953a4eeee6b53539ea5a6744226f1850541a2f34485b7acaf1306880333b2a9752f8d4c25fb57106756471bcae5dff02dc4c49bdc1b4862bb8563567f3b7f2f7b4d88f138e47409d019800b9689a44db38c33dc0f14de8008b37045a5d11f279021498d7f4706c5960d53379f2fa0ec38cbf9d6f2b475717e0ebec3b728468e0b64fb76700aecedaf607bd45409aa55baf55995bf899f050b728dd3af420a2338d321ed2616963553b750992e74c83f4c603c207f4a5f93f842bd83ede14b643008f1a7fe82023dc0edafb7c61f4089f0dbf89abe399c20076f31e6abb55c719e33dd88dc6c7acdad39ffb7fc57461192d8f57139c02658d438d6ff262dc6abd967f2962e27cb381bc6e91229607b9a8454bb66dd33fffaf827a3165c406ea77fef5d5f1e8e8b227b687dd11b03d8d0db43ea54e0a173af04d91d9df3c226cfe921edf76e5df3d6b1995e631c26d2828ee6e351f70136d3abe18df361c10e5602dc364556043ab64f3acd5b65eaebcea2e89510466fff28d3bb62e8677f489c5df018ac9ca0d4dadbe5f590bfe245aff8fd021b4bea837a37fe8d0a83e06fcc05ed9898dd38721fd20b364fb182bfd06521131eeb3b3be66c2fa7ef94fd8854bf5177ecee0953974c110b96bf2d952962efd40058bd07ecd44dbb9c9b056cb65cc7da86c2dc95a62e045f0d9ffa34630f7671c9157bafa6a177b4b89c98c55a7168fe125660944a497c38b926063ff74fe7678fbcf01cf5bad5f85af33712a65c962a108db3b964e6d5319a87a3632f58397ab34e48ad6d2d29ad89c26dd8cfb3cf3fea1c22ec14f93d5603d0fb654b91413b285638e51b0b4e1db7f0d131cbe623d5c1cd4a54d5895255c02a53460397a5cf7acb1da0d9c945b2d09f289460ee2024cb1b9d70668f1ad73dde376f6651229bf4c7d50390503f3c74dc2f01c0ed71fe3affcfe46393c7fa1394382e235849c997bdbbb87ad34250ec20d0ba5001beae9265f200d1e3cf57371f35d9b120a9387a91637ad1960ad4b2bf05bb908e5e56540b35aaa75d40221f96355b17abb65d9a1061d19118abd7fe5faa1d6d36315397dfbba0f35e0200e32d64c811baad896d5ca5f48c9cf700169a617a6000418f6611bf2dedd35a8dbe7a43b103725530e85a19e3b0d418bbed4fd424f15325b2472fc9164aa72ce199d1088f7ba8b93079aa328bb04dd03c7c31a7973eb393e759502160f0e1f46037186c6bb610919ab2f5cd454d0d2c68a200890ac5f2e4f4edf956402c324726cde478096fb4d885157c8f4c854f9cb8cafff4f758884f19fa52bbbbc529aea2589bbeb180a7c0d3f54c2693904511cb6be4928e20ff9e9f2f9be86207a5a0adc6c70c9f5d38a6dee4f2652ad48d46a7beb657c237a14955c51b763e56b79b9b94a504a5a48d8069a23e9ebfe295ea4ab5f006016105345f3ad28281a3ac5efb99711f7a828e59404ed30b920d2305f1a5d0a5b97773329a7766b03d40ad988dbf443f9aed5fe441e81319ac023b8ee728c3d6fa1ddb5cebf3b4efb001b523265bd784372467d4fec7b2cf6fc7c26bd58e32a662f0d496cb86da4e8cc53c8689628261aee7262b1394596d171bd6ea4f537e3b02c85c4ab21866bf223c223ec6e05563a852ff6da84326a6b37d55dfc0f93bbd37bd2ee4b2913858a435b295a099c665308899c367702337d6c70347569329dd7a97b47d92a14fa10", 0x1000, 0xffffffffffff8001}, {&(0x7f0000001380)="6cf195a3d4cb22b4d68814cef6b7d8d8d6d61fa8272dba9ef548475e615ce235a4d3e1daa2f168e95f40067b3a6c593268bcb596222f243aa9ffddeee1e2969bacedc0ce69b0d54f60d3b1c6a3b6f7c412cebb640d3ed75dc8a3d00d", 0x5c, 0x101}, {&(0x7f0000001400)="191d34b824b4cc4ffc0194bb6385d2dcdc0f9525d9e7d5e2efe95c428f6fc559680d8ad9d1175f5f4e17d55cb6cce7353c2cdd9d34ef2e2fab81dae6df4282cdedb19cc3cad23d3fcd1af28a5813543874afa766498b9a73f4e751d9d231c224a600644ee2c16c47a650b88b1b4c80c4ce16a9a37799201cb28d0666f6e6cd3c418f215ff11d2416da3f42c711cb7918438c8cb637e7eff95839b394f20886e94ee19494b4cd27eb9f0991acba", 0xad}, {&(0x7f00000014c0)="43665b4e8cb22661272de79cef81b36a82f747aed7e5662743780d965e4403d385c9c2665377d6", 0x27, 0x1}, {&(0x7f0000001500)="75575fbe2717c3f28f849ee77e55892a30593c402290998a8131011ee2b6bb86acc8438f368ade218237660b8a22938596ed716f0417aa45d99a55876ebddb056d3ad039e736f9ff3da1353c97ee74a3d27a936929570876fc6a61a4fda1560f5c3cb792fa8ac722b4038d56ae86a1f78a259fbe1536eda21837a8da44eef8986895d8d6c80914d19d1f980e7fbe24c25296b4a039afbaeccd0778967977c04b3c66fb5bc4864cc0d7731f638ab508945789f519433e044ca1f30057624b8a00fa30ac6fcaa025defe5fb67973790c11058003b9246270cf006b31ed3b973eaced4337d7222eca5fa1718b3bb272e04baa0e731e5d9ab760819d9e45ac8a02cf78793cb7679a10cfbfaf6abc0b89c1295d2275bbb1d17a205e801a42bc4a783e01b96d0b36d96972615850aa450f70597cf40fa2f0926d14c5551941ad7c8b7ce4d6f4eca97170dcad9650eba99ee215af6d18bf1acacc94ac2b6104a547c3c303a52b590ddf4ecd89ca26c5b13b78b3d7000dc54ea1f76a2c6ed64c04c7a3d5b0afd96b0e1137815d7cbc7ab620fe8dbd417daeb9b8f371132c8f5e67e8cbaf9c24ae130087c68f4984d35fccb6a49ee871562a8a6f0826a6b7b5a2317766a458225c32591059f7d6f907558fd7fa326644bc46e2be8877b7d190799d1a797060e7416f01cab2285a1bb8b2b10aade84f65dd57f3d5bcd1c597575877f30101aa9c2b973437d9f9289369185eef168f86b0602cb0c0d3c364b2b7f0a55a6b55be11f09ca650db0bcd1952454a93dabf654420c85ac28c8fd388853846359024c4feec5651c777d43b08ce26d70cc08e4f69a0b653fde8461b55a7c9eb05d1586c0f2b3fd7debc5c194b13e0592e72f41d40e64eeaa66ad0fe8be9087b6cc2247b1b8f434f2dc279a1937a616e974c39c3211ede82b856111cb2032b3891266bc88e7b65e4b2b731124968264cdc8b9e292f8dd76b08fec3faaa29d10122c500da9f0451b45291bc2a340d6428d26ff0caf8e1716846b2722f7fd34b43886f62c83e1a8550f68f259750df1037c2ddcb0714887a1fbbb78030d2b231297255ea4e4bc0a1de3f959344e5fbe20e8088588b9fb56ed639837bec28eacb63e9f010bf331f2accd69ed2231a2b2b6ab16b70d6c1cb15fe1720db76fe068ddc883fc7029d1b42f725222d005fc438aa27813b32371d49f10828f871da4e7ab1dadc39078c21085064cca7f68511b253ac2f2f7be2cadd1051fe1bdd338dcf2ad16c73ad8a4c1c285318cb284f352f18ecc63f188bbe80d5bc4187cfbbd428ddf9133110b80ec74ff39404a76d9eadc91aa7d6d9e04d9530b147645d744d0d6e109f8e4355899ab7bad6888d2070db0d79d69c01e86552f2acbcbe2b0181122bcba81f9fa364ef83a0c810eeebfa8a6c42162ca445ecd43d4367a35126af47f8037279f0b6288802e64b010503327ee8ce103d5ba5764b10e6663c4afa872c5a7424e17be7d20e7f2f315a74f37e79a25e1b57557b7902e9544d56a3b393c946e322cb581731cce0b1407af72fb0b8978a708f2cdff40f17b3f6e7c558b83b2bab282bd75dcf5181cb01508bdbf2ac6ac76962ea68b8d1c824283059ad76b70dbe02ed416b7f712eeb5ccb342f78d7630490d2b8ce53a7dfb4e2ec53ae887c64a8108a3e04e20f484d907d909de1ac359e87639bb16e62c5383ab0594f3789b39b7314e5041f2473ec0e60af7055a63ce005bccf2aa47340218ad4137729ec48d09e52b8912cb47fb5265e51a662efa977056b40bd82e6a8d9b1e5c3f217331b93addeba1fabd187f4757aecb94dfb2383a19ca97d8e939100a945ab2ed533a1aecfebdd5ff62a9da2a39071585eafffc964efda5c583b5532a160da483fc20212c0e3966f00caf8787ae5a783c3cb8c23af2ae0e09250879731704da960da2bec74bfdaed81d24ead463bcdc03bc6bbb404b4cb8dcca58b0546ee7975a655965bd829950a9285a767f74b4b85d9e069782fd8af0c817d894ec7d3ca3abc5560a2cc936fd4104acc01e2e34b17e632a4e5e443c25b4ed41770450257de18928611d78fefbcb9bfc692e030366b018b36e2caeef7b0e230767207eb943c408078a954b3471b46ccc659ecb32449a641d80e0fb6de76110171c13df61926cf40e8bda815234f85d1da3dde585361a0e04ec36986be08b5db83ce59d2ef39c7bb0cc312e5f23218454d678837661c09e2ac774bd0d442b1e8d75a61cf91f26a897ba7e804933e4cdcdb1e42904cd4d2ac04183f652983443d0e601bcb0c56cbbccffe9d9fe108689436d39937747f2749a83b2acf64503892b9b4ea913554ed953ae0967f9b9e9c4cd4bc60bbe2f7ef49b3b2b22da40f0c7bdaf5bd9bfede4e1fc48c4487f0e0d9612ec9c8be027af254dfd131f97364e328fec2e9a73c035312decd11bba191add0a018c1d1dd498b835af074c2f7a88e81e4eec239deac230e4a39cf0b597622101bd23e3b1a0d14a384097b0c819ac22581a9454061acc60beae9994ebbc085594f023ecd94fbd204de702043c792b14b0914ed38a88aeb537bc1d84f8bdd2d29c8912f084244e0039c1180e10f96a55967d83c9cae8f0851b24aca036100f7319efdb9b275f4e11401801229c21525f4b68d0405826307ee3fb1f6f984d555cb3283da08855952ef40709a461d6f9cf995e018446649b3c9f77727082f5b7bd6355c455be99404ec5e9fcf70dbf4d9f27f761d3a0422b9f15b7495499da5da05f454db651ec2aada4374b62567823060f9603a156763551d4153900ce6f43631d645feb66877c90fc7e381dd496e3738d6e7063b47849f22de331909cc8a2e36e8db390dbfb78d8d8779117f18dbf3ab5ee2a60876d7627446519cebe192e58f27648c905848df6af1ce2c5ca90a959cca950596acac8e5916b6001000805277dde94423a4a916223546afcf006d0da39bd07cc34583c458acf0c4c7fd56636cb2548c60e654d1e060c201a879730269f2dbf3d3d94534cad1a996367847e6ff3194e65767224455b1a938b4023ab0d8998b56ca414c155eb352568c7835b5e9611e177f616f2c60414248fb4be0445230962bd74d541e7f9347a362af27d0b510c206690fd6cebd0a9bd9bfcde1e3e8651020e7bbea7f79d9e014982dd01767339298af958facfd596b23f55d1e87efe6c0d6340b550d04ef5d621c7be5ba0bf536a2e93237cd53d49161be19d906092ca67638ec0dd75219cc01025ff13c227527a1a883692b4245774a104fc4bae352100cc994ac5abd37028aceed57db35b58c66e2e0382fe8498a78f7b88e0136669f2323d0c7b8605b05520945227d2976da0b97d15926496228fd4662c07be415f794ee0cac60bbcafa10bd69fecd516c31a887ceab49123af2ed5dc82a92f0141ecc8ee25276bf168af9c4922f637969c994980e2250b170333466231e8f1cc29dbbc50e69c1dfab0b45aafb4212e250ea48a1cb2f681f00a6706578d41c864215c788cd16c50e6f00945e9422ad166c4018a5400edabfea73263207c9caad474cd7fef84858a47581745250d8f4bc4c2b1bc0c80f426ca3bfce3e1155d739821271a60bec2929c86adbfe64f3defb5d070b95fb96e81ac7d0f1698490523583b03c080cd8876c96d684300586f6902850c774415dbb21a1b9e0d33c248fb11cbcc7ae667f5a0e1c63944582e7c4ea12a0ade2db5e5540d96d846ae439cddc0c1ce2826e33cd6c9afe13ded8484fa348a288ed36eb17518af757bac8ff9b98e671c755345d0460c93a02edde1aa16fda59427137f874ab06c559f932a0d2ff49e58dd91bd37afca135fb31bc868a41714ffda11adf4a22a2acb4bf1efeac05bd44bd21e6fffa3ac997dce9ad5fd44d1a286c2fab116c76b8a8b5979845fa47a2c20a5af2566c8d1140009f67bdb32bcb5ecb386e25a899e7be7dbf33942b255277036914e78fd5b347227d66e10ae8fb887c807dd9aa33c5a129a8e047dc440b7eeec7807a0fc1fbdb681f399cf786c71b5fd297b9d6e0d8b9cbe14f8c76dd51ff84d2ca4e62ab7e04d65bb9f73085e8bfa5fae534d32ea07d22ad1f88f0f09189d99af0b2b16e0dda6fe35c205b4303adc566eb9a7613e4e50e63a3922ba1b4546b1c9990a94f5414c54411a33451254d54a88e64454eea4232bb7be051080ffe7c1339f058d0b158cf9e1bb0c948d9557d5e32421cdc259f7b5ef1386b9f39053d0a4e7a9b141db26a1ebeeb4f183666cc8ccd3012342cb6f5a513404fe96ce7b64e8221d18301b16c47c6fbbe6310365b197c4207ddc146a724bef7da76c98724daa12f0453a42d68790245767b109b19ce997d068f7b24ad9a5282674cfdc311499742e81a335900beca8d5e488524242fd55a3afa35220d70e904493fd39e19581bf05d4b624d0c1cb94448c2096dbf4de10cba056a4d42e7b09030b2985966b1e70e5e9b997b7c86a1fe844ef79d1fd430d9cd783fff43f374af56dff340b6d13e72070ce9681613e9992354f17bc9ac7a55b24a0834e80169a155510decfbbb27e87262b27e87b5a240ca64a8bde157718e31323d35c3b3d7e98cd565bcd7eb9200afb7db397d53a641dbb442c1f373f566cb250b746d331d5a84368afebb00e9d290db6f2fa4d3c0b5b02a42af58ee47f7cdd7495aab9fe799fa07499d0f77ecf73fa912bc7863aa48384bc5c6283fbaeb52a60059ec8777af4a34bfcdbdffce93b8d027580e5bf927d082756af3bc5b04b9a0c2e8f19803c4d4000b907f168542e84c3a36c1752d9d2f159e9ed7877dc389440adf0c3fb0e46a9b3a0cd7d43470e16e4d8dcba9c8ba792c3b14dae48a9241233dc2235dce7d438fcce6649f4f409ac853a71f7d906b351efb52124d8b1553e0c5b54966a060767453764d93fbdc00314edf8fa1f89a263d10b3e7e0f0fb1712dfd42ca73d92305ced8157d20a22fc3e0dac1920d4332d8f832a22c2860813939cea9c20e6d2e28f09adde8d049fb51f3ad1b97ed751aba983dea649652f207b1da2ea20b311bebf29bfc391df9fc77e3018f8c74fb0e2d45cc6fc42b909d465488d1b6a9c16e8725103d077ba55006f596b77aa73c6c7819a8c5a8a30e0c8e5871cfd219b49103d692bb975de2c87ba522f30b794c228e53766a9fc598d1fa992e25a806c0714f89cc37978b782172e7273580f8527607a3653da70523b005d92fb281e2c300777f04c5e712672ac757d3d80edeb2cc6c8b4f0163afa8a3acfeb61170881daab08bc15aa2d3ee861b52dd1d103aae8227fe113c32f9fb6e26b7e91c64032294dbe977764cfef4e97b08d5c5acda5c2e028f90d5688abd79b3c3d51a08dcf2a1320cf39fc61348d14fdfcb3fe86ba0927d40bd25a59e2b6eabe5422d223202ca3b9967e99ce32d891d2f9a5578d607e76667d0a16352010d204b3f4cbd0b1db86479034b28e4368c0b09ec6e0c2ab77ca2a344476c6dd867b0be4c69e9405f7fc5180558d435dc1bb38142bf0bdd74b7453edc21a006cab04d114fdce17518fc9728347dd96f3983631660a4505c8a552dabfc50233640a2918875efacfbed05b1f48f353a8040a0b27b6a1562245fdb27ce1e309b976e0136f5e6fd684b2bf2dd15933079c7de2d67506add745a6b1ef49a7949d28f1c72d6b943a1182e815835c8bb8e8f8a0812430f8493a8ffbac5688d3715bef613172d473b1b9294be851ad0f5eada5c845a0eee35cce30f904480e73e1878876876ddab246199ee6307e7b4a59665536e2e7389de3c4cb", 0x1000, 0x100000000}, {&(0x7f0000002500)="4aeb70a7254c951f91da64e7d4dd20581d4edfb1cd149f03de6a0a72b3f6389656fc5d9a3ae7c7958d07d3d812d17b6593a6b5dd9d4576e6b0a17f2f269ff2727d3cd9daff4ba3cf950b9d12b054f9a0332a34e90dc41dc8336326397f89979fc8fd7ebf8174e11bb117a3dd903dbc8965798383ff096d968651f6aca27e8389ccef9344b3c3f16b563a1ca89a58e8e6fd9a659f8e266a46daa56538033061299c8c6857602d434cbaaa8c0c200c54ab09f6a0deed4996aa4890bab066293a33a1dfb72b216767bf02", 0xc9, 0x2}, {&(0x7f0000002600)="0da7f012f49ea45612b1069e2598a83003158b50fb65500ba40d05231e0fc571d73d9aab8449c48708b0608e0e88050b184d65ca6424f6f50b06022bd14d4fd861fb79cd01f3f25700bad3713e5c88f8f3598c30515ae3ca16fe39436f142bc5ab54", 0x62, 0x4}, {&(0x7f0000002680)="6212a5326cb4314f51fad8b0c066a28a6937fec9f5d2ca0450357e328cac2245fc88a829e574097238dd29b5dd75f94f7bf45aeb0dccff60789c45a0432059e5dc4be853561a4205715e4a22940e6592d7d14c39e6db44450404be34709a3ce0a927dfc29bc593eaceaf626ea577fa104d28ac159923f95fcef2739d66f5e99f956a520e54715ed4217dfed9bc07660668d8ae030e2d443fc995588143ad64727f042adeeb5962757d055fe978506483e30a3aa6c2158a06791b3827", 0xbc, 0xffffffffffffffff}], 0x1800, &(0x7f0000002840)={[{@mode={'mode', 0x3d, 0xa7d2}}, {@mode={'mode', 0x3d, 0x7}}, {@mode={'mode', 0x3d, 0x89e5}}, {@mpol={'mpol', 0x3d, {'interleave', '=relative'}}}, {@mpol={'mpol', 0x3d, {'local', '=relative'}}}, {@mode={'mode', 0x3d, 0x69}}], [{@fowner_eq={'fowner', 0x3d, r4}}, {@subj_type={'subj_type', 0x3d, '&'}}, {@mask={'mask', 0x3d, '^MAY_EXEC'}}, {@appraise_type}]})
pivot_root(&(0x7f00000000c0)='./file1\x00', &(0x7f0000000180)='./file1\x00')

00:24:53 executing program 2:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440", 0x12}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
creat(&(0x7f0000000000)='./file1\x00', 0x100)

00:24:53 executing program 3:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r0, &(0x7f0000000140)=[{}], 0x1, 0x0, 0x0)

00:24:53 executing program 7:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684fd2981c8409820000080000000000000000"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x100d}], 0x69e, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

[ 3182.742905] loop5: detected capacity change from 0 to 40
[ 3182.783344] FAT-fs (loop5): invalid media value (0x70)
[ 3182.784119] FAT-fs (loop5): Can't find a valid FAT filesystem
[ 3182.793495] loop4: detected capacity change from 0 to 40
[ 3182.822479] FAT-fs (loop4): Unrecognized mount option "�������T�����*G�[vX�.v�[1���E���DҚB��RKſ���E@���r��x��" or missing value
[ 3182.879354] loop2: detected capacity change from 0 to 40
[ 3182.912095] FAT-fs (loop2): invalid media value (0x00)
[ 3182.912851] FAT-fs (loop2): Can't find a valid FAT filesystem
[ 3182.932481] loop3: detected capacity change from 0 to 40
[ 3183.552545] loop4: detected capacity change from 0 to 40
[ 3183.574883] FAT-fs (loop4): Unrecognized mount option "./file0" or missing value
00:25:15 executing program 4:
r0 = perf_event_open(&(0x7f0000000000)={0x0, 0x80, 0x5, 0x9, 0x0, 0x1f, 0x0, 0x6, 0x20406, 0xb, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x4, @perf_config_ext={0x100000001}, 0x9004, 0x8000, 0x4, 0xe, 0x41d, 0x2, 0x3a4, 0x0, 0x9, 0x0, 0x7}, 0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0x0)
signalfd4(r0, &(0x7f00000000c0)={[0x2]}, 0x8, 0xc0800)
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_mount_image$tmpfs(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r2, r1, 0x0, 0xfffffdef)

00:25:15 executing program 6:
r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r4 = perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000500)=ANY=[@ANYBLOB="010000000100000018000000", @ANYRES32=r4, @ANYBLOB="00000000000000002ed9aeaff9b7f1164083cb1f9bed3f8f5e3000000000c100"])
connect$802154_dgram(r2, &(0x7f0000000180)={0x24, @short={0x2, 0x3, 0xaaa0}}, 0x14)
openat(r3, &(0x7f00000000c0)='./file0\x00', 0x50100, 0x11)
poll(&(0x7f0000000040)=[{r0, 0x10}, {r3, 0x280}, {r3, 0x9000}, {r2, 0x100}, {r4}], 0x5, 0xe5a)
write$binfmt_aout(r3, &(0x7f0000000040)=ANY=[], 0x220)
sendfile(r3, r1, 0x0, 0xfffffdef)

00:25:15 executing program 2:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440", 0x12}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
creat(&(0x7f0000000000)='./file1\x00', 0x100)

00:25:15 executing program 0:
perf_event_open(&(0x7f0000000080)={0x0, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r1, &(0x7f0000000100), 0x0, 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r0, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r2, 0x3000000, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0x0, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r1, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

[ 3205.355089] loop2: detected capacity change from 0 to 40
[ 3205.373500] loop3: detected capacity change from 0 to 40
00:25:16 executing program 1:
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}}, 0x0, 0x6, 0xffffffffffffffff, 0xb)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
r1 = gettid()
rt_sigqueueinfo(0x0, 0x0, 0x0)
r2 = pidfd_getfd(0xffffffffffffffff, r0, 0x0)
perf_event_open(&(0x7f0000000040)={0x5, 0x80, 0x40, 0x71, 0x2, 0x0, 0x0, 0x8000, 0x20, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, @perf_config_ext={0xff}, 0x0, 0x9b5, 0xfa, 0xd, 0x0, 0x8000, 0x55, 0x0, 0x0, 0x0, 0x3ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000400)={0x2, 0x80, 0x2a, 0x81, 0xe0, 0x40, 0x0, 0x63c5ef1c, 0x80, 0x3, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x7, 0x2, @perf_config_ext={0xf2, 0x6}, 0x0, 0x5, 0xfffffff8, 0x0, 0x1, 0x0, 0x1b6, 0x0, 0x6}, 0x0, 0xd, 0xffffffffffffffff, 0x0)
rt_sigqueueinfo(0x0, 0x0, &(0x7f0000000000))
setsockopt$sock_timeval(r0, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10)
bind$packet(r2, &(0x7f00000000c0)={0x11, 0xfe, 0x0, 0x1, 0xfb, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}}, 0x14)
perf_event_open(&(0x7f0000000100)={0x0, 0x80, 0xff, 0x8, 0x4, 0x1, 0x0, 0x4, 0x684, 0x4, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0xdbc, 0x0, @perf_config_ext={0xd03, 0x80000000}, 0x800, 0x3, 0x3, 0x5, 0x300000000000000, 0x7, 0x7ff, 0x0, 0x0, 0x0, 0x5}, r1, 0x10, 0xffffffffffffffff, 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r3, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
openat(r3, 0x0, 0x400040, 0x80)
rt_sigqueueinfo(0x0, 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f0000000240)={'ip6_vti0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x4, 0x0, 0x7f, 0x40, 0xb, @local, @mcast1, 0x88, 0x20, 0x8, 0x2}})

00:25:16 executing program 3:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r0, &(0x7f0000000140)=[{}], 0x1, 0x0, 0x0)

00:25:16 executing program 5:
syz_mount_image$vfat(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0xffffffffffffffba}, {0x0, 0x0, 0x101}], 0x4440, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef)

00:25:16 executing program 7:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684fd2981c8409820000080000000000000000"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x100d}], 0x6a7, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

[ 3205.402434] FAT-fs (loop2): invalid media value (0x00)
[ 3205.403249] FAT-fs (loop2): Can't find a valid FAT filesystem
[ 3205.458858] loop6: detected capacity change from 0 to 40
[ 3205.462456] loop4: detected capacity change from 0 to 40
00:25:16 executing program 1:
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}}, 0x0, 0x6, 0xffffffffffffffff, 0xb)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
r1 = gettid()
rt_sigqueueinfo(0x0, 0x0, 0x0)
r2 = pidfd_getfd(0xffffffffffffffff, r0, 0x0)
perf_event_open(&(0x7f0000000040)={0x5, 0x80, 0x40, 0x71, 0x2, 0x0, 0x0, 0x8000, 0x20, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, @perf_config_ext={0xff}, 0x0, 0x9b5, 0xfa, 0xd, 0x0, 0x8000, 0x55, 0x0, 0x0, 0x0, 0x3ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000400)={0x2, 0x80, 0x2a, 0x81, 0xe0, 0x40, 0x0, 0x63c5ef1c, 0x80, 0x3, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x7, 0x2, @perf_config_ext={0xf2, 0x6}, 0x0, 0x5, 0xfffffff8, 0x0, 0x1, 0x0, 0x1b6, 0x0, 0x6}, 0x0, 0xd, 0xffffffffffffffff, 0x0)
rt_sigqueueinfo(0x0, 0x0, &(0x7f0000000000))
setsockopt$sock_timeval(r0, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10)
bind$packet(r2, &(0x7f00000000c0)={0x11, 0xfe, 0x0, 0x1, 0xfb, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}}, 0x14)
perf_event_open(&(0x7f0000000100)={0x0, 0x80, 0xff, 0x8, 0x4, 0x1, 0x0, 0x4, 0x684, 0x4, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0xdbc, 0x0, @perf_config_ext={0xd03, 0x80000000}, 0x800, 0x3, 0x3, 0x5, 0x300000000000000, 0x7, 0x7ff, 0x0, 0x0, 0x0, 0x5}, r1, 0x10, 0xffffffffffffffff, 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r3, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
openat(r3, 0x0, 0x400040, 0x80)
rt_sigqueueinfo(0x0, 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f0000000240)={'ip6_vti0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x4, 0x0, 0x7f, 0x40, 0xb, @local, @mcast1, 0x88, 0x20, 0x8, 0x2}})

[ 3205.594685] syz-executor.4: attempt to access beyond end of device
00:25:16 executing program 2:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000", 0x15}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
creat(&(0x7f0000000000)='./file1\x00', 0x100)

[ 3205.594685] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 3205.596581] Buffer I/O error on dev loop4, logical block 10, lost async page write
[ 3205.632943] syz-executor.4: attempt to access beyond end of device
[ 3205.632943] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 3205.633985] Buffer I/O error on dev loop4, logical block 10, lost async page write
00:25:16 executing program 0:
perf_event_open(&(0x7f0000000080)={0x0, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r1, &(0x7f0000000100), 0x0, 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r0, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r2, 0x4000000, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0x0, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r1, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

[ 3205.696901] loop2: detected capacity change from 0 to 40
00:25:16 executing program 3:
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}}, 0x0, 0x6, 0xffffffffffffffff, 0xb)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
r1 = gettid()
rt_sigqueueinfo(0x0, 0x0, 0x0)
r2 = pidfd_getfd(0xffffffffffffffff, r0, 0x0)
perf_event_open(&(0x7f0000000040)={0x5, 0x80, 0x40, 0x71, 0x2, 0x0, 0x0, 0x8000, 0x20, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, @perf_config_ext={0xff}, 0x0, 0x9b5, 0xfa, 0xd, 0x0, 0x8000, 0x55, 0x0, 0x0, 0x0, 0x3ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000400)={0x2, 0x80, 0x2a, 0x81, 0xe0, 0x40, 0x0, 0x63c5ef1c, 0x80, 0x3, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x7, 0x2, @perf_config_ext={0xf2, 0x6}, 0x0, 0x5, 0xfffffff8, 0x0, 0x1, 0x0, 0x1b6, 0x0, 0x6}, 0x0, 0xd, 0xffffffffffffffff, 0x0)
rt_sigqueueinfo(0x0, 0x0, &(0x7f0000000000))
setsockopt$sock_timeval(r0, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10)
bind$packet(r2, &(0x7f00000000c0)={0x11, 0xfe, 0x0, 0x1, 0xfb, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}}, 0x14)
perf_event_open(&(0x7f0000000100)={0x0, 0x80, 0xff, 0x8, 0x4, 0x1, 0x0, 0x4, 0x684, 0x4, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0xdbc, 0x0, @perf_config_ext={0xd03, 0x80000000}, 0x800, 0x3, 0x3, 0x5, 0x300000000000000, 0x7, 0x7ff, 0x0, 0x0, 0x0, 0x5}, r1, 0x10, 0xffffffffffffffff, 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r3, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
openat(r3, 0x0, 0x400040, 0x80)
rt_sigqueueinfo(0x0, 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f0000000240)={'ip6_vti0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x4, 0x0, 0x7f, 0x40, 0xb, @local, @mcast1, 0x88, 0x20, 0x8, 0x2}})

[ 3205.709675] syz-executor.6: attempt to access beyond end of device
[ 3205.709675] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 3205.711725] Buffer I/O error on dev loop6, logical block 10, lost async page write
[ 3205.718135] FAT-fs (loop2): invalid media value (0x00)
[ 3205.718533] FAT-fs (loop2): Can't find a valid FAT filesystem
[ 3206.156324] loop5: detected capacity change from 0 to 32640
[ 3206.162272] FAT-fs (loop5): Unrecognized mount option "./file0" or missing value
[ 3206.340632] loop5: detected capacity change from 0 to 32640
[ 3206.341689] FAT-fs (loop5): Unrecognized mount option "./file0" or missing value
00:25:32 executing program 7:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684fd2981c8409820000080000000000000000"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x100d}], 0x6ac, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:25:32 executing program 1:
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}}, 0x0, 0x6, 0xffffffffffffffff, 0xb)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
r1 = gettid()
rt_sigqueueinfo(0x0, 0x0, 0x0)
r2 = pidfd_getfd(0xffffffffffffffff, r0, 0x0)
perf_event_open(&(0x7f0000000040)={0x5, 0x80, 0x40, 0x71, 0x2, 0x0, 0x0, 0x8000, 0x20, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, @perf_config_ext={0xff}, 0x0, 0x9b5, 0xfa, 0xd, 0x0, 0x8000, 0x55, 0x0, 0x0, 0x0, 0x3ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000400)={0x2, 0x80, 0x2a, 0x81, 0xe0, 0x40, 0x0, 0x63c5ef1c, 0x80, 0x3, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x7, 0x2, @perf_config_ext={0xf2, 0x6}, 0x0, 0x5, 0xfffffff8, 0x0, 0x1, 0x0, 0x1b6, 0x0, 0x6}, 0x0, 0xd, 0xffffffffffffffff, 0x0)
rt_sigqueueinfo(0x0, 0x0, &(0x7f0000000000))
setsockopt$sock_timeval(r0, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10)
bind$packet(r2, &(0x7f00000000c0)={0x11, 0xfe, 0x0, 0x1, 0xfb, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}}, 0x14)
perf_event_open(&(0x7f0000000100)={0x0, 0x80, 0xff, 0x8, 0x4, 0x1, 0x0, 0x4, 0x684, 0x4, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0xdbc, 0x0, @perf_config_ext={0xd03, 0x80000000}, 0x800, 0x3, 0x3, 0x5, 0x300000000000000, 0x7, 0x7ff, 0x0, 0x0, 0x0, 0x5}, r1, 0x10, 0xffffffffffffffff, 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r3, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
openat(r3, 0x0, 0x400040, 0x80)
rt_sigqueueinfo(0x0, 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f0000000240)={'ip6_vti0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x4, 0x0, 0x7f, 0x40, 0xb, @local, @mcast1, 0x88, 0x20, 0x8, 0x2}})

00:25:32 executing program 5:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
ioctl$EXT4_IOC_SWAP_BOOT(r1, 0x6611)
accept4$unix(r1, &(0x7f0000000180)=@abs, &(0x7f0000000040)=0x6e, 0x800)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r2, r0, 0x0, 0xfffffdef)

00:25:32 executing program 3:
r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r4 = perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000500)=ANY=[@ANYBLOB="010000000100000018000000", @ANYRES32=r4, @ANYBLOB="00000000000000002ed9aeaff9b7f1164083cb1f9bed3f8f5e3000000000c100"])
connect$802154_dgram(r2, &(0x7f0000000180)={0x24, @short={0x2, 0x3, 0xaaa0}}, 0x14)
openat(r3, &(0x7f00000000c0)='./file0\x00', 0x50100, 0x11)
poll(&(0x7f0000000040)=[{r0, 0x10}, {r3, 0x280}, {r3, 0x9000}, {r2, 0x100}, {r4}], 0x5, 0xe5a)
write$binfmt_aout(r3, &(0x7f0000000040)=ANY=[], 0x220)
sendfile(r3, r1, 0x0, 0xfffffdef)

00:25:32 executing program 2:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000", 0x15}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
creat(&(0x7f0000000000)='./file1\x00', 0x100)

00:25:32 executing program 6:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
ioctl$EXT4_IOC_SWAP_BOOT(r2, 0x6611)
getsockopt$inet_mreqsrc(r2, 0x0, 0x28, &(0x7f0000000040)={@loopback, @local, @private}, &(0x7f00000000c0)=0xc)
mq_timedsend(r2, &(0x7f0000000240)="61ae124a704e296357928819bac1cfca9e4a4c16747d197fd8d5d61807838f26ca798a9f5fdec6af17520aba831fd8832c5bb7d70927933a047e0ff34cc192954cb106d81bb65511c5203aa4b0c15ca79e063df77de6fd5edf5b307ad8fe69dc96a5b88da5c51cb439496d6c4e02fda8792be8e67e0d3c10ccb9238ec3c4489745fa7f15d8f68fcf6b20847a43b22d5e60b89ab961f1c2c745c289045a1deff3fd28bf25e25b9d61b283b2f241638ef80a1fde5c498603fe4c7d92ab15ecfb659fffdb1a7dcfbc28a9c0d47534d1c361af0e315faed9732b80bcd5f4de84638cf587", 0xe2, 0x3, &(0x7f0000000180))

00:25:32 executing program 0:
perf_event_open(&(0x7f0000000080)={0x0, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r1, &(0x7f0000000100), 0x0, 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r0, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r2, 0x5000000, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0x0, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r1, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:25:32 executing program 4:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_mount_image$tmpfs(0x0, 0x0, 0x0, 0x31, 0x0, 0x344816, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000000)='./file1\x00', 0x640000, 0x112)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x10000, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef)

[ 3221.546821] loop2: detected capacity change from 0 to 40
[ 3221.553461] loop4: detected capacity change from 0 to 40
[ 3221.577377] FAT-fs (loop2): invalid media value (0x00)
[ 3221.578219] FAT-fs (loop2): Can't find a valid FAT filesystem
[ 3221.602559] loop6: detected capacity change from 0 to 40
[ 3221.608871] loop5: detected capacity change from 0 to 40
[ 3221.610128] loop3: detected capacity change from 0 to 40
00:25:32 executing program 1:
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}}, 0x0, 0x6, 0xffffffffffffffff, 0xb)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
r1 = gettid()
rt_sigqueueinfo(0x0, 0x0, 0x0)
r2 = pidfd_getfd(0xffffffffffffffff, r0, 0x0)
perf_event_open(&(0x7f0000000040)={0x5, 0x80, 0x40, 0x71, 0x2, 0x0, 0x0, 0x8000, 0x20, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, @perf_config_ext={0xff}, 0x0, 0x9b5, 0xfa, 0xd, 0x0, 0x8000, 0x55, 0x0, 0x0, 0x0, 0x3ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000400)={0x2, 0x80, 0x2a, 0x81, 0xe0, 0x40, 0x0, 0x63c5ef1c, 0x80, 0x3, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x7, 0x2, @perf_config_ext={0xf2, 0x6}, 0x0, 0x5, 0xfffffff8, 0x0, 0x1, 0x0, 0x1b6, 0x0, 0x6}, 0x0, 0xd, 0xffffffffffffffff, 0x0)
rt_sigqueueinfo(0x0, 0x0, &(0x7f0000000000))
setsockopt$sock_timeval(r0, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10)
bind$packet(r2, &(0x7f00000000c0)={0x11, 0xfe, 0x0, 0x1, 0xfb, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}}, 0x14)
perf_event_open(&(0x7f0000000100)={0x0, 0x80, 0xff, 0x8, 0x4, 0x1, 0x0, 0x4, 0x684, 0x4, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0xdbc, 0x0, @perf_config_ext={0xd03, 0x80000000}, 0x800, 0x3, 0x3, 0x5, 0x300000000000000, 0x7, 0x7ff, 0x0, 0x0, 0x0, 0x5}, r1, 0x10, 0xffffffffffffffff, 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r3, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
openat(r3, &(0x7f0000000180)='\x00', 0x0, 0x80)
rt_sigqueueinfo(0x0, 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f0000000240)={'ip6_vti0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x4, 0x0, 0x7f, 0x40, 0xb, @local, @mcast1, 0x88, 0x20, 0x8, 0x2}})

00:25:32 executing program 0:
perf_event_open(&(0x7f0000000080)={0x0, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r1, &(0x7f0000000100), 0x0, 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r0, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r2, 0x6000000, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0x0, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r1, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:25:32 executing program 4:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat$loop_ctrl(0xffffffffffffff9c, 0x0, 0x0, 0x0)
setxattr$system_posix_acl(&(0x7f0000000180)='./file1\x00', &(0x7f00000001c0)='system.posix_acl_default\x00', &(0x7f0000000340)={{}, {0x1, 0x4}, [{}, {0x2, 0x4, 0xee00}, {0x2, 0x5}, {0x2, 0x1}, {0x2, 0x3}, {0x2, 0x1, 0xffffffffffffffff}, {0x2, 0x6}], {0x4, 0x4}, [{0x8, 0x3}], {0x10, 0x4}}, 0x64, 0x1)
ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, 0x0)
r1 = perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000300)=ANY=[@ANYRES32, @ANYRES32=<r2=>r1, @ANYBLOB="00000000000000002ed9aeaff9b7f1164083cb1f9bed3f8f5e3000000000c100"])
ioctl$AUTOFS_DEV_IOCTL_READY(r2, 0xc0189376, &(0x7f0000000040)={{0x1, 0x1, 0x18, r0, {0x4f95}}, './file0\x00'})
ioctl$AUTOFS_DEV_IOCTL_PROTOVER(0xffffffffffffffff, 0xc0189372, &(0x7f00000000c0)={{0x1, 0x1, 0x18, r0, {0x100}}, './file0\x00'})
r3 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_tcp_int(r3, 0x6, 0x5, &(0x7f0000000000)=0x1, 0x4)
openat(0xffffffffffffff9c, 0x0, 0x0, 0x0)
setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
setsockopt$inet6_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000040)=0x1, 0x4)
r5 = syz_mount_image$tmpfs(0x0, 0x0, 0x0, 0x0, 0x0, 0x1000, 0x0)
r6 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r6, &(0x7f0000001180)=ANY=[], 0x220)
write(r5, &(0x7f0000000240)="af5b4c782281f92667b76593111074cd551707e57fe39b72e3b891bd1db1852ebcc2d5aa82ab92c86b7e1cef3cd36f83994b42fc9b849a47519931f6fbee5aab3846ea36d4553db8b18eff5be630a1ad7d13d71b9054f5d5c7671f2342eb348ad9c2d792040f56d228c2a9fbd21b8acdd1d2712a83ebd3aefb49cbe702ea7f81fbac7fda89cc029a7c235b35af507b1df68dca0000000000000000", 0x9b)
sendfile(r6, r4, 0x0, 0xfffffdef)

[ 3221.729312] syz-executor.6: attempt to access beyond end of device
[ 3221.729312] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 3221.731350] Buffer I/O error on dev loop6, logical block 10, lost async page write
[ 3221.738727] syz-executor.5: attempt to access beyond end of device
[ 3221.738727] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 3221.740653] Buffer I/O error on dev loop5, logical block 10, lost async page write
[ 3221.742478] loop4: detected capacity change from 0 to 40
00:25:32 executing program 2:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000", 0x15}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
creat(&(0x7f0000000000)='./file1\x00', 0x100)

[ 3221.807627] syz-executor.6: attempt to access beyond end of device
[ 3221.807627] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 3221.809374] Buffer I/O error on dev loop6, logical block 10, lost async page write
00:25:32 executing program 0:
perf_event_open(&(0x7f0000000080)={0x0, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r1, &(0x7f0000000100), 0x0, 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r0, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r2, 0x87ffffc, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0x0, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r1, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:25:32 executing program 1:
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}}, 0x0, 0x6, 0xffffffffffffffff, 0xb)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
r1 = gettid()
rt_sigqueueinfo(0x0, 0x0, 0x0)
r2 = pidfd_getfd(0xffffffffffffffff, r0, 0x0)
perf_event_open(&(0x7f0000000040)={0x5, 0x80, 0x40, 0x71, 0x2, 0x0, 0x0, 0x8000, 0x20, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, @perf_config_ext={0xff}, 0x0, 0x9b5, 0xfa, 0xd, 0x0, 0x8000, 0x55, 0x0, 0x0, 0x0, 0x3ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000400)={0x2, 0x80, 0x2a, 0x81, 0xe0, 0x40, 0x0, 0x63c5ef1c, 0x80, 0x3, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x7, 0x2, @perf_config_ext={0xf2, 0x6}, 0x0, 0x5, 0xfffffff8, 0x0, 0x1, 0x0, 0x1b6, 0x0, 0x6}, 0x0, 0xd, 0xffffffffffffffff, 0x0)
rt_sigqueueinfo(0x0, 0x0, &(0x7f0000000000))
setsockopt$sock_timeval(r0, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10)
bind$packet(r2, &(0x7f00000000c0)={0x11, 0xfe, 0x0, 0x1, 0xfb, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}}, 0x14)
perf_event_open(&(0x7f0000000100)={0x0, 0x80, 0xff, 0x8, 0x4, 0x1, 0x0, 0x4, 0x684, 0x4, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0xdbc, 0x0, @perf_config_ext={0xd03, 0x80000000}, 0x800, 0x3, 0x3, 0x5, 0x300000000000000, 0x7, 0x7ff, 0x0, 0x0, 0x0, 0x5}, r1, 0x10, 0xffffffffffffffff, 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r3, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
openat(r3, &(0x7f0000000180)='\x00', 0x0, 0x80)
rt_sigqueueinfo(0x0, 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f0000000240)={'ip6_vti0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x4, 0x0, 0x7f, 0x40, 0xb, @local, @mcast1, 0x88, 0x20, 0x8, 0x2}})

00:25:32 executing program 7:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684fd2981c8409820000080000000000000000"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x100d}], 0x6b2, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

[ 3221.869105] loop2: detected capacity change from 0 to 40
[ 3221.880599] FAT-fs (loop2): invalid media value (0x00)
[ 3221.880997] FAT-fs (loop2): Can't find a valid FAT filesystem
00:25:32 executing program 5:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef)
symlinkat(&(0x7f0000000040)='./file0\x00', r1, &(0x7f00000000c0)='./file1\x00')

00:25:32 executing program 6:
r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
chroot(&(0x7f0000000040)='./file0\x00')
r2 = openat2(r0, &(0x7f00000000c0)='./file1\x00', &(0x7f0000000180)={0x400000, 0x44, 0xa}, 0x18)
openat(r2, &(0x7f00000001c0)='./file1\x00', 0x301c41, 0x153)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r3, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r3, r1, 0x0, 0xfffffdef)

00:25:32 executing program 2:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f8", 0x16}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
creat(&(0x7f0000000000)='./file1\x00', 0x100)

[ 3222.008658] syz-executor.3: attempt to access beyond end of device
[ 3222.008658] loop3: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 3222.010821] Buffer I/O error on dev loop3, logical block 10, lost async page write
[ 3222.023610] syz-executor.4: attempt to access beyond end of device
[ 3222.023610] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 3222.025339] Buffer I/O error on dev loop4, logical block 10, lost async page write
[ 3222.036581] loop5: detected capacity change from 0 to 40
[ 3222.057644] loop2: detected capacity change from 0 to 40
[ 3222.102437] FAT-fs (loop2): bogus number of FAT sectors
[ 3222.102937] FAT-fs (loop2): Can't find a valid FAT filesystem
[ 3222.132848] loop6: detected capacity change from 0 to 40
[ 3222.170681] syz-executor.5: attempt to access beyond end of device
[ 3222.170681] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 3222.171634] Buffer I/O error on dev loop5, logical block 10, lost async page write
00:25:32 executing program 3:
r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r4 = perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000500)=ANY=[@ANYBLOB="010000000100000018000000", @ANYRES32=r4, @ANYBLOB="00000000000000002ed9aeaff9b7f1164083cb1f9bed3f8f5e3000000000c100"])
connect$802154_dgram(r2, &(0x7f0000000180)={0x24, @short={0x2, 0x3, 0xaaa0}}, 0x14)
openat(r3, &(0x7f00000000c0)='./file0\x00', 0x50100, 0x11)
poll(&(0x7f0000000040)=[{r0, 0x10}, {r3, 0x280}, {r3, 0x9000}, {r2, 0x100}, {r4}], 0x5, 0xe5a)
write$binfmt_aout(r3, &(0x7f0000000040)=ANY=[], 0x220)
sendfile(r3, r1, 0x0, 0xfffffdef)

00:25:32 executing program 1:
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}}, 0x0, 0x6, 0xffffffffffffffff, 0xb)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
r1 = gettid()
rt_sigqueueinfo(0x0, 0x0, 0x0)
r2 = pidfd_getfd(0xffffffffffffffff, r0, 0x0)
perf_event_open(&(0x7f0000000040)={0x5, 0x80, 0x40, 0x71, 0x2, 0x0, 0x0, 0x8000, 0x20, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, @perf_config_ext={0xff}, 0x0, 0x9b5, 0xfa, 0xd, 0x0, 0x8000, 0x55, 0x0, 0x0, 0x0, 0x3ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000400)={0x2, 0x80, 0x2a, 0x81, 0xe0, 0x40, 0x0, 0x63c5ef1c, 0x80, 0x3, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x7, 0x2, @perf_config_ext={0xf2, 0x6}, 0x0, 0x5, 0xfffffff8, 0x0, 0x1, 0x0, 0x1b6, 0x0, 0x6}, 0x0, 0xd, 0xffffffffffffffff, 0x0)
rt_sigqueueinfo(0x0, 0x0, &(0x7f0000000000))
setsockopt$sock_timeval(r0, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10)
bind$packet(r2, &(0x7f00000000c0)={0x11, 0xfe, 0x0, 0x1, 0xfb, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}}, 0x14)
perf_event_open(&(0x7f0000000100)={0x0, 0x80, 0xff, 0x8, 0x4, 0x1, 0x0, 0x4, 0x684, 0x4, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0xdbc, 0x0, @perf_config_ext={0xd03, 0x80000000}, 0x800, 0x3, 0x3, 0x5, 0x300000000000000, 0x7, 0x7ff, 0x0, 0x0, 0x0, 0x5}, r1, 0x10, 0xffffffffffffffff, 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r3, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
openat(r3, &(0x7f0000000180)='\x00', 0x0, 0x80)
rt_sigqueueinfo(0x0, 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f0000000240)={'ip6_vti0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x4, 0x0, 0x7f, 0x40, 0xb, @local, @mcast1, 0x88, 0x20, 0x8, 0x2}})

[ 3222.215788] syz-executor.5: attempt to access beyond end of device
[ 3222.215788] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 3222.217582] Buffer I/O error on dev loop5, logical block 10, lost async page write
[ 3222.269875] syz-executor.6: attempt to access beyond end of device
[ 3222.269875] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 3222.270933] Buffer I/O error on dev loop6, logical block 10, lost async page write
[ 3222.311415] loop3: detected capacity change from 0 to 40
[ 3222.410433] syz-executor.3: attempt to access beyond end of device
[ 3222.410433] loop3: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 3222.411739] Buffer I/O error on dev loop3, logical block 10, lost async page write
00:25:47 executing program 0:
perf_event_open(&(0x7f0000000080)={0x0, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r1, &(0x7f0000000100), 0x0, 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r0, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r2, 0xc000000, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0x0, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r1, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:25:47 executing program 3:
r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r4 = perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000500)=ANY=[@ANYBLOB="010000000100000018000000", @ANYRES32=r4, @ANYBLOB="00000000000000002ed9aeaff9b7f1164083cb1f9bed3f8f5e3000000000c100"])
connect$802154_dgram(r2, &(0x7f0000000180)={0x24, @short={0x2, 0x3, 0xaaa0}}, 0x14)
openat(r3, &(0x7f00000000c0)='./file0\x00', 0x50100, 0x11)
poll(&(0x7f0000000040)=[{r0, 0x10}, {r3, 0x280}, {r3, 0x9000}, {r2, 0x100}, {r4}], 0x5, 0xe5a)
write$binfmt_aout(r3, &(0x7f0000000040)=ANY=[], 0x220)
sendfile(r3, r1, 0x0, 0xfffffdef)

00:25:47 executing program 5:
r0 = syz_mount_image$vfat(&(0x7f0000000040), &(0x7f0000000600)='./file2\x00', 0x0, 0x2, &(0x7f0000000580)=[{&(0x7f0000000500)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17, 0xb}, {0x0, 0x0, 0x2803}], 0x12000, &(0x7f0000000080)=ANY=[@ANYRESHEX, @ANYRES16, @ANYRESDEC=0x0])
chdir(&(0x7f0000000140)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_open_dev$tty1(0xc, 0x4, 0x1)
writev(r3, &(0x7f0000000000)=[{&(0x7f0000000140)="02b2dccad213e1e6cf54b7a797f8f22a47f25b7658fb110b2e76f95b0f318b8fa745e6ffba4414d29a42bfab524bc5bffb17decc4540a6f00b9772f5f9789a9525790df8d989b23530d0a1398f2ad734c7ff47961be476ffeec81efa3d3aa64b8ea329261dfc2e1047a68670f0e5950d6a5414956bddd09e101b5b66e5742fe843413e065e3b86a242b37bc58c68153a45015f6f1ea67762c302e461e0c84bbb7f8d464f5a72d9fad56dac0c5028a4012a93dbc7da640786e3c9898cdd8fe091b166bfcd66e6257abc923ceaf90e994deded3fe8a59c2105f5caf366d32170ef51299dbf441bc3cddda352a2e07375fb44e75fed8082f3e960015d9bcddb0c834feda68d113a9a9fc0d1c30153685caf43b176219b666d74e67b6192cfd8a561c6c4aadcc80ed8c469bc41b028f1db515d699e45ad3379f9b1edb8de4bb2f8615d6716297baac7e45073fcecf31e51ec78c40edd78f245bced04414f849fb961fbbe79ff2ed7c48ec1b5331f9755d7094986fc8da198ce4a12f9ddfb43e565bc4fed618da9a693d03c3e7ec4b3014dfc022103e277c1b12efb03ef8b197f3a931f6cbe238cf8a4e7639b409b4586f66da41b94eed69d52ba9fde5aa1ee774d4e626932dc3511b10ae3bc3e8688a7a83b0467dfbf92951747396735c9f47ad4552e7bdf4f8e7998a1266a360beb2ec1527390452139f9ab91ee250efcf3413e72a6b2688d8b6a4748ccc165bbf886573ccdd03bd93f32a866cd878ec246e06f31d4d7f7ec9836b7305ee0c1b9fa75cd6e4ca5cc2f107b654f15a2442cd9c8eaf581d093639fe35e0da49394c5ed66ad29bc2b863649e16c1951d0d3dd6f1048539e558ee1f059d91510a5acd84777ca01545635d2fb40e2f205bb11435023e47e4e2f85b6d1b56b688dd1a4304708a561d32dbaa6cd4f969e67af33773d4e9772751019dc6c2af7e2fe9d3c7eb6f1b401926603d90802f792b081957dd5ebd18410cd42b2ea05ae9a61254e4b878384b8a376fe9eba06afc1253f2224fab88feb7c426e3dfb19385afbb42cc13209b419568eeafdf505dc5ca30acc17d337e941e0badf9f9413f381fe9a315e2597426805827943f193f02a12554d434bd91708a28d9da1bf64ad64f80a7287d1e02d5d1f14bf9d89ba3badfa524694db6a651e97ea64104ad34942f36745259f4ec32fdce0bd13e693ccbe0e012e61a1fae9fc1662b99871e3812cea14d12646ccc08b0514762a475ecdbf9071377bb1ecd891c6fe32fde1d3044caf466b3a342b7541e8ed7432e94baf1d5546aff0e23f6a03c9ea5635519533e712639c27958e3a0f3684ed91cfb2e6e4", 0x3b8}], 0x1)
r4 = syz_io_uring_complete(0x0)
r5 = syz_open_dev$tty1(0xc, 0x4, 0x1)
writev(r5, &(0x7f0000000600), 0x0)
r6 = openat$loop_ctrl(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$LOOP_CTL_REMOVE(r6, 0x4c81, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000500)=ANY=[])
ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000040)=ANY=[])
ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0)
r7 = openat$loop_ctrl(0xffffffffffffff9c, 0x0, 0x0, 0x0)
write$binfmt_aout(r4, &(0x7f0000000bc0)=ANY=[@ANYRES64, @ANYRES32=r5, @ANYBLOB="cd4281ff16ced2624d7de70fee4bd85f67d22faea7df94f7e1973029ba859cb28116d23b32f65f1d5372c132f7c9babc", @ANYRES32, @ANYRES64=r6, @ANYBLOB="ae02668134c6735c7ca1bcc4df2a22bb5999da97e81369274e2a83b477295f35346249694b2f21e3b25952f33519fdd0613ef345ec01c25a73ac0bc01d88d8476d512984db", @ANYBLOB="c0ad0ca0d0757e5c444223fdcffd495eb207baf54ffc694ae46c8864b7226d042d64b47665f04f1bc8ee77ec5de09a7eb5360703b7c5c2f8802a741667168a3e1e88cc7379bfe6fe5c126eefc385fe484943da6bb0e77e35800cca3ebec014da17dd7ea4186e0200040000000000007779bb8919b697b92f1d51b4bf3a84a1b70a08741f2c42c84e89a990563a3eacb6abbe6499270d04d7d7117184e14c41d8a674ed75694329b5041e0c7899a4156b059c79fb108491e1575ecaf642e593ee3f478435f9d65083d64001c5cf1a063ac2768ddbd2f3ffe5b938f3fa76478cf65cbdb1221e5d769ab0d0f2d7326799d3e51fa90b75435b597c511656d247a3469566805db5b26ed10067b8485a60ba816b467c375fefe6bdf2a71aca9ca6b8e601d776cea50dfa4b059402eb543f62cfbcdb9c94c2dde9a2f06a1bdb5513f1ab47b83642b2808aac4c9acaa5236d4e8ec98ee8e3e59a82d100a5ff95dfa1721425a25d7e75e09d8c9f56ae3195fdc90222c229", @ANYRESHEX, @ANYRES64=r5, @ANYRES32, @ANYRESHEX=r7, @ANYRES64=r0], 0x220)
sendfile(r2, r1, 0x0, 0xfffffdef)
getsockopt$WPAN_WANTLQI(r4, 0x0, 0x3, &(0x7f00000000c0), &(0x7f0000000540)=0x4)

00:25:47 executing program 7:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684fd2981c8409820000080000000000000000"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x100d}], 0x6ba, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:25:47 executing program 2:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f8", 0x16}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
creat(&(0x7f0000000000)='./file1\x00', 0x100)

00:25:47 executing program 4:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x181042, 0x0)
syz_mount_image$tmpfs(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef)

00:25:47 executing program 6:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
stat(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, <r1=>0x0})
setresuid(0x0, r1, 0x0)
mount$9p_unix(&(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='./file1\x00', &(0x7f0000000180), 0x100000, &(0x7f0000000240)={'trans=unix,', {[{@cache_none}, {@access_uid={'access', 0x3d, 0xee01}}, {@loose}, {@access_uid={'access', 0x3d, 0xee01}}, {@version_L}, {@cache_fscache}], [{@subj_type={'subj_type', 0x3d, 'vfat\x00'}}, {@fowner_eq={'fowner', 0x3d, r1}}, {@func={'func', 0x3d, 'FIRMWARE_CHECK'}}, {@subj_user}]}})
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r2, r0, 0x0, 0xfffffdef)

00:25:47 executing program 1:
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}}, 0x0, 0x6, 0xffffffffffffffff, 0xb)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
r1 = gettid()
rt_sigqueueinfo(0x0, 0x0, 0x0)
r2 = pidfd_getfd(0xffffffffffffffff, r0, 0x0)
perf_event_open(&(0x7f0000000040)={0x5, 0x80, 0x40, 0x71, 0x2, 0x0, 0x0, 0x8000, 0x20, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, @perf_config_ext={0xff}, 0x0, 0x9b5, 0xfa, 0xd, 0x0, 0x8000, 0x55, 0x0, 0x0, 0x0, 0x3ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000400)={0x2, 0x80, 0x2a, 0x81, 0xe0, 0x40, 0x0, 0x63c5ef1c, 0x80, 0x3, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x7, 0x2, @perf_config_ext={0xf2, 0x6}, 0x0, 0x5, 0xfffffff8, 0x0, 0x1, 0x0, 0x1b6, 0x0, 0x6}, 0x0, 0xd, 0xffffffffffffffff, 0x0)
rt_sigqueueinfo(0x0, 0x0, &(0x7f0000000000))
setsockopt$sock_timeval(r0, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10)
bind$packet(r2, &(0x7f00000000c0)={0x11, 0xfe, 0x0, 0x1, 0xfb, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}}, 0x14)
perf_event_open(&(0x7f0000000100)={0x0, 0x80, 0xff, 0x8, 0x4, 0x1, 0x0, 0x4, 0x684, 0x4, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0xdbc, 0x0, @perf_config_ext={0xd03, 0x80000000}, 0x800, 0x3, 0x3, 0x5, 0x300000000000000, 0x7, 0x7ff, 0x0, 0x0, 0x0, 0x5}, r1, 0x10, 0xffffffffffffffff, 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r3, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
openat(r3, &(0x7f0000000180)='\x00', 0x400040, 0x0)
rt_sigqueueinfo(0x0, 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f0000000240)={'ip6_vti0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x4, 0x0, 0x7f, 0x40, 0xb, @local, @mcast1, 0x88, 0x20, 0x8, 0x2}})

[ 3237.102268] loop5: detected capacity change from 0 to 40
[ 3237.107799] loop6: detected capacity change from 0 to 40
[ 3237.115905] loop4: detected capacity change from 0 to 40
[ 3237.123936] loop3: detected capacity change from 0 to 40
[ 3237.140869] loop2: detected capacity change from 0 to 40
[ 3237.159293] FAT-fs (loop2): bogus number of FAT sectors
[ 3237.159321] FAT-fs (loop2): Can't find a valid FAT filesystem
[ 3237.217261] syz-executor.6: attempt to access beyond end of device
[ 3237.217261] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 3237.219115] Buffer I/O error on dev loop6, logical block 10, lost async page write
[ 3237.274385] syz-executor.4: attempt to access beyond end of device
[ 3237.274385] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 3237.275919] Buffer I/O error on dev loop4, logical block 10, lost async page write
[ 3237.277753] loop5: detected capacity change from 0 to 40
00:25:47 executing program 2:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f8", 0x16}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
creat(&(0x7f0000000000)='./file1\x00', 0x100)

00:25:48 executing program 1:
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}}, 0x0, 0x6, 0xffffffffffffffff, 0xb)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
r1 = gettid()
rt_sigqueueinfo(0x0, 0x0, 0x0)
r2 = pidfd_getfd(0xffffffffffffffff, r0, 0x0)
perf_event_open(&(0x7f0000000040)={0x5, 0x80, 0x40, 0x71, 0x2, 0x0, 0x0, 0x8000, 0x20, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, @perf_config_ext={0xff}, 0x0, 0x9b5, 0xfa, 0xd, 0x0, 0x8000, 0x55, 0x0, 0x0, 0x0, 0x3ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000400)={0x2, 0x80, 0x2a, 0x81, 0xe0, 0x40, 0x0, 0x63c5ef1c, 0x80, 0x3, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x7, 0x2, @perf_config_ext={0xf2, 0x6}, 0x0, 0x5, 0xfffffff8, 0x0, 0x1, 0x0, 0x1b6, 0x0, 0x6}, 0x0, 0xd, 0xffffffffffffffff, 0x0)
rt_sigqueueinfo(0x0, 0x0, &(0x7f0000000000))
setsockopt$sock_timeval(r0, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10)
bind$packet(r2, &(0x7f00000000c0)={0x11, 0xfe, 0x0, 0x1, 0xfb, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}}, 0x14)
perf_event_open(&(0x7f0000000100)={0x0, 0x80, 0xff, 0x8, 0x4, 0x1, 0x0, 0x4, 0x684, 0x4, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0xdbc, 0x0, @perf_config_ext={0xd03, 0x80000000}, 0x800, 0x3, 0x3, 0x5, 0x300000000000000, 0x7, 0x7ff, 0x0, 0x0, 0x0, 0x5}, r1, 0x10, 0xffffffffffffffff, 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r3, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
openat(r3, &(0x7f0000000180)='\x00', 0x400040, 0x0)
rt_sigqueueinfo(0x0, 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f0000000240)={'ip6_vti0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x4, 0x0, 0x7f, 0x40, 0xb, @local, @mcast1, 0x88, 0x20, 0x8, 0x2}})

00:25:48 executing program 0:
perf_event_open(&(0x7f0000000080)={0x0, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r1, &(0x7f0000000100), 0x0, 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r0, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r2, 0xc010000, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0x0, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r1, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:25:48 executing program 6:
r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r2 = ioctl$TUNGETDEVNETNS(0xffffffffffffffff, 0x54e3, 0x0)
fremovexattr(r2, &(0x7f0000000500)=@random={'trusted.', '[/$]{&-!}+)\x00'})
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
setxattr$security_ima(&(0x7f0000000040)='./file0\x00', &(0x7f00000000c0), &(0x7f0000000180)=@md5={0x1, "cbf13a50049463c7ddc8990fd3352d96"}, 0x11, 0x3)
ioctl$AUTOFS_DEV_IOCTL_SETPIPEFD(r1, 0xc0189378, &(0x7f00000001c0)={{0x1, 0x1, 0x18, <r4=>r0, {r1}}, './file0\x00'})
getgroups(0x3, &(0x7f0000000240)=[0x0, 0xee01, <r5=>0x0])
ioctl$AUTOFS_DEV_IOCTL_REQUESTER(r1, 0xc018937b, &(0x7f0000000280)={{0x1, 0x1, 0x18, r4, {0xffffffffffffffff, r5}}, './file1\x00'})
write$binfmt_aout(r3, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r3, r1, 0x0, 0xfffffdef)
r6 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
ioctl$EXT4_IOC_SWAP_BOOT(r6, 0x6611)
r7 = syz_open_dev$tty1(0xc, 0x4, 0x1)
writev(r7, &(0x7f0000000000)=[{&(0x7f0000000140)="02b2dccad213e1e6cf54b7a797f8f22a47f25b7658fb110b2e76f95b0f318b8fa745e6ffba4414d29a42bfab524bc5bffb17decc4540a6f00b9772f5f9789a9525790df8d989b23530d0a1398f2ad734c7ff47961be476ffeec81efa3d3aa64b8ea329261dfc2e1047a68670f0e5950d6a5414956bddd09e101b5b66e5742fe843413e065e3b86a242b37bc58c68153a45015f6f1ea67762c302e461e0c84bbb7f8d464f5a72d9fad56dac0c5028a4012a93dbc7da640786e3c9898cdd8fe091b166bfcd66e6257abc923ceaf90e994deded3fe8a59c2105f5caf366d32170ef51299dbf441bc3cddda352a2e07375fb44e75fed8082f3e960015d9bcddb0c834feda68d113a9a9fc0d1c30153685caf43b176219b666d74e67b6192cfd8a561c6c4aadcc80ed8c469bc41b028f1db515d699e45ad3379f9b1edb8de4bb2f8615d6716297baac7e45073fcecf31e51ec78c40edd78f245bced04414f849fb961fbbe79ff2ed7c48ec1b5331f9755d7094986fc8da198ce4a12f9ddfb43e565bc4fed618da9a693d03c3e7ec4b3014dfc022103e277c1b12efb03ef8b197f3a931f6cbe238cf8a4e7639b409b4586f66da41b94eed69d52ba9fde5aa1ee774d4e626932dc3511b10ae3bc3e8688a7a83b0467dfbf92951747396735c9f47ad4552e7bdf4f8e7998a1266a360beb2ec1527390452139f9ab91ee250efcf3413e72a6b2688d8b6a4748ccc165bbf886573ccdd03bd93f32a866cd878ec246e06f31d4d7f7ec9836b7305ee0c1b9fa75cd6e4ca5cc2f107b654f15a2442cd9c8eaf581d093639fe35e0da49394c5ed66ad29bc2b863649e16c1951d0d3dd6f1048539e558ee1f059d91510a5acd84777ca01545635d2fb40e2f205bb11435023e47e4e2f85b6d1b56b688dd1a4304708a561d32dbaa6cd4f969e67af33773d4e9772751019dc6c2af7e2fe9d3c7eb6f1b401926603d90802f792b081957dd5ebd18410cd42b2ea05ae9a61254e4b878384b8a376fe9eba06afc1253f2224fab88feb7c426e3dfb19385afbb42cc13209b419568eeafdf505dc5ca30acc17d337e941e0badf9f9413f381fe9a315e2597426805827943f193f02a12554d434bd91708a28d9da1bf64ad64f80a7287d1e02d5d1f14bf9d89ba3badfa524694db6a651e97ea64104ad34942f36745259f4ec32fdce0bd13e693ccbe0e012e61a1fae9fc1662b99871e3812cea14d12646ccc08b0514762a475ecdbf9071377bb1ecd891c6fe32fde1d3044caf466b3a342b7541e8ed7432e94baf1d5546aff0e23f6a03c9ea5635519533e712639c27958e3a0f3684ed91cfb2e6e4", 0x3b8}], 0x1)
ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r6, 0xc0189372, &(0x7f00000002c0)={{0x1, 0x1, 0x18, r7, {0x5}}, './file0\x00'})

[ 3237.469307] loop2: detected capacity change from 0 to 40
00:25:48 executing program 4:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
ioctl$VFAT_IOCTL_READDIR_SHORT(r0, 0x82307202, &(0x7f0000000240)=[{0x0, 0x0, 0x100}, {0x0, 0x0, 0x100}])
r1 = openat(r0, &(0x7f0000000100)='./file0\x00', 0x101042, 0x0)
syz_mount_image$tmpfs(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r2, r1, 0x0, 0xfffffdef)

[ 3237.485360] FAT-fs (loop2): bogus number of FAT sectors
[ 3237.486353] FAT-fs (loop2): Can't find a valid FAT filesystem
00:25:48 executing program 3:
r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r4 = perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000500)=ANY=[@ANYBLOB="010000000100000018000000", @ANYRES32=r4, @ANYBLOB="00000000000000002ed9aeaff9b7f1164083cb1f9bed3f8f5e3000000000c100"])
connect$802154_dgram(r2, &(0x7f0000000180)={0x24, @short={0x2, 0x3, 0xaaa0}}, 0x14)
openat(r3, &(0x7f00000000c0)='./file0\x00', 0x50100, 0x11)
poll(&(0x7f0000000040)=[{r0, 0x10}, {r3, 0x280}, {r3, 0x9000}, {r2, 0x100}, {r4}], 0x5, 0xe5a)
write$binfmt_aout(r3, &(0x7f0000000040)=ANY=[], 0x220)
sendfile(r3, r1, 0x0, 0xfffffdef)

00:25:48 executing program 5:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r0, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
r1 = openat(r0, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r2, r1, 0x0, 0xfffffdef)

[ 3237.603334] loop6: detected capacity change from 0 to 40
[ 3237.606757] loop4: detected capacity change from 0 to 40
[ 3237.688306] loop3: detected capacity change from 0 to 40
[ 3237.733407] loop5: detected capacity change from 0 to 40
[ 3237.774208] syz-executor.6: attempt to access beyond end of device
[ 3237.774208] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 3237.774293] Buffer I/O error on dev loop6, logical block 10, lost async page write
[ 3237.897846] syz-executor.3: attempt to access beyond end of device
[ 3237.897846] loop3: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 3237.900111] Buffer I/O error on dev loop3, logical block 10, lost async page write
00:26:02 executing program 3:
r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r1 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000500)=ANY=[@ANYBLOB="010000000100000018000000", @ANYRES32=r3, @ANYBLOB="00000000000000002ed9aeaff9b7f1164083cb1f9bed3f8f5e3000000000c100"])
connect$802154_dgram(r1, &(0x7f0000000180)={0x24, @short={0x2, 0x3, 0xaaa0}}, 0x14)
openat(r2, &(0x7f00000000c0)='./file0\x00', 0x50100, 0x11)
poll(&(0x7f0000000040)=[{r0, 0x10}, {r2, 0x280}, {r2, 0x9000}, {r1, 0x100}, {r3}], 0x5, 0xe5a)
write$binfmt_aout(r2, &(0x7f0000000040)=ANY=[], 0x220)

00:26:02 executing program 6:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
unlinkat(r0, &(0x7f0000000040)='./file0\x00', 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef)

00:26:02 executing program 1:
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}}, 0x0, 0x6, 0xffffffffffffffff, 0xb)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
r1 = gettid()
rt_sigqueueinfo(0x0, 0x0, 0x0)
r2 = pidfd_getfd(0xffffffffffffffff, r0, 0x0)
perf_event_open(&(0x7f0000000040)={0x5, 0x80, 0x40, 0x71, 0x2, 0x0, 0x0, 0x8000, 0x20, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, @perf_config_ext={0xff}, 0x0, 0x9b5, 0xfa, 0xd, 0x0, 0x8000, 0x55, 0x0, 0x0, 0x0, 0x3ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000400)={0x2, 0x80, 0x2a, 0x81, 0xe0, 0x40, 0x0, 0x63c5ef1c, 0x80, 0x3, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x7, 0x2, @perf_config_ext={0xf2, 0x6}, 0x0, 0x5, 0xfffffff8, 0x0, 0x1, 0x0, 0x1b6, 0x0, 0x6}, 0x0, 0xd, 0xffffffffffffffff, 0x0)
rt_sigqueueinfo(0x0, 0x0, &(0x7f0000000000))
setsockopt$sock_timeval(r0, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10)
bind$packet(r2, &(0x7f00000000c0)={0x11, 0xfe, 0x0, 0x1, 0xfb, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}}, 0x14)
perf_event_open(&(0x7f0000000100)={0x0, 0x80, 0xff, 0x8, 0x4, 0x1, 0x0, 0x4, 0x684, 0x4, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0xdbc, 0x0, @perf_config_ext={0xd03, 0x80000000}, 0x800, 0x3, 0x3, 0x5, 0x300000000000000, 0x7, 0x7ff, 0x0, 0x0, 0x0, 0x5}, r1, 0x10, 0xffffffffffffffff, 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r3, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
openat(r3, &(0x7f0000000180)='\x00', 0x400040, 0x0)
rt_sigqueueinfo(0x0, 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f0000000240)={'ip6_vti0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x4, 0x0, 0x7f, 0x40, 0xb, @local, @mcast1, 0x88, 0x20, 0x8, 0x2}})

00:26:02 executing program 2:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
creat(&(0x7f0000000000)='./file1\x00', 0x100)

00:26:02 executing program 7:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684fd2981c8409820000080000000000000000"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x100d}], 0x6d5, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:26:02 executing program 0:
perf_event_open(&(0x7f0000000080)={0x0, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r1, &(0x7f0000000100), 0x0, 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r0, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r2, 0xd010000, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0x0, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r1, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:26:02 executing program 4:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
fsconfig$FSCONFIG_SET_PATH(0xffffffffffffffff, 0x3, &(0x7f0000000040)='vfat\x00', &(0x7f00000000c0)='./file1\x00', 0xffffffffffffffff)
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_mount_image$tmpfs(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r1, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
r2 = openat(r1, &(0x7f0000000100)='./file1\x00', 0x105040, 0x0)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r2, r0, 0x0, 0xfffffdef)

00:26:02 executing program 5:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0xffffffffffffffff, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
acct(&(0x7f0000000040)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef)

[ 3252.199919] loop4: detected capacity change from 0 to 40
[ 3252.216929] loop2: detected capacity change from 0 to 40
[ 3252.228170] loop6: detected capacity change from 0 to 40
[ 3252.229015] loop5: detected capacity change from 0 to 264192
[ 3252.275886] loop3: detected capacity change from 0 to 40
00:26:02 executing program 1:
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}}, 0x0, 0x6, 0xffffffffffffffff, 0xb)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
r1 = gettid()
rt_sigqueueinfo(0x0, 0x0, 0x0)
r2 = pidfd_getfd(0xffffffffffffffff, r0, 0x0)
perf_event_open(&(0x7f0000000040)={0x5, 0x80, 0x40, 0x71, 0x2, 0x0, 0x0, 0x8000, 0x20, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, @perf_config_ext={0xff}, 0x0, 0x9b5, 0xfa, 0xd, 0x0, 0x8000, 0x55, 0x0, 0x0, 0x0, 0x3ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000400)={0x2, 0x80, 0x2a, 0x81, 0xe0, 0x40, 0x0, 0x63c5ef1c, 0x80, 0x3, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x7, 0x2, @perf_config_ext={0xf2, 0x6}, 0x0, 0x5, 0xfffffff8, 0x0, 0x1, 0x0, 0x1b6, 0x0, 0x6}, 0x0, 0xd, 0xffffffffffffffff, 0x0)
rt_sigqueueinfo(0x0, 0x0, &(0x7f0000000000))
setsockopt$sock_timeval(r0, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10)
bind$packet(r2, &(0x7f00000000c0)={0x11, 0xfe, 0x0, 0x1, 0xfb, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}}, 0x14)
perf_event_open(&(0x7f0000000100)={0x0, 0x80, 0xff, 0x8, 0x4, 0x1, 0x0, 0x4, 0x684, 0x4, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0xdbc, 0x0, @perf_config_ext={0xd03, 0x80000000}, 0x800, 0x3, 0x3, 0x5, 0x300000000000000, 0x7, 0x7ff, 0x0, 0x0, 0x0, 0x5}, r1, 0x10, 0xffffffffffffffff, 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r3, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
openat(r3, &(0x7f0000000180)='\x00', 0x400040, 0x80)
rt_sigqueueinfo(0x0, 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000240)={'ip6_vti0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x4, 0x0, 0x7f, 0x40, 0xb, @local, @mcast1, 0x88, 0x20, 0x8, 0x2}})

[ 3252.339595] syz-executor.6: attempt to access beyond end of device
[ 3252.339595] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 3252.341507] Buffer I/O error on dev loop6, logical block 10, lost async page write
00:26:03 executing program 2:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
creat(&(0x7f0000000000)='./file1\x00', 0x100)

00:26:03 executing program 4:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r1 = openat2$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file1\x00', &(0x7f0000000040)={0x0, 0x22, 0x13}, 0x18)
execveat(r1, &(0x7f00000000c0)='./file1\x00', &(0x7f0000000300)=[&(0x7f0000000180)='vfat\x00', &(0x7f00000001c0)='(,!}:\x00', &(0x7f0000000240)='vfat\x00', &(0x7f0000000280)='vfat\x00', &(0x7f00000002c0)='$\\@-\x00'], &(0x7f0000000400)=[&(0x7f0000000340)=']/\x04#\'+\x00', &(0x7f0000000380)='\x00', &(0x7f00000003c0)='vfat\x00'], 0x100)
syz_mount_image$tmpfs(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r2, r0, 0x0, 0xfffffdef)

00:26:03 executing program 7:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684fd2981c8409820000080000000000000000"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x100d}], 0x6df, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:26:03 executing program 0:
perf_event_open(&(0x7f0000000080)={0x0, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r1, &(0x7f0000000100), 0x0, 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r0, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r2, 0x10000000, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0x0, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r1, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:26:03 executing program 3:
r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r1 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000500)=ANY=[@ANYBLOB="010000000100000018000000", @ANYRES32=r3, @ANYBLOB="00000000000000002ed9aeaff9b7f1164083cb1f9bed3f8f5e3000000000c100"])
connect$802154_dgram(r1, &(0x7f0000000180)={0x24, @short={0x2, 0x3, 0xaaa0}}, 0x14)
openat(r2, &(0x7f00000000c0)='./file0\x00', 0x50100, 0x11)
poll(&(0x7f0000000040)=[{r0, 0x10}, {r2, 0x280}, {r2, 0x9000}, {r1, 0x100}, {r3}], 0x5, 0xe5a)

[ 3252.549468] loop4: detected capacity change from 0 to 40
00:26:03 executing program 6:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
getsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f0000001340)={{{@in6=@loopback, @in6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r2=>0x0}}, {{@in=@loopback}, 0x0, @in=@private}}, &(0x7f00000001c0)=0xe8)
syz_mount_image$tmpfs(&(0x7f0000000040), &(0x7f00000000c0)='./file0/file0\x00', 0xff, 0x2, &(0x7f0000000180)=[{&(0x7f0000000240)="6f1374218720aa371528974a961163e168ccbd323cefeef6fd9b1f54b431a328a1d8c3c78d5ab0066375edc6e95afa3d46d61b27d8a1777dd5c457369b7909a02fe34a1b5e2802891eee0cfb421c56d03cd0a7e3c8f4c16310c9b8925ac1b831b311eb9233d56818f5a68852f5b3380ea889411cefd4ef5870fe1a869adf25239c5dc82b94fdb96b363afbda5a4c6da93e3663146bd56caf26ed2c16d9c234769a07f144590a8b975da24c01042fb70e7de00c259a690adae0ae9c8a697ff1065818160fd79cb2961a6db191621900716a32972f4e6d18ab12bbe4c09aa4be5d22b70eaf0b20c2b1d789debe33fdf470caca9ba87fbb739864fab03459b64447f9f7a47a6207e3c95fc044dd09c1afc069db1b6524f1c35929d2188d0f2616596250b9fe461fe99924012ad61da54710599c63135ecffda707cd0065d4b8e9a516630588881b6165cb43b249b4b5d95570c8823ea8cc72de3e3f2b11c7abdb33b2b9767179fa0c02dd1c6ec588f2fc7454c36be091f720420b5fd49a14eccf72d75f41b67e4ebcdd52c542945a5d293316de792237458c591c4ebcbebb444f8d1f08e3393e8332908269a6a5d22c31deba86b438686f969d22a735653f5c6088bbada1220b4e92324ebbc07e0d6ccf15fded61f4af6ae31ed6aa307070f15037949fdb8903a10d41334d5d41b83855ef2d532279798578963e1ef46cd932ebecfa41e9ad6c42fa59b94834bacbbb17293d8b538d13b5bd893da587ccbb4726a6ce999526f1057115bc41ffa88fe87ccf1a9e7abadc64ba05e4855f42f8c93b52bffe5bba5a92804daf6fd412e5adc96e93b952ffb901cf1ab06c75edaa3b584868e5e9095f52048807d58ac2222a8c430070ebb36067f1099dfc7123f72b1b9e4c188bf83b41fe84b8f825bdf50f2a1648f2871a58f6cc92a1aafcde0e63fe581660f9d84b3acfaa472949ffda11158c5dc6ecac2e00e642593bfb00678b5ee5f0a619e80ed0878b44aafa2b18776b0812fcca90f6fba7033069415b5d338f6c73c518f5f268d61a59d2858bbdde9a8f6df7b3475e7050342f5f643603ecafeff61e987b84051dd6398a1ff89c914068cd06668317771cdb0856d29e39bcc17042539b2a29c64cd7f7ef37e9e6bcb891d866c8e39309b183d0a001994c4e459f86284d85da9e16918fc343933fed39051c5aa6db76cd2ae44760a32ec829f5c3663833b4079dca2fdbf5497fae59fcc124834a0efa22ac2d5a1f6299e83984ef93b96e32d34a01150bc8d38ec83e3c743ab02be9c739e90551b85ef976deb440794e7a0f35ba5b98d554f4b093e7b96e21989fa1a4bd190dea733a10aab645c846d43765a63a02c35fc80183f364ffb3a95b87aadf2e1292eb18450e17e7e9426853b348dfb3d8fac973fd9cb88766a64aece8503b7ec1f368159141d00c6bba975131f2cb9000d39dd505376335cb6a76ab5700ea1aa23f7d6ef05e55fc19fb166e2972d2aaa96b96c9d4e00a09d2bf5da3474b950de42382285fa7da36f44d30b4efcc84a04be4d12de1bad2a23d73f3a9a2c70b533554b083301dc62ada34470608131e7127e42d7c1b6fe9e053324fb9c54769c42608d563c105c6d5ffcb5ab9aa3b136c37686f59c8f28265089e8e0e744b968d4fe69b6b0acc580491fb73966b857c4886997526cb44a7404d47facb4d331005d40c044b419eecec3021530ba1fff4a84520e374355d3b37fa4539318898cc9744a0c0d1ebf8ae0e024ccb3454c2ecdeb3ca8b10d63a1d42fe3234ef6e0b3eab457aa4c5510cffb6df7c0744c5338b0a29091cb2156c52e699c98183fe5ff2b1d3590e98d56cc3c21abb108f9366d171a6e7e9779908d6c0052cf8e0ff206e79addad4d82432139a76458476993ab46c283ef508b31c8575c66145e4fc4d3cd4d47a433664e5a7829134928b2426cc28296edfcf7ccdae0693a73aad891f8a3b4c303a001b542caa509586ebe4ef0db69c1df70c4ca8c27f66d831229c3d45c4ef080970f31540c8048fc6dc944ee9ad1fdea9defe4ab9920aae551972e153a72ccef91854946d9c03b3802d8054d0db34b0014ecaf0f7e8ad54a59e199c21a1d69f3f460d1e97bf278effa8635be3cead4f68935fb437ea833dfdf61e1cfbd5e40483ea0a4d19d1837780aefea3c59a431acf9875e5f4b8250115a7e669f1a418147d57c3c02398afdf9db9e9a49af57533220f1bc8d0c275c317973a7395e30491002e85b1f0bf036d80ac29ded34774764ed274ddb97a41c1326dc7d4b97660915487498429f02f5eb376d6c7de3ca7724f486dc81b72ec07dfe98c0f406e68a6ddcf2ed1cac802a916641f5cc934a7e3f90fe0255efe69ae39ce367afcf2d91f4657b327dfb6cd968d20ef21de90a8c136eb2bc5b77e3bf73868a39fa11e02cf62d9fcc47493c651b45d2c91527b8c5a4b15873d75c1cf536d4575ea19f7e30913c35490c5f7b3070e4fda2d08590945f9073890839f5db59d73f3fae833b448ba735fb8b8c9e5f6d4687c9b64826f592b4f2eb18d66197d43cde10ea99aa64865103761d125da790cb7a6db1236c5fc88b3b4fef71edde8112551b63cde9635040d08c9d7d30f41f86c5a265148ae90a2d669a3f3eef1375ceeb7688918c1183b9fdf749499f64905f7a153dfe2807c4369f49c6bc3bab0e2b1d6c979b196b60a25b5308b352efd9773505e81e656511e76d80492cff4fb8915848dd6760f7bbb1e41f4c0d544ee25d208eae62430cf27f974399da517127b896e2bf5b30becf89bd0d34849b2cd835d8f6fc8cb8de19edea6abcb073b01fe3e7cb7cc9fabc65a6669b3e8c656553e513482a0b515db15606b16102bcfe52aaa8d20f1f86113b6ec1d7958882e249131c1dca708125d27b9bd184ac2773a0f474acf43915069717fe49b4e911a99aac322b2eade4aa8972f002e4a7e7980182553c77ce8d6054296d24cbd1eacdc9074803584ea2efec863c13fb45a110c37178856fc354d327aac238275766672e55b927d02cc3290b1b184d32cba9a0cf0ec6192f7f7f7fdd3062917341aa25769cb5671beeee4b8c525ee86f301f94695d1e6e54286785680a428c8c3953c74a7b3f357d44aec5d4e30fbfb6e0296775ceca6c16046b68456717e9e2acd03cb8951504d689d255a346564eb45345092b7106ccfde30726ab1ccb07073ceb151651e9a45eb7382a5d63b8cc8b251748f2374cc317479d45b33c9884accddc25c0619cb6cb19aba97fee1b1d4f89380678d34d163fba9d77437237e32ac10142c983cd89c4bcfeb9c7ef9bd595c1de487df1fad3baacee75e6bebc0c625fe8688cff3535c21862ecf0d7a2655eb1bd44a50836f69683832e972281c7a089950e575b3b3ecd86b8e7881a85eb1e98ff3a93fc76a3b18a91598a1e81355f80733a7c396c774c9bdf37fb1880521351202b47cbb81934f5423e8c6cdefc5590342f2b2eff8372df0161a2ce9471bb7b5cc99625f1b7d6f966328fc2da48f95654b9c6ffd3f85a4e0c3faee4b0de961e47ee57d5f1ac9feff533080ea96ef217432e805076eedb6348290e189d0424068c93a67eaac71bcfaef3ec3172f4d9df7409a622b5fb256a548fc55a70325f0e4f03de67445c11fbc86b233cfb4f91dab6104c41ca4992f898b7553decf4939e812126a14f3a43bf6964502e8ada61fb37323d913a24df1bfa9fdbfd702d1f1f5e3b0335d1344558299e4bb2af47ede1a3f657b126017717b965aa22f41663c80d4602dbf83f67d29d400f86644ad4204289e6d627a54196351acc8a2175ed472874ccd175e435d9fc2361683d4c340e2ef9329fdf1057d7e53ec4c870da4206b107a0a3a45f46d7a2390c7506cbc921d27b2f4f5dd1e4aa22715da8101d14930713b88d18f377d9bde970018624103043ce8b0d3d0d9b8e3b819566e708af11bbbc7b9ececb0742e8a0235095294d87cdc71ed5b4181bba9573d6ebe139e4f346f9c8608edbff90c2a9f6dd3452df3f3b0798f36c1ae5f4517bb1897bbfa2e6e3d191431ec83caa1f33d42034f4217eb3a7731055adf18be9b6c818eb05ff894439698a54517c7c51bdcc74722cfafb452eacaffc9c4df101a97c66dfeec125e82cd9a4d755cc149efcd7d2061ed7750ac6c9c055bcfc569c552f9b6bfa1cb268c08be1b9d242201c1bd9788683d5c5afa573f20747fc98b6ecfb13cd9c0de142c3f1798675a3eaf67c5146901163e7051852ebd261e60fbf2a5392601564b86c7677a5e30f5c75f3bc9fdedd7f9d87dd735d24f4559f4711b8f1f0639985306b8b8a43267202edccc7ee74534ca8d340e6db6b1231aa18a49b7ec7c240a4aa5163fd009d8b1181ed1546a134ea9049ad1de9ac68e91a0bc0619ea7abda71271d92dd8aa00c0adb37597a5af86dd6f61564321831fa2b74c32d4c613468fabe125a162dd7616d907fc5e84b0db4e57382ea5c2f7589bbc0fc27084ca6d12b39ff2385e10c0e88066c34d667b661c97746246e93ee6a4e54dbf42ab4d699bd68963168190a997c55baec73aa65cdf543e49651c60698ee4cbff80949a5a5a32400b2eb45264c902637029faa5bbb7db1e79a85178afd9d5d40909f555cf3e9612d17e44b2b3a44735fbea0b7dd3445a742434c9f4b24a58190b036b154bab6c5fc9a44c3093a2f8b7a73112f4c9797b4299e1b69538e49f81c81906f4ea54359eae18a8fca69094c51a10085839b72772570a34ad2722543f33acd56be597d975d659af29fd0c2d7e5307314dbcc0ac4e598901a983b8a465cccb06163a78f82a28102f0d3493d1424e67dd19a81e0c875213fca35f31bf31446b1d974f2b83c6d5b5aeafb751a7e7af2f44caf860056318816e20be202e9821dbe42176958bd58d7777d5c1b046d98a0146fa8f81861001941cdb6fc15561c73056eb06547498d4e10b61783054ffa8c7c8b669090e842ad62d7d1744da1dfb3696f892cd155deb13f5c7d47122c4a2872a5643478f437f6d83a081790d0d87f5a0cb1e9e6ae77de3506719d54b1ad6a38bd352a80667b609c4c0b05d2e6687586eebb5a78da881b17a1eef76940647dd82080b28c58623ddd6cf1a068c876a54370aaf853defdad26965a3ee818f083199ad65be15b1aaa8a9f582f27e480e730d6be60fc76407fdbc68cab19471e4b3113ae0c8ac0797dfc25327d61d1bfa3ae40223f2c322c7221cd55577509186af7e6b4053c654a56f7b3d41570eae009aaa01710ad1de91f12c6fe16cd3a32fc78b6bfee5f6e119aefa977879fd78ad51158c8a3a62acb2637292f249c951c04be0313a5e8ca23e97d963fc3540166f2c9135c91da800bd89e6ed6698aa9d6b61b2fd152a4278a4d552dc6bbabee1074ed494f21ad1f35a01fe2d3847d5bcd5c29cfdaa73dcb44c9944b9f6fda04b9b6b3de52d85e912956b5c298ab3c09e9081fe29a390c60750d3292af8c44b9e103c335247a13b9604678f8973613b887176d10a4e0afa6124a3c61caffc088d927446e559d11ede56f7d93d977baa26792068d7e561526146be93f44d69335d8beba8fb8f15665b2040db68e4bc9b382c02931db94b651b2dfcd044f7a9b7833d5b1b64031ac99cae559979496ed662b632e766c21d592b68929aaf2885d2a06e36ddc5e4f7101ff249bc2f2a4abc4be08b6abdab96c2b4bfae07d1c4b27a0dbcdde3305cbd246158ed4690b5a41cef46b3f68a95cf81c0822ba9a40e9430cc7950832893a000cfef1caa148db19348e34d496415782ad38876", 0x1000, 0x9}, {&(0x7f0000001240)="2baea2511e0cb19658fabce94afc49126322a7ee3c0a13e8c2e8736e64d0bbd5277a90f7b8eeb11b469afe9b1a89ed263a92779ad7e5bb0488081103816fc37d1241f0a9b9f17745740be0f1fb16de311e48998e5f39d5e81ab78a9ac5e2317ee80c1e7f7209d412c0dc836be16f7a3a0ef3b324549b8939f60ff56f7143068c630d42a3f63a3fed966173337939bfb5d709802218cb7445584a1b6bc8b7e4d6c39dcd768982602825fb6561bcf7b6548070bd8e91ffa7feb59de4054765b686c48e8eb06eb88ad7dc835c49144301bd3b4924832212cad0d42a88e8c4531d8af1b4689566ad12b1ae9b8a10", 0xec, 0x4}], 0x8050, &(0x7f0000001440)={[{@huge_always}], [{@smackfstransmute}, {@subj_user={'subj_user', 0x3d, '\\^:\\H*.'}}, {@obj_type={'obj_type', 0x3d, '!'}}, {@euid_eq={'euid', 0x3d, r2}}, {@context={'context', 0x3d, 'staff_u'}}, {@audit}, {@smackfstransmute={'smackfstransmute', 0x3d, 'vfat\x00'}}, {@fsuuid={'fsuuid', 0x3d, {[0x64, 0x30, 0x65, 0x64, 0x33, 0x53, 0x65, 0x38], 0x2d, [0x31, 0x62, 0x0, 0x30], 0x2d, [0x35, 0x65, 0x62, 0x62], 0x2d, [0x38, 0x62, 0x30, 0x39], 0x2d, [0x35, 0x6, 0x39, 0x66, 0x67, 0x32, 0x61, 0x39]}}}]})
sendfile(r1, r0, 0x0, 0xfffffdef)

[ 3252.618533] syz-executor.4: attempt to access beyond end of device
[ 3252.618533] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 3252.619425] Buffer I/O error on dev loop4, logical block 10, lost async page write
[ 3252.633245] loop2: detected capacity change from 0 to 40
[ 3252.656051] syz-executor.4: attempt to access beyond end of device
[ 3252.656051] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 3252.658223] Buffer I/O error on dev loop4, logical block 10, lost async page write
[ 3252.664630] loop6: detected capacity change from 0 to 40
00:26:03 executing program 1:
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}}, 0x0, 0x6, 0xffffffffffffffff, 0xb)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
r1 = gettid()
rt_sigqueueinfo(0x0, 0x0, 0x0)
r2 = pidfd_getfd(0xffffffffffffffff, r0, 0x0)
perf_event_open(&(0x7f0000000040)={0x5, 0x80, 0x40, 0x71, 0x2, 0x0, 0x0, 0x8000, 0x20, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, @perf_config_ext={0xff}, 0x0, 0x9b5, 0xfa, 0xd, 0x0, 0x8000, 0x55, 0x0, 0x0, 0x0, 0x3ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000400)={0x2, 0x80, 0x2a, 0x81, 0xe0, 0x40, 0x0, 0x63c5ef1c, 0x80, 0x3, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x7, 0x2, @perf_config_ext={0xf2, 0x6}, 0x0, 0x5, 0xfffffff8, 0x0, 0x1, 0x0, 0x1b6, 0x0, 0x6}, 0x0, 0xd, 0xffffffffffffffff, 0x0)
rt_sigqueueinfo(0x0, 0x0, &(0x7f0000000000))
setsockopt$sock_timeval(r0, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10)
bind$packet(r2, &(0x7f00000000c0)={0x11, 0xfe, 0x0, 0x1, 0xfb, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}}, 0x14)
perf_event_open(&(0x7f0000000100)={0x0, 0x80, 0xff, 0x8, 0x4, 0x1, 0x0, 0x4, 0x684, 0x4, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0xdbc, 0x0, @perf_config_ext={0xd03, 0x80000000}, 0x800, 0x3, 0x3, 0x5, 0x300000000000000, 0x7, 0x7ff, 0x0, 0x0, 0x0, 0x5}, r1, 0x10, 0xffffffffffffffff, 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r3, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
openat(r3, &(0x7f0000000180)='\x00', 0x400040, 0x80)
rt_sigqueueinfo(0x0, 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000240)={'ip6_vti0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x4, 0x0, 0x7f, 0x40, 0xb, @local, @mcast1, 0x88, 0x20, 0x8, 0x2}})

[ 3252.714095] loop3: detected capacity change from 0 to 40
[ 3252.727562] syz-executor.6: attempt to access beyond end of device
[ 3252.727562] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 3252.728557] Buffer I/O error on dev loop6, logical block 10, lost async page write
[ 3252.755340] syz-executor.6: attempt to access beyond end of device
[ 3252.755340] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 3252.756306] Buffer I/O error on dev loop6, logical block 10, lost async page write
00:26:03 executing program 7:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684fd2981c8409820000080000000000000000"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x100d}], 0x6e5, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:26:03 executing program 6:
r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r1 = openat(r0, &(0x7f0000000040)='./file0\x00', 0x4000, 0x1a0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
setsockopt$WPAN_SECURITY(r2, 0x0, 0x1, &(0x7f00000001c0)=0x2, 0x4)
write$binfmt_aout(r4, &(0x7f0000001180)=ANY=[], 0x220)
ioctl$AUTOFS_DEV_IOCTL_SETPIPEFD(0xffffffffffffffff, 0xc0189378, &(0x7f00000000c0)={{0x1, 0x1, 0x18, <r5=>r1}, './file1\x00'})
r6 = openat$loop_ctrl(0xffffffffffffff9c, 0x0, 0x101040, 0x0)
ioctl$LOOP_CTL_REMOVE(r1, 0x4c81, 0xa)
r7 = perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000500)=ANY=[@ANYBLOB="010000000100000018000000", @ANYRES32=<r8=>r7, @ANYBLOB="00000000000000002ed9ed3f8f5e30aa840000c100"])
ioctl$AUTOFS_DEV_IOCTL_READY(r8, 0xc0189376, &(0x7f0000000040)={{0x1, 0x1, 0x18, r6, {0x4f95}}, './file0\x00'})
fcntl$setstatus(r6, 0x4, 0x2800)
sendfile(r2, r5, &(0x7f0000000180)=0x2d6, 0x7)
sendfile(r4, r2, 0x0, 0xfffffdef)
r9 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000240), 0x82200, 0x0)
ftruncate(r3, 0x2)
sendfile(r9, 0xffffffffffffffff, &(0x7f0000000300)=0xbb95, 0x7)

[ 3252.911608] loop6: detected capacity change from 0 to 40
[ 3253.081278] syz-executor.6: attempt to access beyond end of device
[ 3253.081278] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 3253.082830] Buffer I/O error on dev loop6, logical block 10, lost async page write
00:26:18 executing program 5:
r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
ioctl$AUTOFS_DEV_IOCTL_ISMOUNTPOINT(0xffffffffffffffff, 0xc018937e, &(0x7f0000000040)={{0x1, 0x1, 0x18, <r1=>0xffffffffffffffff, @in_args={0x1}}, './file1\x00'})
ioctl$AUTOFS_DEV_IOCTL_TIMEOUT(r1, 0xc018937a, &(0x7f00000000c0)={{0x1, 0x1, 0x18, r0, {0xfffffffffffffffb}}, './file1\x00'})
chdir(&(0x7f0000000140)='./file0\x00')
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x900, 0x10)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
openat$hwrng(0xffffffffffffff9c, &(0x7f00000001c0), 0x408040, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
ioctl$EXT4_IOC_SWAP_BOOT(r4, 0x6611)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
ioctl$EXT4_IOC_SWAP_BOOT(r5, 0x6611)
openat(r5, &(0x7f0000000240)='./file1\x00', 0x480102, 0x10c)
write$binfmt_aout(r3, &(0x7f0000000280)=ANY=[], 0x230)
sendfile(r3, r2, 0x0, 0xfffffdef)

00:26:18 executing program 2:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
creat(&(0x7f0000000000)='./file1\x00', 0x100)

00:26:18 executing program 6:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x3, &(0x7f0000001640)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}, {&(0x7f0000000640)="8d6c3956066e37f84e34352029da71125848544994333f04feab013ac1d1f3524e7576666cea695c82d057ac1d9033f9f8aff5d5704a7d6c23ba9dd92b1d7771561229d2e49f30a37f5710221cf28394ba78e6c43c64092521d855eafdfb2f1a1dd9f61924fd6cc7888d10c895dc812d98ec600dfb0b0608130ec0d24491f48d355864f7d813520367c619cc167194d5bb896b466798c07dc2df7d1649f220897469545008600982927944e96cacd3a9c1838f8e0fe2038cf1e1b1044d46503bd4cb22a6b665880b3488d3318b93ed24eee1da2aedc3b23c90166609523de31b9b8ff7c9c95685f4e6fd033f249da171cf11626a838d89a516a6d1aec9b50ba5994936f6b0242760d45228674c69405ff5d6fcd0c789d0b6779378d211c3e410e090edbe51348db7e8a9c7082d037e443fdbb4f8dd7072b1514ce423d6d339e72d01b54810762782cc92c4fc69f942de1ef24b9e3d727fb1d9614608fc6c602c4c8fcea1d8ffe9e17ec39b8fec09e7beacb5b67a02f8dee90010b1636a039169b95e4585aea24bd7869e1e523b677d3d02acf94483fef5b2644ad726372f794e6e2eb29579240152c2585ecac06468d38d595366f93b7f40148087e276727f924d444d7ffb629c8dd6fd2441fea304eb24fe32a9ec116b803a5ddd09d1a04bf7307cc576e24647b41cffee13aced1c73ca7c4e649b75636fa78c8e100837a4d24c6280fae9dc9460d71c8263958e3bebb875f6fbc84889d33cfef2ab004c30abaf601b290acd01b0c8b17c09b68cb9f48065510a4d7ac0eb985550c648a3ba75b0340494c173f0fe220168c8aa438d03181b880dee99c830aa9f27c3bfcdeccf4a5848510c746acee60f816fe26d7fb975a0d963d51804e88c80fe5c61df5b3533221b22646c5460b958bccef39efc8a18af33b5cf2b0f6e9223774a6fb2d8d3502c7fdee4b4a2750a756cf418bac333c755f3eff98349232a17435cc5ef7e86ad83727764660308ce24491dbff7a0187ead52488b016baf9b96cf69d3f331394489f50bbd3f14d3475429f37a657506819bc22c0ea2c40a9499163706cc7691dd1ecd56c4a5f8f6e8eb75fabddbe06655dbf090dded6985428820cfa9e6c910b6da1bad615054be5b10307e3fed711e8d898a09edbc0a92c72fbbce469aa75583782f1a61d26fa6e99c957463ea158986139e87214b1906a4f3b0327eb5e8274d4e11383216f99d82d306742dff2de1a5462810dbdc2ae2615ee29333c77e5f49625e2a9862d0ec9154882c5fe0249b10e81bf992d71da6ad9e7b93a12c85298ccef7442cf7aedb01571fe144b191f7c59bcabc5063667cd6507d686179e70fc395f6ccefe365c8e6c6a72f65adad2b3c63fe7570434f04187f87b42050605976c43301ebd6d9f14dbae80bd0503033e63dce7909b3f1791e1e7b6122f4b4e43534313c5010f58663f364d69b6ea003ea3185c69243e60c7770cdeb6d3d6e2daaa25bebf3797b3f8267c91f73add1ee0ee88408bfcdd18f1b3819011e8ae5a19a52ff6d5035712792b54267bb630d72d2d1dcca90c442163277ad9dab08bc61eb070e8864b5abf023265745c0b9a0a09c444ada81bbe9369c757e06c15dabdc42c17033dddd8df394dd689820ecbbffc59a6daca5584e6842e21ad0cf1a55d4cf147cdc6d83d540a7156625d62f2f9e4414dbe6def528597b291adfaf3081db4f0eedd630bb314c8b57c060d6e0325db09cf9cbe4f3ccf149e522080fc1e2e14d578662e1c4a4085cd54d7b531cda7909aa7a032dfa456c14c50458bea9238060661bb22eac28fbef8b13941be6287b3929232bc09a33209da64f2ac51af54e875ca9e92c954bb531c08e8ce30d55eddafcebe7ed5e2917d652d09c13a4e7157803f34247d3a118e3452c94669491673d5d7e0e10144005c1a8ec483432f4eb919f27a17088ba2a01a8726a788c6e113ddc98eb75cd3bee7943f6002b8aca577bb8f1ac2bd67a4447ccf3bdf4327c3865cdca5eefe86f54224fabae32c7423e77f4b5ce7f15fe3705d7567dbbe4a3dbe86e9c9e2886897a345747e5dabe567dec564d0efcd893aa2d819d48dedc122722781ec8b35b9e92ab6debf327553f7bbf0fc7912eb4df5e45d21182e8335cf3ca6950193aff6b51a7d768efa8d846664701efa7fadcd646c334a648094fa1e91c2b226c169428fe4c6cf4740d03f6eb1130f5120f25631ae744d5b5d7734531b185d1192c7b996434b875afdd4467cbb10efed6bec65077d1be5da0ed43d8ce53467dfdf6394dbf375fa64f881b79c69b6f9acf1e069ba3f8257f88b7d436de1c1666bae45695319acf94e0a7e6b919b498c88b65f00dbd55426369aefd79d83f00c0b079fc65967d60ce1248dad4178a653b1a93600f020965b76712403a151054bf4693c12c31afb274028677458fe3f6f60054d477ada18b9d089f7b5ff2c13730cfcae60f2f20ac885ea68ab854e893abfca5414f327013050be0e35504162dbc6de97c1d224060a3e09c3e082c084645be9c103f12670efd3f1ed7768a7b23e7ce9c22355170de1356788b2bf1f80a01532847e1b3560ccdca544060a7880afcda06db17acff094de576b955938938e8b3ded084f6398234c8ccb7bd70762c112bd10332643cd5161b4a11c438346ff9aba91e353c4a4af3c235b096b3efbf9a5a6952273849484f45a3ad22bd3bc5009250300cc6f2295c78edfcd494169f7fb5ea8e08e31025df760e9612f1dc334208841b1549dbaaf434a7d941127509744c2fd466d0abf6aeeb99072bccb438f52fcf4eeb2dda211ded8ef589826c7ce26cce8fc2f0f0988cc99269d2dbaab2e35ba5442a56fc14697c9123c21e22b3f19ae4159571821cc237d32221ccf9cbfc3b83e8b322f997de5ec54019f19aa4e56d44268a746aaef3d7fe745463e1c831e3a62fcd63d30e27f2328ab24e6917d3b5afc6da8d2042fff52094bc20b6509b2a8fe63a5d7f118c3619d3ad1ffcda5222b249222ccda272dca1121e057166d30c07a74af699e31e206aecfae16357dc0f40d21d81a93ebe00c62c9ba7e4e5d2a980cc6c0e7d1ffd26b8e9ded4430dde2d0ee995417f68d839bc54c885a214763e7c3a06d9a26dc6ccbae665663859313841d1da4ca882f97d50219fdc810fd89352ca775ff62a7f66bfd0e647e31bf2da86648086fd6f01c5d4480e3d1b3408475ddb4c173354023bc60c4212db6b635d580bdaa8b7ca26b157653a4d845dce85fbf4179fd73983d5770d373120b8128ffcaf1a63d56e9a64d50bd0fde891a53941bcd32cff07b793535d67169b1198fcc9b55fee0f5b6ccd7cebdf9ae1151378f6fef94ba1264ddfd87599d24d72be84a7ac087bbd22f1297421ffb5664298ef33f25c893acae191b4189d992859346f2f3df9bad4ac3996ab96ddf3eb65aa04572285748d7609134027d324b1e0c0d88597796c18ca0574e00d7c670d2bc0bdfd93e0cec3b330a4f179c53fb2b33f4841af9f42afb98811dd7f1f99d53105db57760e25969b452f2de6d58f9b1c6a41e57a03c1a745702313e28d210ce3ae420a932b73af5ae7efc2a8dc25dd9be9f2d665bf5d3d13cb10d2d9fe1e451e73e7786d54b653abffce8a9878b057f8a9fd5962c5c39686241ddca3daec6a16e8e1dee8ddf484f25b295a5e8d3c79cafe74c804adc4c48cd14afc253812c87f6d3d40f40c5c0278d8fef03f0a014dd2aff88e8b6f7b67645d2002fa42929e4aae416c5bcf01129b80b76a8e139a5a4bb0dd15bd66c6372ea2df05097c7e625a3cda9ffca0ccc9fb9e6c215de4470abe1a59ca31afa6b68d6b29a7fc478a744d0b4fbec0f4f87da4011e478e2d79415f4e720620bfae70368fd2b6107f37a585bf47ef8ca53926cdd9f3fdd86083f0b14045ad75f7b763559c0b5bc98db9756dc5ea0e518880e0a46c280cf2b6d12eeb10bc2ca0d4aadb8893a3448b2e7f3954d9652ddc3f61ca04df85f7373f36787757b5b953bafd384c294fef2a74f9bf2f8cfcc7d1c1bbed15ece4edc2eabd075cf06f465e6fda6386b82f71699ca97081125b50151ce018c6c797563e38137d2bddc6481a9dc327282a2f642b8d8e5f1c58abeda62b47b5ea39d52e3a2c634bb0d9abf087bea570ad0056c23a8bfb2bff85f299e9ea66ceefc1f63d6d1f1790fb560690ffeaaf2735c91b5801f8c55c1d371157c47c51cc036d449f41cf95fd32d1b3fcc63bb21b6fcd7540474393bbda4e816562a9fa7852c744ea54aaa790daf5ee84e94779e560648589dbcc4ce99bb6976733e9852e6d69dd322fed3f9936464b8288bea04be6184d36885ac3fcefa80e500c6e985e0c2c851d0acae033799c1b15cd1fef1a5315bd0417d015687d52ae2cc77851997d7c5636c4ba101529717176ca9269015d3800c67be3f7a0b69efb0271d21f344b767ad84e8e79445a74e9c10f7259f3e4d79970545d7d32f11356349dd1f16f26f7b5c7dcdbe4870919b20eb269c1ced9081579082796793491b893cd7b4398cbd65ab5507705c52a744df647adaef29f39be1b757fe897fe3897fb9d5cec28ff34b95b620346980c16c69cc73fe4b52a24703ee1d36ddfab743e0eccc84e4e9b26380353e19dde6cb7643fcb29e1281b32cd4d67d20c02cdb594eb24b5107584cc86e36d22d60b03f580c917d99f129a9611d97ab9628ca585040b77813b454c0460db63029c234b62af2e0fbadfceeedee3959c417065f3c08ca7ba0646bcf4471396659ac1c7a9c30023247fdca73589d820c47e307edb1480c3fe4b730e6e8645f27d4c12e3b172cb9bd61cada7c8eeba0506cec8ce1ec0a2c600703d5ed369ced0b08bd5f589a7cca9ee9a093e9876e6e03cd59b131305e183d06e57d7babdf6d763c52ff269a3d71602a8dfca50fb48c451f9e887d885c4631228c675ba3790fd5389fd1374c481b299608315532f98e5e8f16262f0b8036cc80ff5cfee0053aa6a441f1eb95664c5cd7138fb4ef1e8728f4e0d9d645e514d2932f7d0e9116f3a6c7e630759d44694d6d4dc463ea02487dc337ef343144c454668a6a380de3652a90fb6955e5882cb47299caa13c244a71ff7bd7671cdc711d70a33329632c9373f44d14a5ae24475ef34eca6217ad0ee62b2835c7d402b330da9ae491012bc070d031766c4279609819f965927bcbdcd4c4049018cc0c3d70a6e7ab9d44e0cc4cfe701416a3ad56fe5f08b9073916ee5a1c5f3534737d394223f3387baeeacab9b4cebc585857bac163970b410bb8471bb5b66e59165a649e922dd2a40cad39652cb3e42fbc147d3d66c1baa4c54a7e55ad1bbee27caf81e838acfaa0d09f674c1cd786c7ca3c6b6d589ddced704795bd200bd53b071ea3241100a04d1a9a739ea94143712b15498fad8249709a72de5ba54156140f0d0e3f0c3fcdc7af8fb878b22cb8b0a09b114852a1ed0c8f01c172616ee61099c674e94957738d14bc59888bdd6292ed50c923ab8324f64637f300a4c479fffefce692affaa7073a75e3e1038be8752fe0a420dacbc49e021ec36c17090bdebc8330d8abde5e35e879721cfe96494633beed392ea3d6897b7e4a806404cf402f6e190752bac80d78728d380638c9d17475bf714ffe66911930e7029cbcac6d905497af78a48de3b55ae01bece3f18585c007d6596c9a619fbcfda641a995d029d87484413cbef141b25587030c74595f373e7b98cc86721f4e9334a5ce18c715d2796242c61988ccedcdd2101f327f78888eddb20db5aff1a6ef832d21b", 0x1000}], 0x0, &(0x7f0000000540)=ANY=[@ANYBLOB="d94f6ea9b7d556bb13c385d759a1c33a020beb8f9197dc84e9d4e07c39872353a26db4e88cc65925a0a73fd17d8b10916923eb487576a0e08c25e16061e2110d6b1908ba9973282a33bc699244957e4da91a76b303e5ea12a8331f369200009e8c06d3bea383caf06d52b98a490b4290fa55bd9ae9296687465b06f82f2955369f15b7090b8de39cb8596ed8aca29adf90afe0bf6cd2ac0de9b2a5900dc8130730da936f977e5906d63105db92e7c485e013dbacc5d19865abdc2aa0829900c66b4f6b452d3a0678e01239e890e37a00006f85c01d8f298b5ee06da7fe4075b7f66cf528dfc996808b71b01be4876cb9ca30ed86", @ANYRES32])
r0 = syz_mount_image$iso9660(&(0x7f0000000040), &(0x7f00000000c0)='./file1\x00', 0x0, 0x1, &(0x7f0000000180)=[{&(0x7f0000000240)="b1592494012707cea310b96fac734fb7fa5d6745df288b5f36d3a2520622529cf88ce38ddcd64a9601eb809ea5d4a62c5d4f1d5841b122573c33c5bbbefe52c54f13774628295fdf25229c3f96c1cf08c104d743d408adb37aef45082b4cf2ebac05d44b9aac3913c0cb0d88f3bf8a9550d925bc07cb486bd8cab9223204bdca7a5ec23efbfff44e7ad8c7eacd9de6033cb3757e187a8fd87e4a5b70043cae428639e7c7cbb7471654ac9fcd4a40bf2b478787b173e198caa7fc03ea075a06f335825a269df70888aec80007858b02980f08a75f64", 0xd5, 0x20}], 0x30804, &(0x7f0000000440)=ANY=[@ANYBLOB='session=0x0000000000000062,fowne\x00'/45, @ANYRESDEC=0x0, @ANYBLOB=',euid<', @ANYRESDEC=0xee00, @ANYBLOB=',obj_type=vfat\x00,defcontext=unconfined_u,\x00'])
sendmsg$AUDIT_MAKE_EQUIV(0xffffffffffffffff, &(0x7f0000001800)={&(0x7f0000001740)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f00000017c0)={&(0x7f0000001780)={0x2c, 0x3f7, 0x400, 0x70bd29, 0x25dfdbfc, {0x7, 0xd, './file0', './file1/file0'}, ["", "", "", "", "", ""]}, 0x2c}, 0x1, 0x0, 0x0, 0x40}, 0x0)
r1 = openat(r0, &(0x7f00000001c0)='./file0\x00', 0x101000, 0x84)
chdir(&(0x7f0000000140)='./file0\x00')
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r2, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
r3 = syz_open_dev$tty20(0xc, 0x4, 0x1)
ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r3, 0x81f8943c, &(0x7f00000033c0))
r4 = openat(r2, &(0x7f0000000400)='./file0\x00', 0x2a1cc0, 0x0)
r5 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r6 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r6, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r6, r4, 0x0, 0xfffffdef)
mount(&(0x7f0000000340)=@sg0, &(0x7f0000000380)='./file1\x00', &(0x7f00000003c0)='virtiofs\x00', 0x800000, &(0x7f0000000500)='P\'{%[/\x00')
setxattr$trusted_overlay_redirect(&(0x7f0000000200)='./file1\x00', &(0x7f00000016c0), &(0x7f0000001700)='./file0\x00', 0x8, 0x0)
write$binfmt_script(r1, &(0x7f0000001a00)={'#! ', './file0', [{0x20, '!&'}, {}, {0x20, '4'}, {0x20, '\x96]\\'}, {0x20, 'virtiofs\x00'}, {0x20, '/%*)'}, {}], 0xa, "7d9988ff7242f7321af3e4a69c3307c6eec6f52948e755d9cec5e00e5a5efa7968"}, 0x46)
ioctl$AUTOFS_DEV_IOCTL_EXPIRE(0xffffffffffffffff, 0xc018937c, &(0x7f0000001840)={{0x1, 0x1, 0x18, <r7=>r5}, './file0/file0\x00'})
sendmsg$IPSET_CMD_PROTOCOL(r7, &(0x7f0000001980)={&(0x7f0000001880)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000001940)={&(0x7f00000018c0)={0x5c, 0x1, 0x6, 0x801, 0x0, 0x0, {0x2, 0x0, 0x8}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x5c}, 0x1, 0x0, 0x0, 0x24004811}, 0x4001)
chdir(&(0x7f00000019c0)='./file0/file0\x00')

00:26:18 executing program 3:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r0 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000500)=ANY=[@ANYBLOB="010000000100000018000000", @ANYRES32=r2, @ANYBLOB="00000000000000002ed9aeaff9b7f1164083cb1f9bed3f8f5e3000000000c100"])
connect$802154_dgram(r0, &(0x7f0000000180)={0x24, @short={0x2, 0x3, 0xaaa0}}, 0x14)
openat(r1, &(0x7f00000000c0)='./file0\x00', 0x50100, 0x11)

00:26:18 executing program 4:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r2, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
openat(r2, &(0x7f00000001c0)='./file0\x00', 0x10401, 0x2)
openat(r0, &(0x7f00000000c0)='./file1\x00', 0x80, 0xc)
syz_mount_image$tmpfs(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
llistxattr(&(0x7f0000000000)='./file1\x00', &(0x7f0000000040)=""/27, 0x1b)
write$binfmt_aout(r3, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r3, r1, 0x0, 0xfffffdef)
r4 = fcntl$dupfd(r0, 0x406, r3)
ioctl$FAT_IOCTL_GET_VOLUME_ID(r4, 0x80047213, &(0x7f0000000180))

00:26:18 executing program 0:
perf_event_open(&(0x7f0000000080)={0x0, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r1, &(0x7f0000000100), 0x0, 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r0, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r2, 0x12000000, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0x0, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r1, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:26:18 executing program 1:
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}}, 0x0, 0x6, 0xffffffffffffffff, 0xb)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
r1 = gettid()
rt_sigqueueinfo(0x0, 0x0, 0x0)
r2 = pidfd_getfd(0xffffffffffffffff, r0, 0x0)
perf_event_open(&(0x7f0000000040)={0x5, 0x80, 0x40, 0x71, 0x2, 0x0, 0x0, 0x8000, 0x20, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, @perf_config_ext={0xff}, 0x0, 0x9b5, 0xfa, 0xd, 0x0, 0x8000, 0x55, 0x0, 0x0, 0x0, 0x3ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000400)={0x2, 0x80, 0x2a, 0x81, 0xe0, 0x40, 0x0, 0x63c5ef1c, 0x80, 0x3, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x7, 0x2, @perf_config_ext={0xf2, 0x6}, 0x0, 0x5, 0xfffffff8, 0x0, 0x1, 0x0, 0x1b6, 0x0, 0x6}, 0x0, 0xd, 0xffffffffffffffff, 0x0)
rt_sigqueueinfo(0x0, 0x0, &(0x7f0000000000))
setsockopt$sock_timeval(r0, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10)
bind$packet(r2, &(0x7f00000000c0)={0x11, 0xfe, 0x0, 0x1, 0xfb, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}}, 0x14)
perf_event_open(&(0x7f0000000100)={0x0, 0x80, 0xff, 0x8, 0x4, 0x1, 0x0, 0x4, 0x684, 0x4, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0xdbc, 0x0, @perf_config_ext={0xd03, 0x80000000}, 0x800, 0x3, 0x3, 0x5, 0x300000000000000, 0x7, 0x7ff, 0x0, 0x0, 0x0, 0x5}, r1, 0x10, 0xffffffffffffffff, 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r3, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
openat(r3, &(0x7f0000000180)='\x00', 0x400040, 0x80)
rt_sigqueueinfo(0x0, 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000240)={'ip6_vti0\x00', &(0x7f00000001c0)={'syztnl2\x00', 0x0, 0x4, 0x0, 0x7f, 0x40, 0xb, @local, @mcast1, 0x88, 0x20, 0x8, 0x2}})

00:26:18 executing program 7:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684fd2981c8409820000080000000000000000"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x100d}], 0x6eb, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

[ 3268.171479] loop6: detected capacity change from 0 to 40
[ 3268.177516] FAT-fs (loop6): Unrecognized mount option "�On���V�Å�Y��:돑�܄���|9�#S�m���Y%��?�}��i#�Huv���%�`a�k��s(*3�i�D�~M�v����36�" or missing value
[ 3268.188626] loop3: detected capacity change from 0 to 40
[ 3268.192518] loop4: detected capacity change from 0 to 40
[ 3268.212458] loop2: detected capacity change from 0 to 40
[ 3268.224708] loop5: detected capacity change from 0 to 40
[ 3268.335145] syz-executor.4: attempt to access beyond end of device
[ 3268.335145] loop4: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 3268.336774] Buffer I/O error on dev loop4, logical block 10, lost async page write
00:26:19 executing program 3:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r0 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r1 = perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000500)=ANY=[@ANYBLOB="010000000100000018000000", @ANYRES32=r1, @ANYBLOB="00000000000000002ed9aeaff9b7f1164083cb1f9bed3f8f5e3000000000c100"])
connect$802154_dgram(r0, &(0x7f0000000180)={0x24, @short={0x2, 0x3, 0xaaa0}}, 0x14)

[ 3268.389319] syz-executor.5: attempt to access beyond end of device
[ 3268.389319] loop5: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 3268.391254] Buffer I/O error on dev loop5, logical block 10, lost async page write
00:26:19 executing program 2:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x410, 0x0)
chdir(&(0x7f0000000140)='./file0\x00')
openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
creat(&(0x7f0000000000)='./file1\x00', 0x100)

[ 3268.538514] loop3: detected capacity change from 0 to 40
00:26:19 executing program 1:
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}}, 0x0, 0x6, 0xffffffffffffffff, 0xb)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
r1 = gettid()
rt_sigqueueinfo(0x0, 0x0, 0x0)
r2 = pidfd_getfd(0xffffffffffffffff, r0, 0x0)
perf_event_open(&(0x7f0000000040)={0x5, 0x80, 0x40, 0x71, 0x2, 0x0, 0x0, 0x8000, 0x20, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, @perf_config_ext={0xff}, 0x0, 0x9b5, 0xfa, 0xd, 0x0, 0x8000, 0x55, 0x0, 0x0, 0x0, 0x3ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000400)={0x2, 0x80, 0x2a, 0x81, 0xe0, 0x40, 0x0, 0x63c5ef1c, 0x80, 0x3, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x7, 0x2, @perf_config_ext={0xf2, 0x6}, 0x0, 0x5, 0xfffffff8, 0x0, 0x1, 0x0, 0x1b6, 0x0, 0x6}, 0x0, 0xd, 0xffffffffffffffff, 0x0)
rt_sigqueueinfo(0x0, 0x0, &(0x7f0000000000))
setsockopt$sock_timeval(r0, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10)
bind$packet(r2, &(0x7f00000000c0)={0x11, 0xfe, 0x0, 0x1, 0xfb, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}}, 0x14)
perf_event_open(&(0x7f0000000100)={0x0, 0x80, 0xff, 0x8, 0x4, 0x1, 0x0, 0x4, 0x684, 0x4, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0xdbc, 0x0, @perf_config_ext={0xd03, 0x80000000}, 0x800, 0x3, 0x3, 0x5, 0x300000000000000, 0x7, 0x7ff, 0x0, 0x0, 0x0, 0x5}, r1, 0x10, 0xffffffffffffffff, 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r3, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
openat(r3, &(0x7f0000000180)='\x00', 0x400040, 0x80)
rt_sigqueueinfo(0x0, 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r2, 0x89f0, 0x0)

00:26:19 executing program 4:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x3000410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_mount_image$tmpfs(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x181442, 0xf4)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef)

00:26:19 executing program 0:
perf_event_open(&(0x7f0000000080)={0x0, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r1, &(0x7f0000000100), 0x0, 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r0, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r2, 0x21030000, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0x0, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r1, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

[ 3268.676010] loop2: detected capacity change from 0 to 40
[ 3268.697902] loop4: detected capacity change from 0 to 40
00:26:19 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000440), 0xffffffffffffffff)
sendmsg$NL80211_CMD_ASSOCIATE(r0, 0x0, 0x20000000)
sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000640)=ANY=[@ANYBLOB="1c000000505a1e7a010d75f7304ba92e279c8d269704c79b79bc32b59357bee15379bf3efeccdb3d6ee9e2a3df04e6b1e28520eac9c84eefa0e1f274f54893a05a35461237fac7296f924857c24eec5a0e571be75463d67cb51f9209000000000000001cfa6c1b6d2c14907727030c234d09dc12fe6660bf6adc16d1af4c958d345e307e097e9b", @ANYRES16=r1, @ANYBLOB="010000000000000000007e00000008000300", @ANYRES32=0x0, @ANYBLOB], 0x1c}}, 0x0)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000440), 0xffffffffffffffff)
ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000700)={'wlan1\x00', <r4=>0x0})
sendmsg$NL80211_CMD_ASSOCIATE(r2, &(0x7f00000007c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000780)={&(0x7f0000000700)={0x50, r3, 0x4, 0x70bd29, 0x7, {{}, {@val={0x8, 0x3, r4}, @void}}, [@NL80211_ATTR_USE_MFP={0x8, 0x42, 0x1}, @NL80211_ATTR_PREV_BSSID={0xa, 0x4f, @random="890fa4764159"}, @crypto_settings=[@NL80211_ATTR_WPA_VERSIONS={0x8, 0x4b, 0x1}], @NL80211_ATTR_VHT_CAPABILITY={0x10, 0x9d, {0x2, {0x0, 0x3, 0x5, 0x200}}}, @NL80211_ATTR_USE_RRM={0x4}, @NL80211_ATTR_IE={0x4}]}, 0x50}, 0x1, 0x0, 0x0, 0x40}, 0x20000000)
sendmsg$NL80211_CMD_DEL_PMK(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000180)={0x64, r1, 0x2, 0x70bd29, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r4}, @void}}, [@NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_MAC={0xa}]}, 0x64}, 0x1, 0x0, 0x0, 0x40400}, 0x10800)
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r5 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r6 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
sendfile(r6, r5, 0x0, 0xfffffdef)

[ 3268.736609] loop6: detected capacity change from 0 to 40
[ 3268.740082] FAT-fs (loop6): Unrecognized mount option "�On���V�Å�Y��:돑�܄���|9�#S�m���Y%��?�}��i#�Huv���%�`a�k��s(*3�i�D�~M�v����36�" or missing value
00:26:19 executing program 3:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r0 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
connect$802154_dgram(r0, &(0x7f0000000180)={0x24, @short={0x2, 0x3, 0xaaa0}}, 0x14)

[ 3268.893391] loop3: detected capacity change from 0 to 40
[ 3268.899255] loop5: detected capacity change from 0 to 40
[ 3268.917748] FAT-fs (loop5): Unrecognized mount option "" or missing value
[ 3268.997356] loop5: detected capacity change from 0 to 40
00:26:35 executing program 4:
r0 = syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x410, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r1 = openat(r0, &(0x7f0000000000)='./file0\x00', 0x101042, 0x1e2)
syz_mount_image$tmpfs(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
ioctl$VFAT_IOCTL_READDIR_BOTH(r0, 0x82307201, &(0x7f0000000240)=[{0x0, 0x0, 0x100}, {0x0, 0x0, 0x100}])
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
ioctl$EXT4_IOC_SWAP_BOOT(r3, 0x6611)
mount$9p_fd(0x0, &(0x7f0000000040)='./file1\x00', &(0x7f00000000c0), 0x800000, &(0x7f0000000180)={'trans=fd,', {'rfdno', 0x3d, r3}, 0x2c, {'wfdno', 0x3d, r2}, 0x2c, {[{@cache_fscache}], [{@dont_measure}]}})
write$binfmt_aout(r2, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r2, r1, 0x0, 0xfffffdef)

00:26:35 executing program 2:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x410, 0x0)
chdir(&(0x7f0000000140)='./file0\x00')
openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
creat(&(0x7f0000000000)='./file1\x00', 0x100)

00:26:35 executing program 0:
perf_event_open(&(0x7f0000000080)={0x0, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, 0x0, 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r1, &(0x7f0000000100), 0x0, 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r0, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r2, 0x3f000000, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0x0, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r1, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:26:35 executing program 6:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r1, &(0x7f0000000040)=ANY=[], 0x220)
sendfile(r1, r0, 0x0, 0xfffffdef)

00:26:35 executing program 1:
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}}, 0x0, 0x6, 0xffffffffffffffff, 0xb)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
r1 = gettid()
rt_sigqueueinfo(0x0, 0x0, 0x0)
r2 = pidfd_getfd(0xffffffffffffffff, r0, 0x0)
perf_event_open(&(0x7f0000000040)={0x5, 0x80, 0x40, 0x71, 0x2, 0x0, 0x0, 0x8000, 0x20, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, @perf_config_ext={0xff}, 0x0, 0x9b5, 0xfa, 0xd, 0x0, 0x8000, 0x55, 0x0, 0x0, 0x0, 0x3ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000400)={0x2, 0x80, 0x2a, 0x81, 0xe0, 0x40, 0x0, 0x63c5ef1c, 0x80, 0x3, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x7, 0x2, @perf_config_ext={0xf2, 0x6}, 0x0, 0x5, 0xfffffff8, 0x0, 0x1, 0x0, 0x1b6, 0x0, 0x6}, 0x0, 0xd, 0xffffffffffffffff, 0x0)
rt_sigqueueinfo(0x0, 0x0, &(0x7f0000000000))
setsockopt$sock_timeval(r0, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10)
bind$packet(r2, &(0x7f00000000c0)={0x11, 0xfe, 0x0, 0x1, 0xfb, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}}, 0x14)
perf_event_open(&(0x7f0000000100)={0x0, 0x80, 0xff, 0x8, 0x4, 0x1, 0x0, 0x4, 0x684, 0x4, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0xdbc, 0x0, @perf_config_ext={0xd03, 0x80000000}, 0x800, 0x3, 0x3, 0x5, 0x300000000000000, 0x7, 0x7ff, 0x0, 0x0, 0x0, 0x5}, r1, 0x10, 0xffffffffffffffff, 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r3, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
openat(r3, &(0x7f0000000180)='\x00', 0x400040, 0x80)
rt_sigqueueinfo(0x0, 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r2, 0x89f0, 0x0)

00:26:35 executing program 7:
r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x80, 0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = signalfd4(r0, &(0x7f0000000000)={[0x6]}, 0x8, 0x800)
open_by_handle_at(0xffffffffffffffff, &(0x7f0000000240)=ANY=[@ANYBLOB="73ac99d1e17b71e714e4ffff0100001a684fd2981c8409820000080000000000000000"], 0x0)
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0xd}, 0x0, 0x8}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys\x00', 0x0, 0x0)
preadv(r2, &(0x7f0000000100)=[{&(0x7f0000002240)=""/4109, 0x100d}], 0x6f4, 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4042, 0x0)
fsetxattr$trusted_overlay_origin(r1, &(0x7f00000001c0), &(0x7f0000000200), 0x2, 0x3)
fallocate(r3, 0x0, 0x0, 0x87ffffc)
finit_module(0xffffffffffffffff, &(0x7f0000000180)='\x00', 0x2)
syz_io_uring_setup(0xfa7, &(0x7f0000000080), &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000000100), &(0x7f0000000000))
signalfd4(r2, &(0x7f0000000140)={[0x101]}, 0x8, 0x800)

00:26:35 executing program 3:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r0 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
connect$802154_dgram(r0, &(0x7f0000000180)={0x24, @short={0x2, 0x3, 0xaaa0}}, 0x14)

00:26:35 executing program 5:
r0 = syz_open_dev$tty1(0xc, 0x4, 0x1)
writev(r0, &(0x7f0000000000)=[{&(0x7f0000000140)="02b2dccad213e1e6cf54b7a797f8f22a47f25b7658fb110b2e76f95b0f318b8fa745e6ffba4414d29a42bfab524bc5bffb17decc4540a6f00b9772f5f9789a9525790df8d989b23530d0a1398f2ad734c7ff47961be476ffeec81efa3d3aa64b8ea329261dfc2e1047a68670f0e5950d6a5414956bddd09e101b5b66e5742fe843413e065e3b86a242b37bc58c68153a45015f6f1ea67762c302e461e0c84bbb7f8d464f5a72d9fad56dac0c5028a4012a93dbc7da640786e3c9898cdd8fe091b166bfcd66e6257abc923ceaf90e994deded3fe8a59c2105f5caf366d32170ef51299dbf441bc3cddda352a2e07375fb44e75fed8082f3e960015d9bcddb0c834feda68d113a9a9fc0d1c30153685caf43b176219b666d74e67b6192cfd8a561c6c4aadcc80ed8c469bc41b028f1db515d699e45ad3379f9b1edb8de4bb2f8615d6716297baac7e45073fcecf31e51ec78c40edd78f245bced04414f849fb961fbbe79ff2ed7c48ec1b5331f9755d7094986fc8da198ce4a12f9ddfb43e565bc4fed618da9a693d03c3e7ec4b3014dfc022103e277c1b12efb03ef8b197f3a931f6cbe238cf8a4e7639b409b4586f66da41b94eed69d52ba9fde5aa1ee774d4e626932dc3511b10ae3bc3e8688a7a83b0467dfbf92951747396735c9f47ad4552e7bdf4f8e7998a1266a360beb2ec1527390452139f9ab91ee250efcf3413e72a6b2688d8b6a4748ccc165bbf886573ccdd03bd93f32a866cd878ec246e06f31d4d7f7ec9836b7305ee0c1b9fa75cd6e4ca5cc2f107b654f15a2442cd9c8eaf581d093639fe35e0da49394c5ed66ad29bc2b863649e16c1951d0d3dd6f1048539e558ee1f059d91510a5acd84777ca01545635d2fb40e2f205bb11435023e47e4e2f85b6d1b56b688dd1a4304708a561d32dbaa6cd4f969e67af33773d4e9772751019dc6c2af7e2fe9d3c7eb6f1b401926603d90802f792b081957dd5ebd18410cd42b2ea05ae9a61254e4b878384b8a376fe9eba06afc1253f2224fab88feb7c426e3dfb19385afbb42cc13209b419568eeafdf505dc5ca30acc17d337e941e0badf9f9413f381fe9a315e2597426805827943f193f02a12554d434bd91708a28d9da1bf64ad64f80a7287d1e02d5d1f14bf9d89ba3badfa524694db6a651e97ea64104ad34942f36745259f4ec32fdce0bd13e693ccbe0e012e61a1fae9fc1662b99871e3812cea14d12646ccc08b0514762a475ecdbf9071377bb1ecd891c6fe32fde1d3044caf466b3a342b7541e8ed7432e94baf1d5546aff0e23f6a03c9ea5635519533e712639c27958e3a0f3684ed91cfb2e6e4", 0x3b8}], 0x1)
r1 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000500)="4dc3bd088f0cc664010004ffffff2d5b9fba0000020000000000", 0x1a}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000540)=ANY=[@ANYRESDEC, @ANYRESDEC])
chdir(&(0x7f0000000140)='./file0\x00')
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
setxattr$trusted_overlay_upper(&(0x7f00000000c0)='./file1\x00', &(0x7f0000000580), &(0x7f0000000740)=ANY=[@ANYBLOB="00fbce041b50b54cedb80d912d3b60e5c9f79d418931432947a2cf414d24af1f260a4ff603650cbb81bb563b5f8ccc8696d5eb74ae061c3d09d09adcfa04db4c3c71671afdb1033e24e033f3e67aa3dbf273dde8c39c5ee6a101c7972f33eb616133040676c0cbd078df56d05a4cb6b05107c26841853a159c8dc9a80b294b3105f5c0726776a806d881c614e18a58a81e4c63497d4f670e37c4e94fd192d483e1b1b784a3928ed8052331411f5235f90da7980418f17fdbceffea72fdf348363776b7919f17012dbe7c45a8d60b5e3ce3dc9c38a13eacdc810f36d829a1fc5adacd6fdb4bd51f888d705f07ad6b19ad14cfa4fdd6b38822d7d36878f51016190a4c6086fc8ebdd9db9ab47769692e7f6f9a7c5528788eed5f5579a7a4dbc474b2aa01ab691ee2b267ceba20249a2119943a741befb85bd24e4acc2d57bad0efff"], 0xce, 0x3)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r3 = openat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x10843, 0x106)
write$binfmt_aout(r1, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r3, r2, 0x0, 0xfffffdef)
ioctl$F2FS_IOC_START_VOLATILE_WRITE(r1, 0xf503, 0x0)

[ 3285.330718] loop6: detected capacity change from 0 to 40
[ 3285.334067] loop3: detected capacity change from 0 to 40
[ 3285.338035] loop2: detected capacity change from 0 to 40
[ 3285.349597] loop4: detected capacity change from 0 to 40
[ 3285.381605] loop5: detected capacity change from 0 to 40
[ 3285.392842] FAT-fs (loop5): Unrecognized mount option "1844674407370955161518446744073709551615" or missing value
[ 3285.406106] syz-executor.6: attempt to access beyond end of device
[ 3285.406106] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 3285.407032] Buffer I/O error on dev loop6, logical block 10, lost async page write
[ 3285.428911] loop5: detected capacity change from 0 to 40
[ 3285.437853] FAT-fs (loop5): Unrecognized mount option "1844674407370955161518446744073709551615" or missing value
00:26:36 executing program 3:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
r0 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
connect$802154_dgram(r0, &(0x7f0000000180)={0x24, @short={0x2, 0x3, 0xaaa0}}, 0x14)

00:26:36 executing program 6:
syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000400)=ANY=[@ANYRES16=0x0, @ANYRESHEX, @ANYBLOB="58cef06cd81769363a2f19703b83c8069ab2bd7a3fda4235d2fc928acc5e87a1e978659ad59fee0599cd7a41906da1907cc42025d07cdec9257b05e482ef01430000000000000004290fa94ff65732ad6ce9418aefd3beaf98a8e1fb5e4481c8d84275d71233c8cb8adfe0dc927dedb17ef5a07589f202c1224dcf063f0dcfa482ba082b7556ea074068c5d4f8d11c49ee9d1657e2dea5925916f14627b14a39303c669b33c0eff818e626e93380437dfd66cf659f030c73601059ec0beeb55ebe9a3ff4e9d89a52f2c580d9b782904c170351b17a7bfe86fb17c26b253f1a68cd448ca68d003f8af6884b40e4972df34b49cbbdb9269ff8575ee68beec7e5eda4743073479a74666b19ad9637deb940e2444ba409d6d793f1923b66edce070258d1b80a5c92f36a0cf106d71b3e93de84050714e9d9cab2bee925cd8afb9b68e6ec0a7b4053e9d0f0725be97e0deb5fc95a2b2f956a7eb8cfbe0d78e1f0ead1cfbbc85709955adbea5a587a2625198a3991f364f1ecaad337d0a45c67004ffd81a913073aee7602b675b1aa"])
ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000300)=<r0=>0x0)
perf_event_open(&(0x7f0000000180)={0x4, 0x80, 0x6, 0x1f, 0x4, 0x6, 0x0, 0x3, 0x2, 0x4, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c6e8467, 0x0, @perf_bp={&(0x7f00000000c0), 0x4}, 0x128, 0x6753, 0x40, 0x2, 0xc7c0, 0xfffffe00, 0x3e9b, 0x0, 0x1, 0x0, 0x3}, r0, 0x5, 0xffffffffffffffff, 0x8)
chdir(&(0x7f0000000140)='./file0\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r2, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
openat(r2, &(0x7f0000000040)='./file0\x00', 0x2200, 0x45)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r3, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
connect$802154_dgram(r3, &(0x7f0000000240)={0x24, @long={0x3, 0x1}}, 0x14)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r4, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r4, r1, 0x0, 0xfffffdef)

00:26:36 executing program 2:
syz_mount_image$vfat(&(0x7f0000000080), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="04000000646f7366d8a02b00080101000440002000f801", 0x17}, {0x0, 0x0, 0x2800}], 0x410, 0x0)
chdir(&(0x7f0000000140)='./file0\x00')
openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
creat(&(0x7f0000000000)='./file1\x00', 0x100)

[ 3285.537983] loop3: detected capacity change from 0 to 40
00:26:36 executing program 5:
r0 = syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f7366d8a02b00080101000440002034f801", 0x17}, {0x0, 0x0, 0x2800}], 0x0, &(0x7f0000000140)=ANY=[])
chdir(&(0x7f0000000140)='./file0\x00')
mknod$loop(&(0x7f00000000c0)='./file0\x00', 0x2, 0x0)
r1 = openat(r0, &(0x7f0000000100)='./file0\x00', 0x64042, 0x70)
syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r2, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
openat(r2, &(0x7f0000000040)='./file2\x00', 0x400, 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x101042, 0x0)
write$binfmt_aout(r3, &(0x7f0000001180)=ANY=[], 0x220)
sendfile(r3, r1, 0x0, 0xfffffdef)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
openat(0xffffffffffffffff, &(0x7f00000001c0)='./file0\x00', 0x702, 0x88)
pwritev(r4, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
openat(r4, &(0x7f0000000180)='./file2\x00', 0xa0000, 0x108)

00:26:36 executing program 1:
perf_event_open(&(0x7f0000000280)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}}, 0x0, 0x6, 0xffffffffffffffff, 0xb)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
r1 = gettid()
rt_sigqueueinfo(0x0, 0x0, 0x0)
r2 = pidfd_getfd(0xffffffffffffffff, r0, 0x0)
perf_event_open(&(0x7f0000000040)={0x5, 0x80, 0x40, 0x71, 0x2, 0x0, 0x0, 0x8000, 0x20, 0x9, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, @perf_config_ext={0xff}, 0x0, 0x9b5, 0xfa, 0xd, 0x0, 0x8000, 0x55, 0x0, 0x0, 0x0, 0x3ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000000400)={0x2, 0x80, 0x2a, 0x81, 0xe0, 0x40, 0x0, 0x63c5ef1c, 0x80, 0x3, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x7, 0x2, @perf_config_ext={0xf2, 0x6}, 0x0, 0x5, 0xfffffff8, 0x0, 0x1, 0x0, 0x1b6, 0x0, 0x6}, 0x0, 0xd, 0xffffffffffffffff, 0x0)
rt_sigqueueinfo(0x0, 0x0, &(0x7f0000000000))
setsockopt$sock_timeval(r0, 0x1, 0x49, &(0x7f0000000000)={0x77359400}, 0x10)
bind$packet(r2, &(0x7f00000000c0)={0x11, 0xfe, 0x0, 0x1, 0xfb, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}}, 0x14)
perf_event_open(&(0x7f0000000100)={0x0, 0x80, 0xff, 0x8, 0x4, 0x1, 0x0, 0x4, 0x684, 0x4, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0xdbc, 0x0, @perf_config_ext={0xd03, 0x80000000}, 0x800, 0x3, 0x3, 0x5, 0x300000000000000, 0x7, 0x7ff, 0x0, 0x0, 0x0, 0x5}, r1, 0x10, 0xffffffffffffffff, 0x2)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x141042, 0x0)
pwritev(r3, &(0x7f0000000140)=[{&(0x7f0000000000)='P', 0x1}], 0x1, 0x0, 0x0)
openat(r3, &(0x7f0000000180)='\x00', 0x400040, 0x80)
rt_sigqueueinfo(0x0, 0x0, 0x0)
ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r2, 0x89f0, 0x0)

[ 3285.622519] loop6: detected capacity change from 0 to 40
[ 3285.640567] loop2: detected capacity change from 0 to 40
[ 3285.686018] syz-executor.6: attempt to access beyond end of device
[ 3285.686018] loop6: rw=2049, sector=40, nr_sectors = 4 limit=40
[ 3285.687281] Buffer I/O error on dev loop6, logical block 10, lost async page write
[ 3285.726710] loop5: detected capacity change from 0 to 40

VM DIAGNOSIS:
00:31:46  Registers:
info registers vcpu 0
RAX=ffffffff8441dde0 RBX=ffffffff854328c0 RCX=ffffffff843fe862 RDX=0000000000000000
RSI=0000000000000001 RDI=0000000000000000 RBP=0000000000000000 RSP=ffffffff85407e20
R8 =0000000000000001 R9 =ffff88806ce34f03 R10=ffffed100d9c69e0 R11=0000000000000001
R12=fffffbfff0a86518 R13=ffffffff85d07c90 R14=0000000000000000 R15=dffffc0000000000
RIP=ffffffff8441ddef RFL=00000202 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=1
ES =0000 0000000000000000 00000000 00000000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS   [-WA]
DS =0000 0000000000000000 00000000 00000000
FS =0000 0000000000000000 00000000 00000000
GS =0000 ffff88806ce00000 00000000 00000000
LDT=0000 fffffe0000000000 00000000 00000000
TR =0040 fffffe29ef2e1000 00004087 00008b00 DPL=0 TSS64-busy
GDT=     fffffe29ef2df000 0000007f
IDT=     fffffe0000000000 00000fff
CR0=80050033 CR2=000055907eee5628 CR3=000000000dbcc000 CR4=00350ef0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 
DR6=00000000ffff0ff0 DR7=0000000000000600
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001fa0
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=c724f50000000000 401d FPR7=8000000000000000 4001
XMM00=00000000000000000000000000000000 XMM01=8a6a2ed16eda5a5212747df37ae9a8d5
XMM02=64fb101631b4ac1af8d1fec2e739d28f XMM03=eb1f60d3cefb7940229946ee9a1fef16
XMM04=000000c0003d99f8000000c0003d99c0 XMM05=000000c0003d9a68000000c0003d9a30
XMM06=000000c0003d9ad8000000c0003d9aa0 XMM07=000000c0003d9b48000000c0003d9b10
XMM08=202c2930633130303030303030663778 XMM09=30202c307830202c307830202c307830
XMM10=66666666666666666666666666666678 XMM11=6637783028262833656e6f6c630a2966
XMM12=3078307b3d2930343630303030303030 XMM13=2c307830202c307830202c307830202c
XMM14=30202c307830202c307830202c7d7b20 XMM15=0a2938357830202c7d307830202c3078
info registers vcpu 1
RAX=ffffffff8441dde0 RBX=ffff888008e4d040 RCX=ffffffff843fe862 RDX=0000000000000000
RSI=0000000000000001 RDI=0000000000000000 RBP=0000000000000001 RSP=ffff888008ebfe58
R8 =0000000000000001 R9 =ffff88806cf34f03 R10=ffffed100d9e69e0 R11=0000000000000001
R12=ffffed10011c9a08 R13=ffffffff85d07c90 R14=0000000000000000 R15=dffffc0000000000
RIP=ffffffff8441ddef RFL=00000202 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=1
ES =0000 0000000000000000 00000000 00000000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS   [-WA]
DS =0000 0000000000000000 00000000 00000000
FS =0000 0000000000000000 00000000 00000000
GS =0000 ffff88806cf00000 00000000 00000000
LDT=0000 fffffe0000000000 00000000 00000000
TR =0040 fffffe4964384000 00004087 00008b00 DPL=0 TSS64-busy
GDT=     fffffe4964382000 0000007f
IDT=     fffffe0000000000 00000fff
CR0=80050033 CR2=00007f708850f010 CR3=000000000dbcc000 CR4=00350ee0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 
DR6=00000000ffff0ff0 DR7=0000000000000600
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001fa0
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=00000000000000000000000000000000 XMM01=00000000000000000000000000000000
XMM02=00000000000000004184c2fe80000000 XMM03=0000ff00000000000000000000000000
XMM04=732f6c61636f6c2f7273752f3d485441 XMM05=622f6c61636f6c2f7273752f3a6e6962
XMM06=73752f3a6e6962732f7273752f3a6e69 XMM07=6e69622f3a6e6962732f3a6e69622f72
XMM08=00000000000000000000000000000000 XMM09=00000000000000000000000000000000
XMM10=00000000000000000000000000000000 XMM11=00000000000000000000000000000000
XMM12=00000000000000000000000000000000 XMM13=00000000000000000000000000000000
XMM14=00000000000000000000000000000000 XMM15=00000000000000000000000000000000