0), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x50}}], 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {}, {0x0, 0x0, 0xffffff7f}, 0x0, 0x0, 0xa}, [@algo_auth={0x58, 0x1, {{'md5\x00'}, 0x80, "f959fb7b2a535a87359f0b633f54f881"}}]}, 0x148}}, 0x0) [ 468.898064][T24674] netlink: 224 bytes leftover after parsing attributes in process `syz-executor.4'. [ 468.920136][ C1] sd 0:0:1:0: [sg_rq_end_io] Sense Key : Illegal Request [current] [ 468.928158][ C1] sd 0:0:1:0: [sg_rq_end_io] Add. Sense: Invalid command operation code [ 469.088840][T24687] loop2: detected capacity change from 0 to 16383 [ 469.146165][T24687] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 469.151488][T24687] loop2: p1 size 11290111 extends beyond EOD, truncated [ 469.159166][T24687] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 469.167124][T24687] loop2: p5 size 11290111 extends beyond EOD, truncated [ 469.174350][T24687] loop2: p6 size 1912633224 extends beyond EOD, truncated [ 469.265846][T24687] loop2: detected capacity change from 0 to 16383 09:53:27 executing program 2: syz_read_part_table(0x0, 0x2, &(0x7f0000000100)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0000ffffff85000000060000000000024000ffffff82060400e100000088770072003007000f00000000000000008000da55aa", 0x40, 0x1c0}, {0x0, 0x0, 0xfffffffffffffffb}]) 09:53:27 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0xc}}}, 0xf0}}, 0x0) 09:53:27 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x6, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd}) 09:53:27 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) mkdirat(r1, &(0x7f00000000c0)='./file0\x00', 0x0) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r3 = syz_io_uring_setup(0x3ede, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000140)) io_uring_enter(r3, 0x2ff, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x5, 0x0, &(0x7f0000000040)=""/18, 0xffffffde}, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, &(0x7f0000000dc0)=[{&(0x7f0000000100)="f4a4848461fb0592d2f8db4c1f3c9e408788e03d28fe5e69dbceea46dd67888cdedd07a068040b956c3af7", 0x2b}, {0x0}, {0x0}], 0x3, &(0x7f0000000540)=ANY=[@ANYBLOB="1400000000000000", @ANYRES32], 0x50}}, {{0x0, 0x0, &(0x7f0000003180)=[{0x0}, {0x0}], 0x2, &(0x7f00000002c0)=ANY=[@ANYBLOB="c9252cdfb191d94ef15953a086ed40b24a018fb18d39f9a1256b33cf339f1d1bb52846ddaaaecd492eb1d0774b26968a44bf794e9d902a3c02af9543bc4096ac7a27", @ANYRES32, @ANYRES32=0x0], 0x50, 0x4041}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYRESDEC, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000003000000000000000010000000100", @ANYRES32, @ANYRES64, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESDEC=r4], 0xd0, 0x20000000}}], 0x3, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x138, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {0xffffff7f}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x48, 0x1, {{'md5\x00'}}}]}, 0x138}}, 0x0) 09:53:27 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="5560000018007f083ffe15b282a380930a03000248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) 09:53:27 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x9, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000e80)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) io_uring_enter(r1, 0x0, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x50}}], 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {}, {0x0, 0x0, 0xffffff9e}, 0x0, 0x0, 0xa}, [@algo_auth={0x58, 0x1, {{'md5\x00'}, 0x80, "f959fb7b2a535a87359f0b633f54f881"}}]}, 0x148}}, 0x0) [ 469.331794][T24687] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 469.337055][T24687] loop2: p1 size 11290111 extends beyond EOD, truncated [ 469.344825][T24687] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 469.352671][T24687] loop2: p5 size 11290111 extends beyond EOD, truncated [ 469.359914][T24687] loop2: p6 size 1912633224 extends beyond EOD, truncated 09:53:27 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x9, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000e80)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) io_uring_enter(r1, 0x0, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x50}}], 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {}, {0x0, 0x0, 0xffffffea}, 0x0, 0x0, 0xa}, [@algo_auth={0x58, 0x1, {{'md5\x00'}, 0x80, "f959fb7b2a535a87359f0b633f54f881"}}]}, 0x148}}, 0x0) 09:53:27 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x6, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe}) 09:53:27 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) mkdirat(r1, &(0x7f00000000c0)='./file0\x00', 0x0) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r3 = syz_io_uring_setup(0x3ede, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000140)) io_uring_enter(r3, 0x2ff, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x5, 0x0, &(0x7f0000000040)=""/18, 0xffffffde}, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, &(0x7f0000000dc0)=[{&(0x7f0000000100)="f4a4848461fb0592d2f8db4c1f3c9e408788e03d28fe5e69dbceea46dd67888cdedd07a068040b956c3af7", 0x2b}, {0x0}, {0x0}], 0x3, &(0x7f0000000540)=ANY=[@ANYBLOB="1400000000000000", @ANYRES32], 0x50}}, {{0x0, 0x0, &(0x7f0000003180)=[{0x0}, {0x0}], 0x2, &(0x7f00000002c0)=ANY=[@ANYBLOB="c9252cdfb191d94ef15953a086ed40b24a018fb18d39f9a1256b33cf339f1d1bb52846ddaaaecd492eb1d0774b26968a44bf794e9d902a3c02af9543bc4096ac7a27", @ANYRES32, @ANYRES32=0x0], 0x50, 0x4041}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYRESDEC, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000003000000000000000010000000100", @ANYRES32, @ANYRES64, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESDEC=r4], 0xd0, 0x20000000}}], 0x3, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x138, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {0xffffff9e}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x48, 0x1, {{'md5\x00'}}}]}, 0x138}}, 0x0) 09:53:27 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="5568000018007f083ffe15b282a380930a03000248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) 09:53:27 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0xd}}}, 0xf0}}, 0x0) [ 469.425753][ C1] sd 0:0:1:0: [sg_rq_end_io] Sense Key : Illegal Request [current] [ 469.433758][ C1] sd 0:0:1:0: [sg_rq_end_io] Add. Sense: Invalid command operation code [ 469.449174][T24694] netlink: 224 bytes leftover after parsing attributes in process `syz-executor.4'. 09:53:27 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x9, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000e80)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) io_uring_enter(r1, 0x0, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x50}}], 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {}, {0x0, 0x0, 0xffffffef}, 0x0, 0x0, 0xa}, [@algo_auth={0x58, 0x1, {{'md5\x00'}, 0x80, "f959fb7b2a535a87359f0b633f54f881"}}]}, 0x148}}, 0x0) [ 469.574603][ C1] sd 0:0:1:0: [sg_rq_end_io] Sense Key : Illegal Request [current] [ 469.582647][ C1] sd 0:0:1:0: [sg_rq_end_io] Add. Sense: Invalid command operation code [ 469.622942][T24714] netlink: 224 bytes leftover after parsing attributes in process `syz-executor.4'. [ 469.692808][T24717] loop2: detected capacity change from 0 to 16383 [ 469.733660][ T5592] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 469.739017][ T5592] loop2: p1 size 11290111 extends beyond EOD, truncated [ 469.747201][ T5592] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 469.755078][ T5592] loop2: p5 size 11290111 extends beyond EOD, truncated [ 469.762695][ T5592] loop2: p6 size 1912633224 extends beyond EOD, truncated [ 469.772576][T24717] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 469.777913][T24717] loop2: p1 size 11290111 extends beyond EOD, truncated [ 469.785801][T24717] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 469.793672][T24717] loop2: p5 size 11290111 extends beyond EOD, truncated [ 469.800920][T24717] loop2: p6 size 1912633224 extends beyond EOD, truncated 09:53:28 executing program 2: syz_read_part_table(0x0, 0x2, &(0x7f0000000100)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0000ffffff85000000060000000000024000ffffff82000500e100000088770072003007000f00000000000000008000da55aa", 0x40, 0x1c0}, {0x0, 0x0, 0xfffffffffffffffb}]) 09:53:28 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x6, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10}) 09:53:28 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="556c000018007f083ffe15b282a380930a03000248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) 09:53:28 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) mkdirat(r1, &(0x7f00000000c0)='./file0\x00', 0x0) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r3 = syz_io_uring_setup(0x3ede, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000140)) io_uring_enter(r3, 0x2ff, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x5, 0x0, &(0x7f0000000040)=""/18, 0xffffffde}, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, &(0x7f0000000dc0)=[{&(0x7f0000000100)="f4a4848461fb0592d2f8db4c1f3c9e408788e03d28fe5e69dbceea46dd67888cdedd07a068040b956c3af7", 0x2b}, {0x0}, {0x0}], 0x3, &(0x7f0000000540)=ANY=[@ANYBLOB="1400000000000000", @ANYRES32], 0x50}}, {{0x0, 0x0, &(0x7f0000003180)=[{0x0}, {0x0}], 0x2, &(0x7f00000002c0)=ANY=[@ANYBLOB="c9252cdfb191d94ef15953a086ed40b24a018fb18d39f9a1256b33cf339f1d1bb52846ddaaaecd492eb1d0774b26968a44bf794e9d902a3c02af9543bc4096ac7a27", @ANYRES32, @ANYRES32=0x0], 0x50, 0x4041}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYRESDEC, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000003000000000000000010000000100", @ANYRES32, @ANYRES64, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESDEC=r4], 0xd0, 0x20000000}}], 0x3, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x138, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {0xffffffea}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x48, 0x1, {{'md5\x00'}}}]}, 0x138}}, 0x0) 09:53:28 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0xe}}}, 0xf0}}, 0x0) 09:53:28 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x9, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000e80)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) io_uring_enter(r1, 0x0, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x50}}], 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {}, {0x0, 0x0, 0xfffffff0}, 0x0, 0x0, 0xa}, [@algo_auth={0x58, 0x1, {{'md5\x00'}, 0x80, "f959fb7b2a535a87359f0b633f54f881"}}]}, 0x148}}, 0x0) 09:53:28 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0x10}}}, 0xf0}}, 0x0) 09:53:28 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x6, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18}) 09:53:28 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="5574000018007f083ffe15b282a380930a03000248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) 09:53:28 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x9, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000e80)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) io_uring_enter(r1, 0x0, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x50}}], 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {}, {0x0, 0x0, 0xfffffffc}, 0x0, 0x0, 0xa}, [@algo_auth={0x58, 0x1, {{'md5\x00'}, 0x80, "f959fb7b2a535a87359f0b633f54f881"}}]}, 0x148}}, 0x0) 09:53:28 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) mkdirat(r1, &(0x7f00000000c0)='./file0\x00', 0x0) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r3 = syz_io_uring_setup(0x3ede, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000140)) io_uring_enter(r3, 0x2ff, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x5, 0x0, &(0x7f0000000040)=""/18, 0xffffffde}, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, &(0x7f0000000dc0)=[{&(0x7f0000000100)="f4a4848461fb0592d2f8db4c1f3c9e408788e03d28fe5e69dbceea46dd67888cdedd07a068040b956c3af7", 0x2b}, {0x0}, {0x0}], 0x3, &(0x7f0000000540)=ANY=[@ANYBLOB="1400000000000000", @ANYRES32], 0x50}}, {{0x0, 0x0, &(0x7f0000003180)=[{0x0}, {0x0}], 0x2, &(0x7f00000002c0)=ANY=[@ANYBLOB="c9252cdfb191d94ef15953a086ed40b24a018fb18d39f9a1256b33cf339f1d1bb52846ddaaaecd492eb1d0774b26968a44bf794e9d902a3c02af9543bc4096ac7a27", @ANYRES32, @ANYRES32=0x0], 0x50, 0x4041}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYRESDEC, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000003000000000000000010000000100", @ANYRES32, @ANYRES64, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESDEC=r4], 0xd0, 0x20000000}}], 0x3, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x138, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {0xffffffef}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x48, 0x1, {{'md5\x00'}}}]}, 0x138}}, 0x0) [ 469.887671][T24726] netlink: 224 bytes leftover after parsing attributes in process `syz-executor.4'. [ 469.893558][ C1] sd 0:0:1:0: [sg_rq_end_io] Sense Key : Illegal Request [current] [ 469.905043][ C1] sd 0:0:1:0: [sg_rq_end_io] Add. Sense: Invalid command operation code 09:53:28 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0x11}}}, 0xf0}}, 0x0) [ 470.050564][ C1] sd 0:0:1:0: [sg_rq_end_io] Sense Key : Illegal Request [current] [ 470.051222][T24740] netlink: 224 bytes leftover after parsing attributes in process `syz-executor.4'. [ 470.058589][ C1] sd 0:0:1:0: [sg_rq_end_io] Add. Sense: Invalid command operation code [ 470.088902][T24742] loop2: detected capacity change from 0 to 16383 [ 470.146178][T24742] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 470.151441][T24742] loop2: p1 size 11290111 extends beyond EOD, truncated [ 470.159555][T24742] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 470.167649][T24742] loop2: p5 size 11290111 extends beyond EOD, truncated [ 470.174945][T24742] loop2: p6 size 1912633224 extends beyond EOD, truncated [ 470.232680][T24748] netlink: 224 bytes leftover after parsing attributes in process `syz-executor.4'. [ 470.305790][T24742] loop2: detected capacity change from 0 to 16383 [ 470.372569][ T5592] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 470.377833][ T5592] loop2: p1 size 11290111 extends beyond EOD, truncated [ 470.385521][ T5592] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 470.393169][ T5592] loop2: p5 size 11290111 extends beyond EOD, truncated [ 470.400657][ T5592] loop2: p6 size 1912633224 extends beyond EOD, truncated [ 470.411137][T24742] loop2: p1 p2 < > p3 p4 < p5 p6 > 09:53:28 executing program 2: syz_read_part_table(0x0, 0x2, &(0x7f0000000100)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0000ffffff85000000060000000000024000ffffff82000600e100000088770072003007000f00000000000000008000da55aa", 0x40, 0x1c0}, {0x0, 0x0, 0xfffffffffffffffb}]) 09:53:28 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="557a000018007f083ffe15b282a380930a03000248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) 09:53:28 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x6, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e", 0x0, 0x0, 0x0, 0x0, 0x0}) 09:53:28 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x9, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000e80)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) io_uring_enter(r1, 0x0, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x50}}], 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {}, {0x0, 0x0, 0xfffffffe}, 0x0, 0x0, 0xa}, [@algo_auth={0x58, 0x1, {{'md5\x00'}, 0x80, "f959fb7b2a535a87359f0b633f54f881"}}]}, 0x148}}, 0x0) 09:53:28 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) mkdirat(r1, &(0x7f00000000c0)='./file0\x00', 0x0) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r3 = syz_io_uring_setup(0x3ede, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000140)) io_uring_enter(r3, 0x2ff, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x5, 0x0, &(0x7f0000000040)=""/18, 0xffffffde}, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, &(0x7f0000000dc0)=[{&(0x7f0000000100)="f4a4848461fb0592d2f8db4c1f3c9e408788e03d28fe5e69dbceea46dd67888cdedd07a068040b956c3af7", 0x2b}, {0x0}, {0x0}], 0x3, &(0x7f0000000540)=ANY=[@ANYBLOB="1400000000000000", @ANYRES32], 0x50}}, {{0x0, 0x0, &(0x7f0000003180)=[{0x0}, {0x0}], 0x2, &(0x7f00000002c0)=ANY=[@ANYBLOB="c9252cdfb191d94ef15953a086ed40b24a018fb18d39f9a1256b33cf339f1d1bb52846ddaaaecd492eb1d0774b26968a44bf794e9d902a3c02af9543bc4096ac7a27", @ANYRES32, @ANYRES32=0x0], 0x50, 0x4041}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYRESDEC, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000003000000000000000010000000100", @ANYRES32, @ANYRES64, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESDEC=r4], 0xd0, 0x20000000}}], 0x3, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x138, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {0xfffffff0}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x48, 0x1, {{'md5\x00'}}}]}, 0x138}}, 0x0) 09:53:28 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0x12}}}, 0xf0}}, 0x0) [ 470.416492][T24742] loop2: p1 size 11290111 extends beyond EOD, truncated [ 470.424172][T24742] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 470.432100][T24742] loop2: p5 size 11290111 extends beyond EOD, truncated [ 470.439517][T24742] loop2: p6 size 1912633224 extends beyond EOD, truncated 09:53:28 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="55fc000018007f083ffe15b282a380930a03000248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) 09:53:28 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x6, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) 09:53:28 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0x25}}}, 0xf0}}, 0x0) 09:53:28 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x9, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000e80)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) io_uring_enter(r1, 0x0, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x50}}], 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x58, 0x1, {{'md5\x00'}, 0x80, "f959fb7b2a535a87359f0b633f54f881"}}]}, 0x148}}, 0x0) 09:53:28 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) mkdirat(r1, &(0x7f00000000c0)='./file0\x00', 0x0) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r3 = syz_io_uring_setup(0x3ede, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000140)) io_uring_enter(r3, 0x2ff, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x5, 0x0, &(0x7f0000000040)=""/18, 0xffffffde}, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, &(0x7f0000000dc0)=[{&(0x7f0000000100)="f4a4848461fb0592d2f8db4c1f3c9e408788e03d28fe5e69dbceea46dd67888cdedd07a068040b956c3af7", 0x2b}, {0x0}, {0x0}], 0x3, &(0x7f0000000540)=ANY=[@ANYBLOB="1400000000000000", @ANYRES32], 0x50}}, {{0x0, 0x0, &(0x7f0000003180)=[{0x0}, {0x0}], 0x2, &(0x7f00000002c0)=ANY=[@ANYBLOB="c9252cdfb191d94ef15953a086ed40b24a018fb18d39f9a1256b33cf339f1d1bb52846ddaaaecd492eb1d0774b26968a44bf794e9d902a3c02af9543bc4096ac7a27", @ANYRES32, @ANYRES32=0x0], 0x50, 0x4041}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYRESDEC, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000003000000000000000010000000100", @ANYRES32, @ANYRES64, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESDEC=r4], 0xd0, 0x20000000}}], 0x3, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x138, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {0xfffffffc}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x48, 0x1, {{'md5\x00'}}}]}, 0x138}}, 0x0) [ 470.497809][ C1] sd 0:0:1:0: [sg_rq_end_io] Sense Key : Illegal Request [current] [ 470.505847][ C1] sd 0:0:1:0: [sg_rq_end_io] Add. Sense: Invalid command operation code [ 470.517012][T24758] netlink: 224 bytes leftover after parsing attributes in process `syz-executor.4'. 09:53:29 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="55a6010018007f083ffe15b282a380930a03000248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) [ 470.697665][ C1] sd 0:0:1:0: [sg_rq_end_io] Sense Key : Illegal Request [current] [ 470.705708][ C1] sd 0:0:1:0: [sg_rq_end_io] Add. Sense: Invalid command operation code [ 470.719051][T24769] netlink: 224 bytes leftover after parsing attributes in process `syz-executor.4'. [ 470.839345][T24778] loop2: detected capacity change from 0 to 16383 [ 470.908507][T24778] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 470.913810][T24778] loop2: p1 size 11290111 extends beyond EOD, truncated [ 470.921650][T24778] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 470.929476][T24778] loop2: p5 size 11290111 extends beyond EOD, truncated [ 470.936860][T24778] loop2: p6 size 1912633224 extends beyond EOD, truncated [ 471.029142][T24778] loop2: detected capacity change from 0 to 16383 [ 471.094015][T24778] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 471.099279][T24778] loop2: p1 size 11290111 extends beyond EOD, truncated [ 471.107019][T24778] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 471.114897][T24778] loop2: p5 size 11290111 extends beyond EOD, truncated [ 471.122167][T24778] loop2: p6 size 1912633224 extends beyond EOD, truncated 09:53:29 executing program 2: syz_read_part_table(0x0, 0x2, &(0x7f0000000100)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0000ffffff85000000060000000000024000ffffff82040600e100000088770072003007000f00000000000000008000da55aa", 0x40, 0x1c0}, {0x0, 0x0, 0xfffffffffffffffb}]) 09:53:29 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x6, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}) 09:53:29 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0x33}}}, 0xf0}}, 0x0) 09:53:29 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x9, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000e80)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) io_uring_enter(r1, 0x0, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x50}}], 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {}, {}, 0x2, 0x0, 0xa}, [@algo_auth={0x58, 0x1, {{'md5\x00'}, 0x80, "f959fb7b2a535a87359f0b633f54f881"}}]}, 0x148}}, 0x0) 09:53:29 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) mkdirat(r1, &(0x7f00000000c0)='./file0\x00', 0x0) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r3 = syz_io_uring_setup(0x3ede, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000140)) io_uring_enter(r3, 0x2ff, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x5, 0x0, &(0x7f0000000040)=""/18, 0xffffffde}, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, &(0x7f0000000dc0)=[{&(0x7f0000000100)="f4a4848461fb0592d2f8db4c1f3c9e408788e03d28fe5e69dbceea46dd67888cdedd07a068040b956c3af7", 0x2b}, {0x0}, {0x0}], 0x3, &(0x7f0000000540)=ANY=[@ANYBLOB="1400000000000000", @ANYRES32], 0x50}}, {{0x0, 0x0, &(0x7f0000003180)=[{0x0}, {0x0}], 0x2, &(0x7f00000002c0)=ANY=[@ANYBLOB="c9252cdfb191d94ef15953a086ed40b24a018fb18d39f9a1256b33cf339f1d1bb52846ddaaaecd492eb1d0774b26968a44bf794e9d902a3c02af9543bc4096ac7a27", @ANYRES32, @ANYRES32=0x0], 0x50, 0x4041}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYRESDEC, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000003000000000000000010000000100", @ANYRES32, @ANYRES64, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESDEC=r4], 0xd0, 0x20000000}}], 0x3, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x138, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {0xfffffffe}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x48, 0x1, {{'md5\x00'}}}]}, 0x138}}, 0x0) 09:53:29 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="55aa010018007f083ffe15b282a380930a03000248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) 09:53:29 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x6, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}) 09:53:29 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="5554020018007f083ffe15b282a380930a03000248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) 09:53:29 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x9, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000e80)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) io_uring_enter(r1, 0x0, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x50}}], 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {}, {}, 0x3, 0x0, 0xa}, [@algo_auth={0x58, 0x1, {{'md5\x00'}, 0x80, "f959fb7b2a535a87359f0b633f54f881"}}]}, 0x148}}, 0x0) 09:53:29 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) mkdirat(r1, &(0x7f00000000c0)='./file0\x00', 0x0) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r3 = syz_io_uring_setup(0x3ede, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000140)) io_uring_enter(r3, 0x2ff, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x5, 0x0, &(0x7f0000000040)=""/18, 0xffffffde}, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, &(0x7f0000000dc0)=[{&(0x7f0000000100)="f4a4848461fb0592d2f8db4c1f3c9e408788e03d28fe5e69dbceea46dd67888cdedd07a068040b956c3af7", 0x2b}, {0x0}, {0x0}], 0x3, &(0x7f0000000540)=ANY=[@ANYBLOB="1400000000000000", @ANYRES32], 0x50}}, {{0x0, 0x0, &(0x7f0000003180)=[{0x0}, {0x0}], 0x2, &(0x7f00000002c0)=ANY=[@ANYBLOB="c9252cdfb191d94ef15953a086ed40b24a018fb18d39f9a1256b33cf339f1d1bb52846ddaaaecd492eb1d0774b26968a44bf794e9d902a3c02af9543bc4096ac7a27", @ANYRES32, @ANYRES32=0x0], 0x50, 0x4041}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYRESDEC, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000003000000000000000010000000100", @ANYRES32, @ANYRES64, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESDEC=r4], 0xd0, 0x20000000}}], 0x3, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x138, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {0x21028ec53e}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x48, 0x1, {{'md5\x00'}}}]}, 0x138}}, 0x0) 09:53:29 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0x48}}}, 0xf0}}, 0x0) [ 471.220736][ C1] sd 0:0:1:0: [sg_rq_end_io] Sense Key : Illegal Request [current] [ 471.228737][ C1] sd 0:0:1:0: [sg_rq_end_io] Add. Sense: Invalid command operation code [ 471.248902][T24787] netlink: 224 bytes leftover after parsing attributes in process `syz-executor.4'. 09:53:29 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="5558020018007f083ffe15b282a380930a03000248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) [ 471.391959][ C1] sd 0:0:1:0: [sg_rq_end_io] Sense Key : Illegal Request [current] [ 471.400041][ C1] sd 0:0:1:0: [sg_rq_end_io] Add. Sense: Invalid command operation code [ 471.447937][ T5428] udevd[5428]: inotify_add_watch(7, /dev/loop2p2, 10) failed: No such file or directory [ 471.456479][ T5592] udevd[5592]: inotify_add_watch(7, /dev/loop2p1, 10) failed: No such file or directory [ 471.459051][T13989] udevd[13989]: inotify_add_watch(7, /dev/loop2p3, 10) failed: No such file or directory [ 471.469594][T16174] udevd[16174]: inotify_add_watch(7, /dev/loop2p4, 10) failed: No such file or directory [ 471.478464][ T5552] udevd[5552]: inotify_add_watch(7, /dev/loop2p5, 10) failed: No such file or directory [ 471.491725][ T5551] udevd[5551]: inotify_add_watch(7, /dev/loop2p6, 10) failed: No such file or directory [ 471.513562][ T5428] udevd[5428]: inotify_add_watch(7, /dev/loop2p2, 10) failed: No such file or directory [ 471.518969][ T5552] udevd[5552]: inotify_add_watch(7, /dev/loop2p5, 10) failed: No such file or directory [ 471.524343][T13989] udevd[13989]: inotify_add_watch(7, /dev/loop2p3, 10) failed: No such file or directory [ 471.534180][T16174] udevd[16174]: inotify_add_watch(7, /dev/loop2p4, 10) failed: No such file or directory [ 471.580113][T24807] loop2: detected capacity change from 0 to 16383 [ 471.629891][ T5592] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 471.635184][ T5592] loop2: p1 size 11290111 extends beyond EOD, truncated [ 471.642855][ T5592] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 471.650952][ T5592] loop2: p5 size 11290111 extends beyond EOD, truncated [ 471.658718][ T5592] loop2: p6 size 1912633224 extends beyond EOD, truncated [ 471.669165][T24807] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 471.674412][T24807] loop2: p1 size 11290111 extends beyond EOD, truncated [ 471.682141][T24807] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 471.690137][T24807] loop2: p5 size 11290111 extends beyond EOD, truncated [ 471.697744][T24807] loop2: p6 size 1912633224 extends beyond EOD, truncated 09:53:30 executing program 2: syz_read_part_table(0x0, 0x2, &(0x7f0000000100)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0000ffffff85000000060000000000024000ffffff82000700e100000088770072003007000f00000000000000008000da55aa", 0x40, 0x1c0}, {0x0, 0x0, 0xfffffffffffffffb}]) 09:53:30 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x6, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}) 09:53:30 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0x4c}}}, 0xf0}}, 0x0) 09:53:30 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) mkdirat(r1, &(0x7f00000000c0)='./file0\x00', 0x0) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r3 = syz_io_uring_setup(0x3ede, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000140)) io_uring_enter(r3, 0x2ff, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x5, 0x0, &(0x7f0000000040)=""/18, 0xffffffde}, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, &(0x7f0000000dc0)=[{&(0x7f0000000100)="f4a4848461fb0592d2f8db4c1f3c9e408788e03d28fe5e69dbceea46dd67888cdedd07a068040b956c3af7", 0x2b}, {0x0}, {0x0}], 0x3, &(0x7f0000000540)=ANY=[@ANYBLOB="1400000000000000", @ANYRES32], 0x50}}, {{0x0, 0x0, &(0x7f0000003180)=[{0x0}, {0x0}], 0x2, &(0x7f00000002c0)=ANY=[@ANYBLOB="c9252cdfb191d94ef15953a086ed40b24a018fb18d39f9a1256b33cf339f1d1bb52846ddaaaecd492eb1d0774b26968a44bf794e9d902a3c02af9543bc4096ac7a27", @ANYRES32, @ANYRES32=0x0], 0x50, 0x4041}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYRESDEC, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000003000000000000000010000000100", @ANYRES32, @ANYRES64, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESDEC=r4], 0xd0, 0x20000000}}], 0x3, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x138, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {0x100000000000000}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x48, 0x1, {{'md5\x00'}}}]}, 0x138}}, 0x0) 09:53:30 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x9, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000e80)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) io_uring_enter(r1, 0x0, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x50}}], 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {}, {}, 0x4, 0x0, 0xa}, [@algo_auth={0x58, 0x1, {{'md5\x00'}, 0x80, "f959fb7b2a535a87359f0b633f54f881"}}]}, 0x148}}, 0x0) 09:53:30 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="5500030018007f083ffe15b282a380930a03000248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) 09:53:30 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x9, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000e80)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) io_uring_enter(r1, 0x0, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x50}}], 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {}, {}, 0x5, 0x0, 0xa}, [@algo_auth={0x58, 0x1, {{'md5\x00'}, 0x80, "f959fb7b2a535a87359f0b633f54f881"}}]}, 0x148}}, 0x0) [ 471.795214][ C1] scsi_io_completion_action: 16 callbacks suppressed [ 471.795243][ C1] sd 0:0:1:0: tag#6050 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 471.811736][ C1] sd 0:0:1:0: tag#6050 CDB: opcode=0xe5 (vendor) [ 471.818124][ C1] sd 0:0:1:0: tag#6050 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 471.827157][ C1] sd 0:0:1:0: tag#6050 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 471.836187][ C1] sd 0:0:1:0: tag#6050 CDB[20]: ba [ 471.843400][ C1] sd 0:0:1:0: [sg_rq_end_io] Sense Key : Illegal Request [current] [ 471.851405][ C1] sd 0:0:1:0: [sg_rq_end_io] Add. Sense: Invalid command operation code [ 471.852103][ C0] sd 0:0:1:0: tag#6053 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 471.869562][ C0] sd 0:0:1:0: tag#6053 CDB: opcode=0xe5 (vendor) [ 471.875897][ C0] sd 0:0:1:0: tag#6053 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 471.884943][ C0] sd 0:0:1:0: tag#6053 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d 09:53:30 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0x60}}}, 0xf0}}, 0x0) 09:53:30 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x6, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd}) 09:53:30 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="5500050018007f083ffe15b282a380930a03000248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) 09:53:30 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) mkdirat(r1, &(0x7f00000000c0)='./file0\x00', 0x0) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r3 = syz_io_uring_setup(0x3ede, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000140)) io_uring_enter(r3, 0x2ff, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x5, 0x0, &(0x7f0000000040)=""/18, 0xffffffde}, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, &(0x7f0000000dc0)=[{&(0x7f0000000100)="f4a4848461fb0592d2f8db4c1f3c9e408788e03d28fe5e69dbceea46dd67888cdedd07a068040b956c3af7", 0x2b}, {0x0}, {0x0}], 0x3, &(0x7f0000000540)=ANY=[@ANYBLOB="1400000000000000", @ANYRES32], 0x50}}, {{0x0, 0x0, &(0x7f0000003180)=[{0x0}, {0x0}], 0x2, &(0x7f00000002c0)=ANY=[@ANYBLOB="c9252cdfb191d94ef15953a086ed40b24a018fb18d39f9a1256b33cf339f1d1bb52846ddaaaecd492eb1d0774b26968a44bf794e9d902a3c02af9543bc4096ac7a27", @ANYRES32, @ANYRES32=0x0], 0x50, 0x4041}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYRESDEC, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000003000000000000000010000000100", @ANYRES32, @ANYRES64, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESDEC=r4], 0xd0, 0x20000000}}], 0x3, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x138, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {0x200000000000000}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x48, 0x1, {{'md5\x00'}}}]}, 0x138}}, 0x0) [ 471.893997][ C0] sd 0:0:1:0: tag#6053 CDB[20]: ba 09:53:30 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x9, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000e80)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) io_uring_enter(r1, 0x0, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x50}}], 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {}, {}, 0x6, 0x0, 0xa}, [@algo_auth={0x58, 0x1, {{'md5\x00'}, 0x80, "f959fb7b2a535a87359f0b633f54f881"}}]}, 0x148}}, 0x0) [ 471.971050][ C1] sd 0:0:1:0: [sg_rq_end_io] Sense Key : Illegal Request [current] [ 471.979057][ C1] sd 0:0:1:0: [sg_rq_end_io] Add. Sense: Invalid command operation code [ 472.018578][T24832] loop2: detected capacity change from 0 to 16383 [ 472.035178][ C1] sd 0:0:1:0: tag#6071 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 472.045028][ C1] sd 0:0:1:0: tag#6071 CDB: opcode=0xe5 (vendor) [ 472.051357][ C1] sd 0:0:1:0: tag#6071 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 472.060374][ C1] sd 0:0:1:0: tag#6071 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 472.069416][ C1] sd 0:0:1:0: tag#6071 CDB[20]: ba [ 472.083559][T24832] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 472.088838][T24832] loop2: p1 size 11290111 extends beyond EOD, truncated [ 472.096677][T24832] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 472.105280][T24832] loop2: p5 size 11290111 extends beyond EOD, truncated [ 472.113066][T24832] loop2: p6 size 1912633224 extends beyond EOD, truncated [ 472.202404][T24832] loop2: detected capacity change from 0 to 16383 [ 472.238026][ T5592] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 472.243262][ T5592] loop2: p1 size 11290111 extends beyond EOD, truncated [ 472.250969][ T5592] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 472.258721][ T5592] loop2: p5 size 11290111 extends beyond EOD, truncated [ 472.265930][ T5592] loop2: p6 size 1912633224 extends beyond EOD, truncated [ 472.276025][T24832] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 472.281380][T24832] loop2: p1 size 11290111 extends beyond EOD, truncated [ 472.288899][T24832] loop2: p3 size 1912633224 extends beyond EOD, truncated 09:53:30 executing program 2: syz_read_part_table(0x0, 0x2, &(0x7f0000000100)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0000ffffff85000000060000000000024000ffffff82000a00e100000088770072003007000f00000000000000008000da55aa", 0x40, 0x1c0}, {0x0, 0x0, 0xfffffffffffffffb}]) 09:53:30 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x6, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe}) 09:53:30 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0x68}}}, 0xf0}}, 0x0) 09:53:30 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="5500060018007f083ffe15b282a380930a03000248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) 09:53:30 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) mkdirat(r1, &(0x7f00000000c0)='./file0\x00', 0x0) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r3 = syz_io_uring_setup(0x3ede, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000140)) io_uring_enter(r3, 0x2ff, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x5, 0x0, &(0x7f0000000040)=""/18, 0xffffffde}, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, &(0x7f0000000dc0)=[{&(0x7f0000000100)="f4a4848461fb0592d2f8db4c1f3c9e408788e03d28fe5e69dbceea46dd67888cdedd07a068040b956c3af7", 0x2b}, {0x0}, {0x0}], 0x3, &(0x7f0000000540)=ANY=[@ANYBLOB="1400000000000000", @ANYRES32], 0x50}}, {{0x0, 0x0, &(0x7f0000003180)=[{0x0}, {0x0}], 0x2, &(0x7f00000002c0)=ANY=[@ANYBLOB="c9252cdfb191d94ef15953a086ed40b24a018fb18d39f9a1256b33cf339f1d1bb52846ddaaaecd492eb1d0774b26968a44bf794e9d902a3c02af9543bc4096ac7a27", @ANYRES32, @ANYRES32=0x0], 0x50, 0x4041}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYRESDEC, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000003000000000000000010000000100", @ANYRES32, @ANYRES64, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESDEC=r4], 0xd0, 0x20000000}}], 0x3, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x138, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {0x300000000000000}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x48, 0x1, {{'md5\x00'}}}]}, 0x138}}, 0x0) 09:53:30 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x9, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000e80)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) io_uring_enter(r1, 0x0, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x50}}], 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {}, {}, 0x7, 0x0, 0xa}, [@algo_auth={0x58, 0x1, {{'md5\x00'}, 0x80, "f959fb7b2a535a87359f0b633f54f881"}}]}, 0x148}}, 0x0) [ 472.296858][T24832] loop2: p5 size 11290111 extends beyond EOD, truncated [ 472.304183][T24832] loop2: p6 size 1912633224 extends beyond EOD, truncated [ 472.368455][ C1] sd 0:0:1:0: [sg_rq_end_io] Sense Key : Illegal Request [current] [ 472.376477][ C1] sd 0:0:1:0: [sg_rq_end_io] Add. Sense: Invalid command operation code [ 472.386116][ C0] sd 0:0:1:0: tag#6053 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 472.395973][ C0] sd 0:0:1:0: tag#6053 CDB: opcode=0xe5 (vendor) [ 472.402323][ C0] sd 0:0:1:0: tag#6053 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c 09:53:30 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0x6c}}}, 0xf0}}, 0x0) 09:53:30 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x6, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10}) 09:53:30 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="5500070018007f083ffe15b282a380930a03000248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) 09:53:30 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x9, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000e80)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) io_uring_enter(r1, 0x0, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x50}}], 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {}, {}, 0x8, 0x0, 0xa}, [@algo_auth={0x58, 0x1, {{'md5\x00'}, 0x80, "f959fb7b2a535a87359f0b633f54f881"}}]}, 0x148}}, 0x0) 09:53:30 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) mkdirat(r1, &(0x7f00000000c0)='./file0\x00', 0x0) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r3 = syz_io_uring_setup(0x3ede, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000140)) io_uring_enter(r3, 0x2ff, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x5, 0x0, &(0x7f0000000040)=""/18, 0xffffffde}, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, &(0x7f0000000dc0)=[{&(0x7f0000000100)="f4a4848461fb0592d2f8db4c1f3c9e408788e03d28fe5e69dbceea46dd67888cdedd07a068040b956c3af7", 0x2b}, {0x0}, {0x0}], 0x3, &(0x7f0000000540)=ANY=[@ANYBLOB="1400000000000000", @ANYRES32], 0x50}}, {{0x0, 0x0, &(0x7f0000003180)=[{0x0}, {0x0}], 0x2, &(0x7f00000002c0)=ANY=[@ANYBLOB="c9252cdfb191d94ef15953a086ed40b24a018fb18d39f9a1256b33cf339f1d1bb52846ddaaaecd492eb1d0774b26968a44bf794e9d902a3c02af9543bc4096ac7a27", @ANYRES32, @ANYRES32=0x0], 0x50, 0x4041}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYRESDEC, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000003000000000000000010000000100", @ANYRES32, @ANYRES64, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESDEC=r4], 0xd0, 0x20000000}}], 0x3, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x138, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {0x400000000000000}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x48, 0x1, {{'md5\x00'}}}]}, 0x138}}, 0x0) [ 472.411388][ C0] sd 0:0:1:0: tag#6053 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 472.420446][ C0] sd 0:0:1:0: tag#6053 CDB[20]: ba 09:53:30 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0x74}}}, 0xf0}}, 0x0) [ 472.547715][ C1] sd 0:0:1:0: [sg_rq_end_io] Sense Key : Illegal Request [current] [ 472.555740][ C1] sd 0:0:1:0: [sg_rq_end_io] Add. Sense: Invalid command operation code [ 472.596088][ C0] sd 0:0:1:0: tag#6075 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 472.605944][ C0] sd 0:0:1:0: tag#6075 CDB: opcode=0xe5 (vendor) [ 472.612302][ C0] sd 0:0:1:0: tag#6075 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 472.621334][ C0] sd 0:0:1:0: tag#6075 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 472.630377][ C0] sd 0:0:1:0: tag#6075 CDB[20]: ba [ 472.649228][ C0] sd 0:0:1:0: tag#6036 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 472.659070][ C0] sd 0:0:1:0: tag#6036 CDB: opcode=0xe5 (vendor) [ 472.665419][ C0] sd 0:0:1:0: tag#6036 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 472.674453][ C0] sd 0:0:1:0: tag#6036 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 472.683481][ C0] sd 0:0:1:0: tag#6036 CDB[20]: ba [ 472.715363][T24867] loop2: detected capacity change from 0 to 16383 [ 472.753227][ T5428] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 472.758498][ T5428] loop2: p1 size 11290111 extends beyond EOD, truncated [ 472.766208][ T5428] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 472.774011][ T5428] loop2: p5 size 11290111 extends beyond EOD, truncated [ 472.781239][ T5428] loop2: p6 size 1912633224 extends beyond EOD, truncated [ 472.790927][T24867] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 472.796249][T24867] loop2: p1 size 11290111 extends beyond EOD, truncated [ 472.804094][T24867] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 472.812071][T24867] loop2: p5 size 11290111 extends beyond EOD, truncated [ 472.819407][T24867] loop2: p6 size 1912633224 extends beyond EOD, truncated [ 472.945140][T24867] loop2: detected capacity change from 0 to 16383 [ 473.000637][ T5592] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 473.005868][ T5592] loop2: p1 size 11290111 extends beyond EOD, truncated [ 473.013589][ T5592] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 473.021320][ T5592] loop2: p5 size 11290111 extends beyond EOD, truncated [ 473.028707][ T5592] loop2: p6 size 1912633224 extends beyond EOD, truncated [ 473.039337][T24867] loop2: p1 p2 < > p3 p4 < p5 p6 > 09:53:31 executing program 2: syz_read_part_table(0x0, 0x2, &(0x7f0000000100)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0000ffffff85000000060000000000024000ffffff82000b00e100000088770072003007000f00000000000000008000da55aa", 0x40, 0x1c0}, {0x0, 0x0, 0xfffffffffffffffb}]) 09:53:31 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="5500090018007f083ffe15b282a380930a03000248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) 09:53:31 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x9, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000e80)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) io_uring_enter(r1, 0x0, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x50}}], 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {}, {}, 0x9, 0x0, 0xa}, [@algo_auth={0x58, 0x1, {{'md5\x00'}, 0x80, "f959fb7b2a535a87359f0b633f54f881"}}]}, 0x148}}, 0x0) 09:53:31 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x6, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18}) 09:53:31 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) mkdirat(r1, &(0x7f00000000c0)='./file0\x00', 0x0) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r3 = syz_io_uring_setup(0x3ede, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000140)) io_uring_enter(r3, 0x2ff, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x5, 0x0, &(0x7f0000000040)=""/18, 0xffffffde}, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, &(0x7f0000000dc0)=[{&(0x7f0000000100)="f4a4848461fb0592d2f8db4c1f3c9e408788e03d28fe5e69dbceea46dd67888cdedd07a068040b956c3af7", 0x2b}, {0x0}, {0x0}], 0x3, &(0x7f0000000540)=ANY=[@ANYBLOB="1400000000000000", @ANYRES32], 0x50}}, {{0x0, 0x0, &(0x7f0000003180)=[{0x0}, {0x0}], 0x2, &(0x7f00000002c0)=ANY=[@ANYBLOB="c9252cdfb191d94ef15953a086ed40b24a018fb18d39f9a1256b33cf339f1d1bb52846ddaaaecd492eb1d0774b26968a44bf794e9d902a3c02af9543bc4096ac7a27", @ANYRES32, @ANYRES32=0x0], 0x50, 0x4041}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYRESDEC, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000003000000000000000010000000100", @ANYRES32, @ANYRES64, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESDEC=r4], 0xd0, 0x20000000}}], 0x3, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x138, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {0x500000000000000}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x48, 0x1, {{'md5\x00'}}}]}, 0x138}}, 0x0) 09:53:31 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0x7a}}}, 0xf0}}, 0x0) [ 473.044598][T24867] loop2: p1 size 11290111 extends beyond EOD, truncated [ 473.052255][T24867] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 473.060000][T24867] loop2: p5 size 11290111 extends beyond EOD, truncated [ 473.067334][T24867] loop2: p6 size 1912633224 extends beyond EOD, truncated [ 473.119691][ C1] sd 0:0:1:0: [sg_rq_end_io] Sense Key : Illegal Request [current] [ 473.121197][ C0] sd 0:0:1:0: tag#6044 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 473.127702][ C1] sd 0:0:1:0: [sg_rq_end_io] Add. Sense: Invalid command operation code [ 473.137499][ C0] sd 0:0:1:0: tag#6044 CDB: opcode=0xe5 (vendor) [ 473.152132][ C0] sd 0:0:1:0: tag#6044 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c 09:53:31 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="55000a0018007f083ffe15b282a380930a03000248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) 09:53:31 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x6, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e", 0x0, 0x0, 0x0, 0x0, 0x0}) 09:53:31 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0x13e}}}, 0xf0}}, 0x0) 09:53:31 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x9, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000e80)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) io_uring_enter(r1, 0x0, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x50}}], 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {}, {}, 0xa, 0x0, 0xa}, [@algo_auth={0x58, 0x1, {{'md5\x00'}, 0x80, "f959fb7b2a535a87359f0b633f54f881"}}]}, 0x148}}, 0x0) 09:53:31 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) mkdirat(r1, &(0x7f00000000c0)='./file0\x00', 0x0) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r3 = syz_io_uring_setup(0x3ede, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000140)) io_uring_enter(r3, 0x2ff, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x5, 0x0, &(0x7f0000000040)=""/18, 0xffffffde}, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, &(0x7f0000000dc0)=[{&(0x7f0000000100)="f4a4848461fb0592d2f8db4c1f3c9e408788e03d28fe5e69dbceea46dd67888cdedd07a068040b956c3af7", 0x2b}, {0x0}, {0x0}], 0x3, &(0x7f0000000540)=ANY=[@ANYBLOB="1400000000000000", @ANYRES32], 0x50}}, {{0x0, 0x0, &(0x7f0000003180)=[{0x0}, {0x0}], 0x2, &(0x7f00000002c0)=ANY=[@ANYBLOB="c9252cdfb191d94ef15953a086ed40b24a018fb18d39f9a1256b33cf339f1d1bb52846ddaaaecd492eb1d0774b26968a44bf794e9d902a3c02af9543bc4096ac7a27", @ANYRES32, @ANYRES32=0x0], 0x50, 0x4041}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYRESDEC, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000003000000000000000010000000100", @ANYRES32, @ANYRES64, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESDEC=r4], 0xd0, 0x20000000}}], 0x3, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x138, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {0x600000000000000}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x48, 0x1, {{'md5\x00'}}}]}, 0x138}}, 0x0) [ 473.161192][ C0] sd 0:0:1:0: tag#6044 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 473.170222][ C0] sd 0:0:1:0: tag#6044 CDB[20]: ba 09:53:31 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="55000b0018007f083ffe15b282a380930a03000248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) [ 473.302758][ C1] sd 0:0:1:0: [sg_rq_end_io] Sense Key : Illegal Request [current] [ 473.310830][ C1] sd 0:0:1:0: [sg_rq_end_io] Add. Sense: Invalid command operation code [ 473.372468][ C0] sd 0:0:1:0: tag#6021 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 473.382329][ C0] sd 0:0:1:0: tag#6021 CDB: opcode=0xe5 (vendor) [ 473.388658][ C0] sd 0:0:1:0: tag#6021 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 473.397708][ C0] sd 0:0:1:0: tag#6021 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 473.406753][ C0] sd 0:0:1:0: tag#6021 CDB[20]: ba [ 473.485895][T24901] loop2: detected capacity change from 0 to 16383 [ 473.515790][ T5592] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 473.521164][ T5592] loop2: p1 size 11290111 extends beyond EOD, truncated [ 473.528754][ T5592] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 473.536593][ T5592] loop2: p5 size 11290111 extends beyond EOD, truncated [ 473.543936][ T5592] loop2: p6 size 1912633224 extends beyond EOD, truncated [ 473.554065][T24901] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 473.559425][T24901] loop2: p1 size 11290111 extends beyond EOD, truncated [ 473.567095][T24901] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 473.574745][T24901] loop2: p5 size 11290111 extends beyond EOD, truncated [ 473.582014][T24901] loop2: p6 size 1912633224 extends beyond EOD, truncated [ 473.661066][T24901] loop2: detected capacity change from 0 to 16383 [ 473.701317][ T5592] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 473.706678][ T5592] loop2: p1 size 11290111 extends beyond EOD, truncated [ 473.714385][ T5592] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 473.722173][ T5592] loop2: p5 size 11290111 extends beyond EOD, truncated [ 473.729395][ T5592] loop2: p6 size 1912633224 extends beyond EOD, truncated [ 473.739034][T24901] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 473.744283][T24901] loop2: p1 size 11290111 extends beyond EOD, truncated 09:53:32 executing program 2: syz_read_part_table(0x0, 0x2, &(0x7f0000000100)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0000ffffff85000000060000000000024000ffffff82001800e100000088770072003007000f00000000000000008000da55aa", 0x40, 0x1c0}, {0x0, 0x0, 0xfffffffffffffffb}]) 09:53:32 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x6, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) 09:53:32 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0x300}}}, 0xf0}}, 0x0) 09:53:32 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x9, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000e80)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) io_uring_enter(r1, 0x0, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x50}}], 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {}, {}, 0xb, 0x0, 0xa}, [@algo_auth={0x58, 0x1, {{'md5\x00'}, 0x80, "f959fb7b2a535a87359f0b633f54f881"}}]}, 0x148}}, 0x0) 09:53:32 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) mkdirat(r1, &(0x7f00000000c0)='./file0\x00', 0x0) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r3 = syz_io_uring_setup(0x3ede, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000140)) io_uring_enter(r3, 0x2ff, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x5, 0x0, &(0x7f0000000040)=""/18, 0xffffffde}, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, &(0x7f0000000dc0)=[{&(0x7f0000000100)="f4a4848461fb0592d2f8db4c1f3c9e408788e03d28fe5e69dbceea46dd67888cdedd07a068040b956c3af7", 0x2b}, {0x0}, {0x0}], 0x3, &(0x7f0000000540)=ANY=[@ANYBLOB="1400000000000000", @ANYRES32], 0x50}}, {{0x0, 0x0, &(0x7f0000003180)=[{0x0}, {0x0}], 0x2, &(0x7f00000002c0)=ANY=[@ANYBLOB="c9252cdfb191d94ef15953a086ed40b24a018fb18d39f9a1256b33cf339f1d1bb52846ddaaaecd492eb1d0774b26968a44bf794e9d902a3c02af9543bc4096ac7a27", @ANYRES32, @ANYRES32=0x0], 0x50, 0x4041}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYRESDEC, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000003000000000000000010000000100", @ANYRES32, @ANYRES64, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESDEC=r4], 0xd0, 0x20000000}}], 0x3, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x138, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {0x700000000000000}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x48, 0x1, {{'md5\x00'}}}]}, 0x138}}, 0x0) 09:53:32 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="55000c0018007f083ffe15b282a380930a03000248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) [ 473.751781][T24901] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 473.759508][T24901] loop2: p5 size 11290111 extends beyond EOD, truncated [ 473.766860][T24901] loop2: p6 size 1912633224 extends beyond EOD, truncated 09:53:32 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x6, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}) [ 473.831543][ C1] sd 0:0:1:0: [sg_rq_end_io] Sense Key : Illegal Request [current] [ 473.833686][ C0] sd 0:0:1:0: tag#6052 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 473.839581][ C1] sd 0:0:1:0: [sg_rq_end_io] Add. Sense: Invalid command operation code [ 473.849360][ C0] sd 0:0:1:0: tag#6052 CDB: opcode=0xe5 (vendor) [ 473.864010][ C0] sd 0:0:1:0: tag#6052 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c 09:53:32 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="55000d0018007f083ffe15b282a380930a03000248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) 09:53:32 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x9, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000e80)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) io_uring_enter(r1, 0x0, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x50}}], 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {}, {}, 0x10, 0x0, 0xa}, [@algo_auth={0x58, 0x1, {{'md5\x00'}, 0x80, "f959fb7b2a535a87359f0b633f54f881"}}]}, 0x148}}, 0x0) 09:53:32 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) mkdirat(r1, &(0x7f00000000c0)='./file0\x00', 0x0) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r3 = syz_io_uring_setup(0x3ede, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000140)) io_uring_enter(r3, 0x2ff, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x5, 0x0, &(0x7f0000000040)=""/18, 0xffffffde}, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, &(0x7f0000000dc0)=[{&(0x7f0000000100)="f4a4848461fb0592d2f8db4c1f3c9e408788e03d28fe5e69dbceea46dd67888cdedd07a068040b956c3af7", 0x2b}, {0x0}, {0x0}], 0x3, &(0x7f0000000540)=ANY=[@ANYBLOB="1400000000000000", @ANYRES32], 0x50}}, {{0x0, 0x0, &(0x7f0000003180)=[{0x0}, {0x0}], 0x2, &(0x7f00000002c0)=ANY=[@ANYBLOB="c9252cdfb191d94ef15953a086ed40b24a018fb18d39f9a1256b33cf339f1d1bb52846ddaaaecd492eb1d0774b26968a44bf794e9d902a3c02af9543bc4096ac7a27", @ANYRES32, @ANYRES32=0x0], 0x50, 0x4041}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYRESDEC, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000003000000000000000010000000100", @ANYRES32, @ANYRES64, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESDEC=r4], 0xd0, 0x20000000}}], 0x3, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x138, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {0x800000000000000}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x48, 0x1, {{'md5\x00'}}}]}, 0x138}}, 0x0) 09:53:32 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0x41e}}}, 0xf0}}, 0x0) [ 473.873077][ C0] sd 0:0:1:0: tag#6052 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 473.882111][ C0] sd 0:0:1:0: tag#6052 CDB[20]: ba [ 473.894306][T24911] __nla_validate_parse: 9 callbacks suppressed [ 473.894331][T24911] netlink: 224 bytes leftover after parsing attributes in process `syz-executor.4'. 09:53:32 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x6, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}) [ 474.006931][ C1] sd 0:0:1:0: [sg_rq_end_io] Sense Key : Illegal Request [current] [ 474.014933][ C1] sd 0:0:1:0: [sg_rq_end_io] Add. Sense: Invalid command operation code [ 474.079169][ C0] sd 0:0:1:0: tag#6025 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 474.088999][ C0] sd 0:0:1:0: tag#6025 CDB: opcode=0xe5 (vendor) [ 474.090026][T24926] netlink: 224 bytes leftover after parsing attributes in process `syz-executor.4'. [ 474.095346][ C0] sd 0:0:1:0: tag#6025 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 474.113730][ C0] sd 0:0:1:0: tag#6025 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 474.122773][ C0] sd 0:0:1:0: tag#6025 CDB[20]: ba [ 474.136185][T24929] netlink: 72 bytes leftover after parsing attributes in process `syz-executor.1'. [ 474.211865][T24932] loop2: detected capacity change from 0 to 16383 [ 474.234447][ C1] sd 0:0:1:0: [sg_rq_end_io] Sense Key : Illegal Request [current] [ 474.242500][ C1] sd 0:0:1:0: [sg_rq_end_io] Add. Sense: Invalid command operation code [ 474.259265][T24932] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 474.264652][T24932] loop2: p1 size 11290111 extends beyond EOD, truncated [ 474.272619][T24932] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 474.280592][T24932] loop2: p5 size 11290111 extends beyond EOD, truncated [ 474.288147][T24932] loop2: p6 size 1912633224 extends beyond EOD, truncated [ 474.430146][T24932] loop2: detected capacity change from 0 to 16383 [ 474.495838][T24932] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 474.501174][T24932] loop2: p1 size 11290111 extends beyond EOD, truncated [ 474.508802][T24932] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 474.516624][T24932] loop2: p5 size 11290111 extends beyond EOD, truncated [ 474.523880][T24932] loop2: p6 size 1912633224 extends beyond EOD, truncated 09:53:32 executing program 2: syz_read_part_table(0x0, 0x2, &(0x7f0000000100)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0000ffffff85000000060000000000024000ffffff82002000e100000088770072003007000f00000000000000008000da55aa", 0x40, 0x1c0}, {0x0, 0x0, 0xfffffffffffffffb}]) 09:53:32 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="55000e0018007f083ffe15b282a380930a03000248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) 09:53:32 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x9, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000e80)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) io_uring_enter(r1, 0x0, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x50}}], 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {}, {}, 0x11, 0x0, 0xa}, [@algo_auth={0x58, 0x1, {{'md5\x00'}, 0x80, "f959fb7b2a535a87359f0b633f54f881"}}]}, 0x148}}, 0x0) 09:53:32 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0x500}}}, 0xf0}}, 0x0) 09:53:32 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) mkdirat(r1, &(0x7f00000000c0)='./file0\x00', 0x0) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r3 = syz_io_uring_setup(0x3ede, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000140)) io_uring_enter(r3, 0x2ff, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x5, 0x0, &(0x7f0000000040)=""/18, 0xffffffde}, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, &(0x7f0000000dc0)=[{&(0x7f0000000100)="f4a4848461fb0592d2f8db4c1f3c9e408788e03d28fe5e69dbceea46dd67888cdedd07a068040b956c3af7", 0x2b}, {0x0}, {0x0}], 0x3, &(0x7f0000000540)=ANY=[@ANYBLOB="1400000000000000", @ANYRES32], 0x50}}, {{0x0, 0x0, &(0x7f0000003180)=[{0x0}, {0x0}], 0x2, &(0x7f00000002c0)=ANY=[@ANYBLOB="c9252cdfb191d94ef15953a086ed40b24a018fb18d39f9a1256b33cf339f1d1bb52846ddaaaecd492eb1d0774b26968a44bf794e9d902a3c02af9543bc4096ac7a27", @ANYRES32, @ANYRES32=0x0], 0x50, 0x4041}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYRESDEC, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000003000000000000000010000000100", @ANYRES32, @ANYRES64, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESDEC=r4], 0xd0, 0x20000000}}], 0x3, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x138, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {0x900000000000000}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x48, 0x1, {{'md5\x00'}}}]}, 0x138}}, 0x0) 09:53:32 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x6, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}) 09:53:32 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="55000f0018007f083ffe15b282a380930a03000248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) 09:53:32 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x6, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd}) 09:53:32 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) mkdirat(r1, &(0x7f00000000c0)='./file0\x00', 0x0) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r3 = syz_io_uring_setup(0x3ede, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000140)) io_uring_enter(r3, 0x2ff, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x5, 0x0, &(0x7f0000000040)=""/18, 0xffffffde}, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, &(0x7f0000000dc0)=[{&(0x7f0000000100)="f4a4848461fb0592d2f8db4c1f3c9e408788e03d28fe5e69dbceea46dd67888cdedd07a068040b956c3af7", 0x2b}, {0x0}, {0x0}], 0x3, &(0x7f0000000540)=ANY=[@ANYBLOB="1400000000000000", @ANYRES32], 0x50}}, {{0x0, 0x0, &(0x7f0000003180)=[{0x0}, {0x0}], 0x2, &(0x7f00000002c0)=ANY=[@ANYBLOB="c9252cdfb191d94ef15953a086ed40b24a018fb18d39f9a1256b33cf339f1d1bb52846ddaaaecd492eb1d0774b26968a44bf794e9d902a3c02af9543bc4096ac7a27", @ANYRES32, @ANYRES32=0x0], 0x50, 0x4041}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYRESDEC, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000003000000000000000010000000100", @ANYRES32, @ANYRES64, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESDEC=r4], 0xd0, 0x20000000}}], 0x3, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x138, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {0xa00000000000000}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x48, 0x1, {{'md5\x00'}}}]}, 0x138}}, 0x0) 09:53:32 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0x600}}}, 0xf0}}, 0x0) 09:53:32 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x9, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000e80)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) io_uring_enter(r1, 0x0, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x50}}], 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {}, {}, 0x14, 0x0, 0xa}, [@algo_auth={0x58, 0x1, {{'md5\x00'}, 0x80, "f959fb7b2a535a87359f0b633f54f881"}}]}, 0x148}}, 0x0) [ 474.633739][ C1] sd 0:0:1:0: [sg_rq_end_io] Sense Key : Illegal Request [current] [ 474.641996][ C1] sd 0:0:1:0: [sg_rq_end_io] Add. Sense: Invalid command operation code [ 474.656216][T24942] netlink: 224 bytes leftover after parsing attributes in process `syz-executor.4'. 09:53:32 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="5500110018007f083ffe15b282a380930a03000248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) [ 474.776860][ C1] sd 0:0:1:0: [sg_rq_end_io] Sense Key : Illegal Request [current] [ 474.784878][ C1] sd 0:0:1:0: [sg_rq_end_io] Add. Sense: Invalid command operation code [ 474.803084][T24954] netlink: 224 bytes leftover after parsing attributes in process `syz-executor.4'. [ 474.880889][T24959] loop2: detected capacity change from 0 to 16383 [ 474.938147][ T5592] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 474.943414][ T5592] loop2: p1 size 11290111 extends beyond EOD, truncated [ 474.950977][ T5592] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 474.958771][ T5592] loop2: p5 size 11290111 extends beyond EOD, truncated [ 474.966218][ T5592] loop2: p6 size 1912633224 extends beyond EOD, truncated [ 474.976602][T24959] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 474.981900][T24959] loop2: p1 size 11290111 extends beyond EOD, truncated [ 474.989651][T24959] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 474.997617][T24959] loop2: p5 size 11290111 extends beyond EOD, truncated [ 475.004929][T24959] loop2: p6 size 1912633224 extends beyond EOD, truncated [ 475.073336][T24959] loop2: detected capacity change from 0 to 16383 [ 475.113433][T24959] loop2: p1 p2 < > p3 p4 < p5 p6 > 09:53:33 executing program 2: syz_read_part_table(0x0, 0x2, &(0x7f0000000100)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0000ffffff85000000060000000000024000ffffff82002600e100000088770072003007000f00000000000000008000da55aa", 0x40, 0x1c0}, {0x0, 0x0, 0xfffffffffffffffb}]) 09:53:33 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x6, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe}) 09:53:33 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0x700}}}, 0xf0}}, 0x0) 09:53:33 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) mkdirat(r1, &(0x7f00000000c0)='./file0\x00', 0x0) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r3 = syz_io_uring_setup(0x3ede, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000140)) io_uring_enter(r3, 0x2ff, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x5, 0x0, &(0x7f0000000040)=""/18, 0xffffffde}, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, &(0x7f0000000dc0)=[{&(0x7f0000000100)="f4a4848461fb0592d2f8db4c1f3c9e408788e03d28fe5e69dbceea46dd67888cdedd07a068040b956c3af7", 0x2b}, {0x0}, {0x0}], 0x3, &(0x7f0000000540)=ANY=[@ANYBLOB="1400000000000000", @ANYRES32], 0x50}}, {{0x0, 0x0, &(0x7f0000003180)=[{0x0}, {0x0}], 0x2, &(0x7f00000002c0)=ANY=[@ANYBLOB="c9252cdfb191d94ef15953a086ed40b24a018fb18d39f9a1256b33cf339f1d1bb52846ddaaaecd492eb1d0774b26968a44bf794e9d902a3c02af9543bc4096ac7a27", @ANYRES32, @ANYRES32=0x0], 0x50, 0x4041}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYRESDEC, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000003000000000000000010000000100", @ANYRES32, @ANYRES64, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESDEC=r4], 0xd0, 0x20000000}}], 0x3, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x138, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {0xb00000000000000}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x48, 0x1, {{'md5\x00'}}}]}, 0x138}}, 0x0) 09:53:33 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x9, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000e80)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) io_uring_enter(r1, 0x0, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x50}}], 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {}, {}, 0x262, 0x0, 0xa}, [@algo_auth={0x58, 0x1, {{'md5\x00'}, 0x80, "f959fb7b2a535a87359f0b633f54f881"}}]}, 0x148}}, 0x0) 09:53:33 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="5500120018007f083ffe15b282a380930a03000248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) [ 475.118743][T24959] loop2: p1 size 11290111 extends beyond EOD, truncated [ 475.126329][T24959] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 475.134105][T24959] loop2: p5 size 11290111 extends beyond EOD, truncated [ 475.141463][T24959] loop2: p6 size 1912633224 extends beyond EOD, truncated 09:53:33 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0x900}}}, 0xf0}}, 0x0) 09:53:33 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="5500200018007f083ffe15b282a380930a03000248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) 09:53:33 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) mkdirat(r1, &(0x7f00000000c0)='./file0\x00', 0x0) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r3 = syz_io_uring_setup(0x3ede, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000140)) io_uring_enter(r3, 0x2ff, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x5, 0x0, &(0x7f0000000040)=""/18, 0xffffffde}, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, &(0x7f0000000dc0)=[{&(0x7f0000000100)="f4a4848461fb0592d2f8db4c1f3c9e408788e03d28fe5e69dbceea46dd67888cdedd07a068040b956c3af7", 0x2b}, {0x0}, {0x0}], 0x3, &(0x7f0000000540)=ANY=[@ANYBLOB="1400000000000000", @ANYRES32], 0x50}}, {{0x0, 0x0, &(0x7f0000003180)=[{0x0}, {0x0}], 0x2, &(0x7f00000002c0)=ANY=[@ANYBLOB="c9252cdfb191d94ef15953a086ed40b24a018fb18d39f9a1256b33cf339f1d1bb52846ddaaaecd492eb1d0774b26968a44bf794e9d902a3c02af9543bc4096ac7a27", @ANYRES32, @ANYRES32=0x0], 0x50, 0x4041}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYRESDEC, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000003000000000000000010000000100", @ANYRES32, @ANYRES64, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESDEC=r4], 0xd0, 0x20000000}}], 0x3, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x138, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {0x1000000000000000}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x48, 0x1, {{'md5\x00'}}}]}, 0x138}}, 0x0) 09:53:33 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x9, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000e80)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) io_uring_enter(r1, 0x0, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x50}}], 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {}, {}, 0x300, 0x0, 0xa}, [@algo_auth={0x58, 0x1, {{'md5\x00'}, 0x80, "f959fb7b2a535a87359f0b633f54f881"}}]}, 0x148}}, 0x0) 09:53:33 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x6, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10}) [ 475.206024][T24969] netlink: 224 bytes leftover after parsing attributes in process `syz-executor.4'. [ 475.227659][ C1] sd 0:0:1:0: [sg_rq_end_io] Sense Key : Illegal Request [current] [ 475.235693][ C1] sd 0:0:1:0: [sg_rq_end_io] Add. Sense: Invalid command operation code 09:53:33 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="5500250018007f083ffe15b282a380930a03000248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) 09:53:33 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0xa00}}}, 0xf0}}, 0x0) [ 475.434067][T24980] netlink: 224 bytes leftover after parsing attributes in process `syz-executor.4'. [ 475.484468][ C1] sd 0:0:1:0: [sg_rq_end_io] Sense Key : Illegal Request [current] [ 475.492518][ C1] sd 0:0:1:0: [sg_rq_end_io] Add. Sense: Invalid command operation code [ 475.552464][T24990] loop2: detected capacity change from 0 to 16383 [ 475.618369][ T5592] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 475.623836][ T5592] loop2: p1 size 11290111 extends beyond EOD, truncated [ 475.632404][ T5592] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 475.640364][ T5592] loop2: p5 size 11290111 extends beyond EOD, truncated [ 475.647723][ T5592] loop2: p6 size 1912633224 extends beyond EOD, truncated [ 475.657446][T24990] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 475.662820][T24990] loop2: p1 size 11290111 extends beyond EOD, truncated [ 475.670577][T24990] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 475.678367][T24990] loop2: p5 size 11290111 extends beyond EOD, truncated [ 475.685624][T24990] loop2: p6 size 1912633224 extends beyond EOD, truncated [ 475.700993][T24994] netlink: 224 bytes leftover after parsing attributes in process `syz-executor.4'. [ 475.820481][T24990] loop2: detected capacity change from 0 to 16383 09:53:34 executing program 2: syz_read_part_table(0x0, 0x2, &(0x7f0000000100)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0000ffffff85000000060000000000024000ffffff82003f00e100000088770072003007000f00000000000000008000da55aa", 0x40, 0x1c0}, {0x0, 0x0, 0xfffffffffffffffb}]) 09:53:34 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) mkdirat(r1, &(0x7f00000000c0)='./file0\x00', 0x0) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r3 = syz_io_uring_setup(0x3ede, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000140)) io_uring_enter(r3, 0x2ff, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x5, 0x0, &(0x7f0000000040)=""/18, 0xffffffde}, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, &(0x7f0000000dc0)=[{&(0x7f0000000100)="f4a4848461fb0592d2f8db4c1f3c9e408788e03d28fe5e69dbceea46dd67888cdedd07a068040b956c3af7", 0x2b}, {0x0}, {0x0}], 0x3, &(0x7f0000000540)=ANY=[@ANYBLOB="1400000000000000", @ANYRES32], 0x50}}, {{0x0, 0x0, &(0x7f0000003180)=[{0x0}, {0x0}], 0x2, &(0x7f00000002c0)=ANY=[@ANYBLOB="c9252cdfb191d94ef15953a086ed40b24a018fb18d39f9a1256b33cf339f1d1bb52846ddaaaecd492eb1d0774b26968a44bf794e9d902a3c02af9543bc4096ac7a27", @ANYRES32, @ANYRES32=0x0], 0x50, 0x4041}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYRESDEC, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000003000000000000000010000000100", @ANYRES32, @ANYRES64, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESDEC=r4], 0xd0, 0x20000000}}], 0x3, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x138, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {0x1100000000000000}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x48, 0x1, {{'md5\x00'}}}]}, 0x138}}, 0x0) 09:53:34 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x9, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000e80)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) io_uring_enter(r1, 0x0, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x50}}], 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {}, {}, 0x500, 0x0, 0xa}, [@algo_auth={0x58, 0x1, {{'md5\x00'}, 0x80, "f959fb7b2a535a87359f0b633f54f881"}}]}, 0x148}}, 0x0) 09:53:34 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x6, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18}) 09:53:34 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="55003f0018007f083ffe15b282a380930a03000248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) 09:53:34 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0xb00}}}, 0xf0}}, 0x0) [ 475.865755][T24990] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 475.871011][T24990] loop2: p1 size 11290111 extends beyond EOD, truncated [ 475.878969][T24990] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 475.886821][T24990] loop2: p5 size 11290111 extends beyond EOD, truncated [ 475.894124][T24990] loop2: p6 size 1912633224 extends beyond EOD, truncated 09:53:34 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x9, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000e80)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) io_uring_enter(r1, 0x0, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x50}}], 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {}, {}, 0x600, 0x0, 0xa}, [@algo_auth={0x58, 0x1, {{'md5\x00'}, 0x80, "f959fb7b2a535a87359f0b633f54f881"}}]}, 0x148}}, 0x0) 09:53:34 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="5500480018007f083ffe15b282a380930a03000248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) 09:53:34 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x6, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e", 0x0, 0x0, 0x0, 0x0, 0x0}) 09:53:34 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0xc00}}}, 0xf0}}, 0x0) 09:53:34 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) mkdirat(r1, &(0x7f00000000c0)='./file0\x00', 0x0) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r3 = syz_io_uring_setup(0x3ede, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000140)) io_uring_enter(r3, 0x2ff, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x5, 0x0, &(0x7f0000000040)=""/18, 0xffffffde}, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, &(0x7f0000000dc0)=[{&(0x7f0000000100)="f4a4848461fb0592d2f8db4c1f3c9e408788e03d28fe5e69dbceea46dd67888cdedd07a068040b956c3af7", 0x2b}, {0x0}, {0x0}], 0x3, &(0x7f0000000540)=ANY=[@ANYBLOB="1400000000000000", @ANYRES32], 0x50}}, {{0x0, 0x0, &(0x7f0000003180)=[{0x0}, {0x0}], 0x2, &(0x7f00000002c0)=ANY=[@ANYBLOB="c9252cdfb191d94ef15953a086ed40b24a018fb18d39f9a1256b33cf339f1d1bb52846ddaaaecd492eb1d0774b26968a44bf794e9d902a3c02af9543bc4096ac7a27", @ANYRES32, @ANYRES32=0x0], 0x50, 0x4041}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYRESDEC, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000003000000000000000010000000100", @ANYRES32, @ANYRES64, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESDEC=r4], 0xd0, 0x20000000}}], 0x3, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x138, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {0x1400000000000000}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x48, 0x1, {{'md5\x00'}}}]}, 0x138}}, 0x0) [ 475.957366][ C1] sd 0:0:1:0: [sg_rq_end_io] Sense Key : Illegal Request [current] [ 475.965399][ C1] sd 0:0:1:0: [sg_rq_end_io] Add. Sense: Invalid command operation code [ 475.988933][T25004] netlink: 224 bytes leftover after parsing attributes in process `syz-executor.4'. 09:53:34 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x9, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000e80)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) io_uring_enter(r1, 0x0, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x50}}], 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {}, {}, 0x700, 0x0, 0xa}, [@algo_auth={0x58, 0x1, {{'md5\x00'}, 0x80, "f959fb7b2a535a87359f0b633f54f881"}}]}, 0x148}}, 0x0) [ 476.119204][ C1] sd 0:0:1:0: [sg_rq_end_io] Sense Key : Illegal Request [current] [ 476.127222][ C1] sd 0:0:1:0: [sg_rq_end_io] Add. Sense: Invalid command operation code [ 476.155876][T25016] netlink: 224 bytes leftover after parsing attributes in process `syz-executor.4'. [ 476.234469][T25021] loop2: detected capacity change from 0 to 16383 [ 476.278092][ T5592] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 476.283362][ T5592] loop2: p1 size 11290111 extends beyond EOD, truncated [ 476.291059][ T5592] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 476.299132][ T5592] loop2: p5 size 11290111 extends beyond EOD, truncated [ 476.306473][ T5592] loop2: p6 size 1912633224 extends beyond EOD, truncated [ 476.316334][T25021] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 476.321578][T25021] loop2: p1 size 11290111 extends beyond EOD, truncated [ 476.329372][T25021] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 476.337137][T25021] loop2: p5 size 11290111 extends beyond EOD, truncated [ 476.344456][T25021] loop2: p6 size 1912633224 extends beyond EOD, truncated [ 476.434132][T25021] loop2: detected capacity change from 0 to 16383 [ 476.484168][ T5592] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 476.489530][ T5592] loop2: p1 size 11290111 extends beyond EOD, truncated [ 476.497300][ T5592] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 476.505110][ T5592] loop2: p5 size 11290111 extends beyond EOD, truncated [ 476.512282][ T5592] loop2: p6 size 1912633224 extends beyond EOD, truncated [ 476.521919][T25021] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 476.527227][T25021] loop2: p1 size 11290111 extends beyond EOD, truncated 09:53:34 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x6, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) 09:53:34 executing program 2: syz_read_part_table(0x0, 0x2, &(0x7f0000000100)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0000ffffff85000000060000000000024000ffffff82004000e100000088770072003007000f00000000000000008000da55aa", 0x40, 0x1c0}, {0x0, 0x0, 0xfffffffffffffffb}]) 09:53:34 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0xd00}}}, 0xf0}}, 0x0) 09:53:34 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="55004c0018007f083ffe15b282a380930a03000248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) 09:53:34 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x9, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000e80)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) io_uring_enter(r1, 0x0, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x50}}], 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {}, {}, 0x900, 0x0, 0xa}, [@algo_auth={0x58, 0x1, {{'md5\x00'}, 0x80, "f959fb7b2a535a87359f0b633f54f881"}}]}, 0x148}}, 0x0) 09:53:34 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) mkdirat(r1, &(0x7f00000000c0)='./file0\x00', 0x0) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r3 = syz_io_uring_setup(0x3ede, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000140)) io_uring_enter(r3, 0x2ff, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x5, 0x0, &(0x7f0000000040)=""/18, 0xffffffde}, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, &(0x7f0000000dc0)=[{&(0x7f0000000100)="f4a4848461fb0592d2f8db4c1f3c9e408788e03d28fe5e69dbceea46dd67888cdedd07a068040b956c3af7", 0x2b}, {0x0}, {0x0}], 0x3, &(0x7f0000000540)=ANY=[@ANYBLOB="1400000000000000", @ANYRES32], 0x50}}, {{0x0, 0x0, &(0x7f0000003180)=[{0x0}, {0x0}], 0x2, &(0x7f00000002c0)=ANY=[@ANYBLOB="c9252cdfb191d94ef15953a086ed40b24a018fb18d39f9a1256b33cf339f1d1bb52846ddaaaecd492eb1d0774b26968a44bf794e9d902a3c02af9543bc4096ac7a27", @ANYRES32, @ANYRES32=0x0], 0x50, 0x4041}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYRESDEC, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000003000000000000000010000000100", @ANYRES32, @ANYRES64, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESDEC=r4], 0xd0, 0x20000000}}], 0x3, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x138, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {0x2000000000000000}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x48, 0x1, {{'md5\x00'}}}]}, 0x138}}, 0x0) [ 476.534766][T25021] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 476.542530][T25021] loop2: p5 size 11290111 extends beyond EOD, truncated [ 476.549793][T25021] loop2: p6 size 1912633224 extends beyond EOD, truncated 09:53:34 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="5502540018007f083ffe15b282a380930a03000248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) 09:53:34 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x6, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}) 09:53:34 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) mkdirat(r1, &(0x7f00000000c0)='./file0\x00', 0x0) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r3 = syz_io_uring_setup(0x3ede, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000140)) io_uring_enter(r3, 0x2ff, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x5, 0x0, &(0x7f0000000040)=""/18, 0xffffffde}, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, &(0x7f0000000dc0)=[{&(0x7f0000000100)="f4a4848461fb0592d2f8db4c1f3c9e408788e03d28fe5e69dbceea46dd67888cdedd07a068040b956c3af7", 0x2b}, {0x0}, {0x0}], 0x3, &(0x7f0000000540)=ANY=[@ANYBLOB="1400000000000000", @ANYRES32], 0x50}}, {{0x0, 0x0, &(0x7f0000003180)=[{0x0}, {0x0}], 0x2, &(0x7f00000002c0)=ANY=[@ANYBLOB="c9252cdfb191d94ef15953a086ed40b24a018fb18d39f9a1256b33cf339f1d1bb52846ddaaaecd492eb1d0774b26968a44bf794e9d902a3c02af9543bc4096ac7a27", @ANYRES32, @ANYRES32=0x0], 0x50, 0x4041}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYRESDEC, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000003000000000000000010000000100", @ANYRES32, @ANYRES64, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESDEC=r4], 0xd0, 0x20000000}}], 0x3, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x138, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {0x3ec58e0221000000}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x48, 0x1, {{'md5\x00'}}}]}, 0x138}}, 0x0) 09:53:34 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0xe00}}}, 0xf0}}, 0x0) [ 476.598587][ C1] sd 0:0:1:0: [sg_rq_end_io] Sense Key : Illegal Request [current] [ 476.606611][ C1] sd 0:0:1:0: [sg_rq_end_io] Add. Sense: Invalid command operation code 09:53:34 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x9, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000e80)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) io_uring_enter(r1, 0x0, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x50}}], 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {}, {}, 0xa00, 0x0, 0xa}, [@algo_auth={0x58, 0x1, {{'md5\x00'}, 0x80, "f959fb7b2a535a87359f0b633f54f881"}}]}, 0x148}}, 0x0) 09:53:34 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x6, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}) 09:53:34 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="5502580018007f083ffe15b282a380930a03000248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) [ 476.740834][ C1] sd 0:0:1:0: [sg_rq_end_io] Sense Key : Illegal Request [current] [ 476.748860][ C1] sd 0:0:1:0: [sg_rq_end_io] Add. Sense: Invalid command operation code [ 476.881534][ T5551] udevd[5551]: inotify_add_watch(7, /dev/loop2p6, 10) failed: No such file or directory [ 476.883907][T13989] udevd[13989]: inotify_add_watch(7, /dev/loop2p3, 10) failed: No such file or directory [ 476.892328][ T5592] udevd[5592]: inotify_add_watch(7, /dev/loop2p1, 10) failed: No such file or directory [ 476.901898][T16174] udevd[16174]: inotify_add_watch(7, /dev/loop2p4, 10) failed: No such file or directory [ 476.917007][ T5428] udevd[5428]: inotify_add_watch(7, /dev/loop2p2, 10) failed: No such file or directory [ 476.921455][ T5552] udevd[5552]: inotify_add_watch(7, /dev/loop2p5, 10) failed: No such file or directory [ 476.936393][ C1] sd 0:0:1:0: [sg_rq_end_io] Sense Key : Illegal Request [current] [ 476.943210][ T5428] udevd[5428]: inotify_add_watch(7, /dev/loop2p2, 10) failed: No such file or directory [ 476.948012][ C1] sd 0:0:1:0: [sg_rq_end_io] Add. Sense: Invalid command operation code [ 476.958928][ T5551] udevd[5551]: inotify_add_watch(7, /dev/loop2p6, 10) failed: No such file or directory [ 476.979943][ T5592] udevd[5592]: inotify_add_watch(7, /dev/loop2p1, 10) failed: No such file or directory [ 476.982265][ T5552] udevd[5552]: inotify_add_watch(7, /dev/loop2p5, 10) failed: No such file or directory [ 477.017123][T25055] loop2: detected capacity change from 0 to 16383 [ 477.061154][ T5592] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 477.066533][ T5592] loop2: p1 size 11290111 extends beyond EOD, truncated [ 477.074342][ T5592] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 477.082288][ T5592] loop2: p5 size 11290111 extends beyond EOD, truncated [ 477.089505][ T5592] loop2: p6 size 1912633224 extends beyond EOD, truncated [ 477.099777][T25055] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 477.105068][T25055] loop2: p1 size 11290111 extends beyond EOD, truncated [ 477.113076][T25055] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 477.120727][T25055] loop2: p5 size 11290111 extends beyond EOD, truncated [ 477.128087][T25055] loop2: p6 size 1912633224 extends beyond EOD, truncated 09:53:35 executing program 2: syz_read_part_table(0x0, 0x2, &(0x7f0000000100)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0000ffffff85000000060000000000024000ffffff82007100e100000088770072003007000f00000000000000008000da55aa", 0x40, 0x1c0}, {0x0, 0x0, 0xfffffffffffffffb}]) 09:53:35 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0xec0}}}, 0xf0}}, 0x0) 09:53:35 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x9, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000e80)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) io_uring_enter(r1, 0x0, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x50}}], 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {}, {}, 0xb00, 0x0, 0xa}, [@algo_auth={0x58, 0x1, {{'md5\x00'}, 0x80, "f959fb7b2a535a87359f0b633f54f881"}}]}, 0x148}}, 0x0) 09:53:35 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) mkdirat(r1, &(0x7f00000000c0)='./file0\x00', 0x0) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r3 = syz_io_uring_setup(0x3ede, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000140)) io_uring_enter(r3, 0x2ff, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x5, 0x0, &(0x7f0000000040)=""/18, 0xffffffde}, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, &(0x7f0000000dc0)=[{&(0x7f0000000100)="f4a4848461fb0592d2f8db4c1f3c9e408788e03d28fe5e69dbceea46dd67888cdedd07a068040b956c3af7", 0x2b}, {0x0}, {0x0}], 0x3, &(0x7f0000000540)=ANY=[@ANYBLOB="1400000000000000", @ANYRES32], 0x50}}, {{0x0, 0x0, &(0x7f0000003180)=[{0x0}, {0x0}], 0x2, &(0x7f00000002c0)=ANY=[@ANYBLOB="c9252cdfb191d94ef15953a086ed40b24a018fb18d39f9a1256b33cf339f1d1bb52846ddaaaecd492eb1d0774b26968a44bf794e9d902a3c02af9543bc4096ac7a27", @ANYRES32, @ANYRES32=0x0], 0x50, 0x4041}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYRESDEC, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000003000000000000000010000000100", @ANYRES32, @ANYRES64, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESDEC=r4], 0xd0, 0x20000000}}], 0x3, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x138, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {0x3f00000000000000}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x48, 0x1, {{'md5\x00'}}}]}, 0x138}}, 0x0) 09:53:35 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x6, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}) 09:53:35 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="5500600018007f083ffe15b282a380930a03000248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) [ 477.242196][ C1] sd 0:0:1:0: [sg_rq_end_io] Sense Key : Illegal Request [current] [ 477.243964][ C0] scsi_io_completion_action: 15 callbacks suppressed [ 477.243988][ C0] sd 0:0:1:0: tag#6029 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 477.250224][ C1] sd 0:0:1:0: [sg_rq_end_io] Add. Sense: Invalid command operation code [ 477.275021][ C0] sd 0:0:1:0: tag#6029 CDB: opcode=0xe5 (vendor) [ 477.281371][ C0] sd 0:0:1:0: tag#6029 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c 09:53:35 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x9, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000e80)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) io_uring_enter(r1, 0x0, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x50}}], 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {}, {}, 0x1100, 0x0, 0xa}, [@algo_auth={0x58, 0x1, {{'md5\x00'}, 0x80, "f959fb7b2a535a87359f0b633f54f881"}}]}, 0x148}}, 0x0) 09:53:35 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="5500680018007f083ffe15b282a380930a03000248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) 09:53:35 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0x1100}}}, 0xf0}}, 0x0) 09:53:35 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x6, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd}) 09:53:35 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) mkdirat(r1, &(0x7f00000000c0)='./file0\x00', 0x0) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r3 = syz_io_uring_setup(0x3ede, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000140)) io_uring_enter(r3, 0x2ff, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x5, 0x0, &(0x7f0000000040)=""/18, 0xffffffde}, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, &(0x7f0000000dc0)=[{&(0x7f0000000100)="f4a4848461fb0592d2f8db4c1f3c9e408788e03d28fe5e69dbceea46dd67888cdedd07a068040b956c3af7", 0x2b}, {0x0}, {0x0}], 0x3, &(0x7f0000000540)=ANY=[@ANYBLOB="1400000000000000", @ANYRES32], 0x50}}, {{0x0, 0x0, &(0x7f0000003180)=[{0x0}, {0x0}], 0x2, &(0x7f00000002c0)=ANY=[@ANYBLOB="c9252cdfb191d94ef15953a086ed40b24a018fb18d39f9a1256b33cf339f1d1bb52846ddaaaecd492eb1d0774b26968a44bf794e9d902a3c02af9543bc4096ac7a27", @ANYRES32, @ANYRES32=0x0], 0x50, 0x4041}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYRESDEC, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000003000000000000000010000000100", @ANYRES32, @ANYRES64, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESDEC=r4], 0xd0, 0x20000000}}], 0x3, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x138, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {0x4000000000000000}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x48, 0x1, {{'md5\x00'}}}]}, 0x138}}, 0x0) [ 477.290425][ C0] sd 0:0:1:0: tag#6029 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 477.299465][ C0] sd 0:0:1:0: tag#6029 CDB[20]: ba 09:53:35 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="55006c0018007f083ffe15b282a380930a03000248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) [ 477.499555][ C1] sd 0:0:1:0: [sg_rq_end_io] Sense Key : Illegal Request [current] [ 477.507603][ C1] sd 0:0:1:0: [sg_rq_end_io] Add. Sense: Invalid command operation code [ 477.521666][ C0] sd 0:0:1:0: tag#6050 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 477.531521][ C0] sd 0:0:1:0: tag#6050 CDB: opcode=0xe5 (vendor) [ 477.537867][ C0] sd 0:0:1:0: tag#6050 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 477.546907][ C0] sd 0:0:1:0: tag#6050 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 477.555962][ C0] sd 0:0:1:0: tag#6050 CDB[20]: ba [ 477.568428][ C0] sd 0:0:1:0: tag#6021 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 477.570994][T25082] loop2: detected capacity change from 0 to 16383 [ 477.578258][ C0] sd 0:0:1:0: tag#6021 CDB: opcode=0xe5 (vendor) [ 477.578278][ C0] sd 0:0:1:0: tag#6021 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 477.600022][ C0] sd 0:0:1:0: tag#6021 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 477.609073][ C0] sd 0:0:1:0: tag#6021 CDB[20]: ba [ 477.628399][T25082] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 477.633754][T25082] loop2: p1 size 11290111 extends beyond EOD, truncated [ 477.641340][T25082] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 477.649851][T25082] loop2: p5 size 11290111 extends beyond EOD, truncated [ 477.657291][T25082] loop2: p6 size 1912633224 extends beyond EOD, truncated [ 477.757179][T25082] loop2: detected capacity change from 0 to 16383 [ 477.803285][ T5592] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 477.808552][ T5592] loop2: p1 size 11290111 extends beyond EOD, truncated [ 477.816227][ T5592] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 477.824158][ T5592] loop2: p5 size 11290111 extends beyond EOD, truncated [ 477.831519][ T5592] loop2: p6 size 1912633224 extends beyond EOD, truncated [ 477.841213][T25082] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 477.846526][T25082] loop2: p1 size 11290111 extends beyond EOD, truncated 09:53:35 executing program 2: syz_read_part_table(0x0, 0x2, &(0x7f0000000100)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0000ffffff85000000060000000000024000ffffff82007e00e100000088770072003007000f00000000000000008000da55aa", 0x40, 0x1c0}, {0x0, 0x0, 0xfffffffffffffffb}]) 09:53:35 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x6, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe}) 09:53:35 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x9, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000e80)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) io_uring_enter(r1, 0x0, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x50}}], 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {}, {}, 0x1400, 0x0, 0xa}, [@algo_auth={0x58, 0x1, {{'md5\x00'}, 0x80, "f959fb7b2a535a87359f0b633f54f881"}}]}, 0x148}}, 0x0) 09:53:35 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) mkdirat(r1, &(0x7f00000000c0)='./file0\x00', 0x0) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r3 = syz_io_uring_setup(0x3ede, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000140)) io_uring_enter(r3, 0x2ff, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x5, 0x0, &(0x7f0000000040)=""/18, 0xffffffde}, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, &(0x7f0000000dc0)=[{&(0x7f0000000100)="f4a4848461fb0592d2f8db4c1f3c9e408788e03d28fe5e69dbceea46dd67888cdedd07a068040b956c3af7", 0x2b}, {0x0}, {0x0}], 0x3, &(0x7f0000000540)=ANY=[@ANYBLOB="1400000000000000", @ANYRES32], 0x50}}, {{0x0, 0x0, &(0x7f0000003180)=[{0x0}, {0x0}], 0x2, &(0x7f00000002c0)=ANY=[@ANYBLOB="c9252cdfb191d94ef15953a086ed40b24a018fb18d39f9a1256b33cf339f1d1bb52846ddaaaecd492eb1d0774b26968a44bf794e9d902a3c02af9543bc4096ac7a27", @ANYRES32, @ANYRES32=0x0], 0x50, 0x4041}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYRESDEC, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000003000000000000000010000000100", @ANYRES32, @ANYRES64, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESDEC=r4], 0xd0, 0x20000000}}], 0x3, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x138, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {0x8000000000000000}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x48, 0x1, {{'md5\x00'}}}]}, 0x138}}, 0x0) 09:53:35 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="55bd6e0018007f083ffe15b282a380930a03000248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) 09:53:35 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0x1200}}}, 0xf0}}, 0x0) [ 477.854018][T25082] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 477.861776][T25082] loop2: p5 size 11290111 extends beyond EOD, truncated [ 477.869005][T25082] loop2: p6 size 1912633224 extends beyond EOD, truncated 09:53:36 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0x1e04}}}, 0xf0}}, 0x0) 09:53:36 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="5500740018007f083ffe15b282a380930a03000248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) 09:53:36 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x9, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000e80)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) io_uring_enter(r1, 0x0, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x50}}], 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {}, {}, 0x2000, 0x0, 0xa}, [@algo_auth={0x58, 0x1, {{'md5\x00'}, 0x80, "f959fb7b2a535a87359f0b633f54f881"}}]}, 0x148}}, 0x0) [ 477.939641][ C1] sd 0:0:1:0: [sg_rq_end_io] Sense Key : Illegal Request [current] [ 477.947686][ C1] sd 0:0:1:0: [sg_rq_end_io] Add. Sense: Invalid command operation code [ 477.970663][ C1] sd 0:0:1:0: tag#6016 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 477.980506][ C1] sd 0:0:1:0: tag#6016 CDB: opcode=0xe5 (vendor) 09:53:36 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x6, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10}) 09:53:36 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) mkdirat(r1, &(0x7f00000000c0)='./file0\x00', 0x0) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r3 = syz_io_uring_setup(0x3ede, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000140)) io_uring_enter(r3, 0x2ff, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x5, 0x0, &(0x7f0000000040)=""/18, 0xffffffde}, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, &(0x7f0000000dc0)=[{&(0x7f0000000100)="f4a4848461fb0592d2f8db4c1f3c9e408788e03d28fe5e69dbceea46dd67888cdedd07a068040b956c3af7", 0x2b}, {0x0}, {0x0}], 0x3, &(0x7f0000000540)=ANY=[@ANYBLOB="1400000000000000", @ANYRES32], 0x50}}, {{0x0, 0x0, &(0x7f0000003180)=[{0x0}, {0x0}], 0x2, &(0x7f00000002c0)=ANY=[@ANYBLOB="c9252cdfb191d94ef15953a086ed40b24a018fb18d39f9a1256b33cf339f1d1bb52846ddaaaecd492eb1d0774b26968a44bf794e9d902a3c02af9543bc4096ac7a27", @ANYRES32, @ANYRES32=0x0], 0x50, 0x4041}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYRESDEC, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000003000000000000000010000000100", @ANYRES32, @ANYRES64, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESDEC=r4], 0xd0, 0x20000000}}], 0x3, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x138, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {0x9effffff00000000}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x48, 0x1, {{'md5\x00'}}}]}, 0x138}}, 0x0) [ 477.986835][ C1] sd 0:0:1:0: tag#6016 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 477.995861][ C1] sd 0:0:1:0: tag#6016 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 478.004888][ C1] sd 0:0:1:0: tag#6016 CDB[20]: ba 09:53:36 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0x2000}}}, 0xf0}}, 0x0) [ 478.171863][ C1] sd 0:0:1:0: [sg_rq_end_io] Sense Key : Illegal Request [current] [ 478.179906][ C1] sd 0:0:1:0: [sg_rq_end_io] Add. Sense: Invalid command operation code [ 478.204463][ C0] sd 0:0:1:0: tag#6027 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 478.214305][ C0] sd 0:0:1:0: tag#6027 CDB: opcode=0xe5 (vendor) [ 478.220672][ C0] sd 0:0:1:0: tag#6027 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 478.229707][ C0] sd 0:0:1:0: tag#6027 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 478.238753][ C0] sd 0:0:1:0: tag#6027 CDB[20]: ba [ 478.252027][ C1] sd 0:0:1:0: tag#6065 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 478.261860][ C1] sd 0:0:1:0: tag#6065 CDB: opcode=0xe5 (vendor) [ 478.268173][ C1] sd 0:0:1:0: tag#6065 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 478.277180][ C1] sd 0:0:1:0: tag#6065 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 478.286188][ C1] sd 0:0:1:0: tag#6065 CDB[20]: ba [ 478.377575][T25114] loop2: detected capacity change from 0 to 16383 [ 478.413040][T25114] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 478.418404][T25114] loop2: p1 size 11290111 extends beyond EOD, truncated [ 478.426307][T25114] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 478.434100][T25114] loop2: p5 size 11290111 extends beyond EOD, truncated [ 478.441379][T25114] loop2: p6 size 1912633224 extends beyond EOD, truncated [ 478.530875][T25114] loop2: detected capacity change from 0 to 16383 [ 478.565951][T25114] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 478.571190][T25114] loop2: p1 size 11290111 extends beyond EOD, truncated 09:53:36 executing program 2: syz_read_part_table(0x0, 0x2, &(0x7f0000000100)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0000ffffff85000000060000000000024000ffffff82fdef00e100000088770072003007000f00000000000000008000da55aa", 0x40, 0x1c0}, {0x0, 0x0, 0xfffffffffffffffb}]) 09:53:36 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="55007a0018007f083ffe15b282a380930a03000248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) 09:53:36 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x6, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18}) 09:53:36 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) mkdirat(r1, &(0x7f00000000c0)='./file0\x00', 0x0) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r3 = syz_io_uring_setup(0x3ede, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000140)) io_uring_enter(r3, 0x2ff, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x5, 0x0, &(0x7f0000000040)=""/18, 0xffffffde}, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, &(0x7f0000000dc0)=[{&(0x7f0000000100)="f4a4848461fb0592d2f8db4c1f3c9e408788e03d28fe5e69dbceea46dd67888cdedd07a068040b956c3af7", 0x2b}, {0x0}, {0x0}], 0x3, &(0x7f0000000540)=ANY=[@ANYBLOB="1400000000000000", @ANYRES32], 0x50}}, {{0x0, 0x0, &(0x7f0000003180)=[{0x0}, {0x0}], 0x2, &(0x7f00000002c0)=ANY=[@ANYBLOB="c9252cdfb191d94ef15953a086ed40b24a018fb18d39f9a1256b33cf339f1d1bb52846ddaaaecd492eb1d0774b26968a44bf794e9d902a3c02af9543bc4096ac7a27", @ANYRES32, @ANYRES32=0x0], 0x50, 0x4041}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYRESDEC, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000003000000000000000010000000100", @ANYRES32, @ANYRES64, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESDEC=r4], 0xd0, 0x20000000}}], 0x3, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x138, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {0xb002000000000000}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x48, 0x1, {{'md5\x00'}}}]}, 0x138}}, 0x0) 09:53:36 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x9, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000e80)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) io_uring_enter(r1, 0x0, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x50}}], 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {}, {}, 0x3f00, 0x0, 0xa}, [@algo_auth={0x58, 0x1, {{'md5\x00'}, 0x80, "f959fb7b2a535a87359f0b633f54f881"}}]}, 0x148}}, 0x0) 09:53:36 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0x2500}}}, 0xf0}}, 0x0) [ 478.578867][T25114] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 478.586754][T25114] loop2: p5 size 11290111 extends beyond EOD, truncated [ 478.593953][T25114] loop2: p6 size 1912633224 extends beyond EOD, truncated 09:53:36 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x9, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000e80)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) io_uring_enter(r1, 0x0, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x50}}], 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {}, {}, 0x6202, 0x0, 0xa}, [@algo_auth={0x58, 0x1, {{'md5\x00'}, 0x80, "f959fb7b2a535a87359f0b633f54f881"}}]}, 0x148}}, 0x0) [ 478.648107][ C0] sd 0:0:1:0: tag#6059 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 478.657957][ C0] sd 0:0:1:0: tag#6059 CDB: opcode=0xe5 (vendor) [ 478.664327][ C0] sd 0:0:1:0: tag#6059 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 478.673378][ C0] sd 0:0:1:0: tag#6059 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 478.682428][ C0] sd 0:0:1:0: tag#6059 CDB[20]: ba [ 478.685997][ C1] sd 0:0:1:0: [sg_rq_end_io] Sense Key : Illegal Request [current] 09:53:36 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0x3300}}}, 0xf0}}, 0x0) 09:53:36 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x6, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x600}) 09:53:36 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="5501a60018007f083ffe15b282a380930a03000248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) 09:53:36 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) mkdirat(r1, &(0x7f00000000c0)='./file0\x00', 0x0) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r3 = syz_io_uring_setup(0x3ede, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000140)) io_uring_enter(r3, 0x2ff, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x5, 0x0, &(0x7f0000000040)=""/18, 0xffffffde}, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, &(0x7f0000000dc0)=[{&(0x7f0000000100)="f4a4848461fb0592d2f8db4c1f3c9e408788e03d28fe5e69dbceea46dd67888cdedd07a068040b956c3af7", 0x2b}, {0x0}, {0x0}], 0x3, &(0x7f0000000540)=ANY=[@ANYBLOB="1400000000000000", @ANYRES32], 0x50}}, {{0x0, 0x0, &(0x7f0000003180)=[{0x0}, {0x0}], 0x2, &(0x7f00000002c0)=ANY=[@ANYBLOB="c9252cdfb191d94ef15953a086ed40b24a018fb18d39f9a1256b33cf339f1d1bb52846ddaaaecd492eb1d0774b26968a44bf794e9d902a3c02af9543bc4096ac7a27", @ANYRES32, @ANYRES32=0x0], 0x50, 0x4041}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYRESDEC, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000003000000000000000010000000100", @ANYRES32, @ANYRES64, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESDEC=r4], 0xd0, 0x20000000}}], 0x3, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x138, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {0xeaffffff00000000}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x48, 0x1, {{'md5\x00'}}}]}, 0x138}}, 0x0) [ 478.695520][ C1] sd 0:0:1:0: [sg_rq_end_io] Add. Sense: Invalid command operation code 09:53:36 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x9, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000e80)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) io_uring_enter(r1, 0x0, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x50}}], 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {}, {}, 0x1000000, 0x0, 0xa}, [@algo_auth={0x58, 0x1, {{'md5\x00'}, 0x80, "f959fb7b2a535a87359f0b633f54f881"}}]}, 0x148}}, 0x0) [ 478.841161][ C1] sd 0:0:1:0: [sg_rq_end_io] Sense Key : Illegal Request [current] [ 478.849196][ C1] sd 0:0:1:0: [sg_rq_end_io] Add. Sense: Invalid command operation code [ 478.866132][ C0] sd 0:0:1:0: tag#6034 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 478.875979][ C0] sd 0:0:1:0: tag#6034 CDB: opcode=0xe5 (vendor) [ 478.882322][ C0] sd 0:0:1:0: tag#6034 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 478.891362][ C0] sd 0:0:1:0: tag#6034 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 478.900394][ C0] sd 0:0:1:0: tag#6034 CDB[20]: ba [ 478.912950][ C0] sd 0:0:1:0: tag#6073 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 478.922773][ C0] sd 0:0:1:0: tag#6073 CDB: opcode=0xe5 (vendor) [ 478.929112][ C0] sd 0:0:1:0: tag#6073 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 478.938145][ C0] sd 0:0:1:0: tag#6073 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 478.947195][ C0] sd 0:0:1:0: tag#6073 CDB[20]: ba [ 479.004811][T25145] loop2: detected capacity change from 0 to 16383 [ 479.050331][ T5592] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 479.055600][ T5592] loop2: p1 size 11290111 extends beyond EOD, truncated [ 479.063460][ T5592] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 479.071336][ T5592] loop2: p5 size 11290111 extends beyond EOD, truncated [ 479.078561][ T5592] loop2: p6 size 1912633224 extends beyond EOD, truncated [ 479.088547][T25145] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 479.093781][T25145] loop2: p1 size 11290111 extends beyond EOD, truncated [ 479.101469][T25145] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 479.109246][T25145] loop2: p5 size 11290111 extends beyond EOD, truncated [ 479.116606][T25145] loop2: p6 size 1912633224 extends beyond EOD, truncated 09:53:37 executing program 2: syz_read_part_table(0x0, 0x2, &(0x7f0000000100)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0000ffffff85000000060000000000024000ffffff82effd00e100000088770072003007000f00000000000000008000da55aa", 0x40, 0x1c0}, {0x0, 0x0, 0xfffffffffffffffb}]) 09:53:37 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0x3e01}}}, 0xf0}}, 0x0) 09:53:37 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x6, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x700}) 09:53:37 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="5501aa0018007f083ffe15b282a380930a03000248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) 09:53:37 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) mkdirat(r1, &(0x7f00000000c0)='./file0\x00', 0x0) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r3 = syz_io_uring_setup(0x3ede, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000140)) io_uring_enter(r3, 0x2ff, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x5, 0x0, &(0x7f0000000040)=""/18, 0xffffffde}, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, &(0x7f0000000dc0)=[{&(0x7f0000000100)="f4a4848461fb0592d2f8db4c1f3c9e408788e03d28fe5e69dbceea46dd67888cdedd07a068040b956c3af7", 0x2b}, {0x0}, {0x0}], 0x3, &(0x7f0000000540)=ANY=[@ANYBLOB="1400000000000000", @ANYRES32], 0x50}}, {{0x0, 0x0, &(0x7f0000003180)=[{0x0}, {0x0}], 0x2, &(0x7f00000002c0)=ANY=[@ANYBLOB="c9252cdfb191d94ef15953a086ed40b24a018fb18d39f9a1256b33cf339f1d1bb52846ddaaaecd492eb1d0774b26968a44bf794e9d902a3c02af9543bc4096ac7a27", @ANYRES32, @ANYRES32=0x0], 0x50, 0x4041}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYRESDEC, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000003000000000000000010000000100", @ANYRES32, @ANYRES64, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESDEC=r4], 0xd0, 0x20000000}}], 0x3, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x138, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {0xefffffff00000000}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x48, 0x1, {{'md5\x00'}}}]}, 0x138}}, 0x0) 09:53:37 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x9, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000e80)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) io_uring_enter(r1, 0x0, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x50}}], 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {}, {}, 0x2000000, 0x0, 0xa}, [@algo_auth={0x58, 0x1, {{'md5\x00'}, 0x80, "f959fb7b2a535a87359f0b633f54f881"}}]}, 0x148}}, 0x0) 09:53:37 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0x4800}}}, 0xf0}}, 0x0) [ 479.201112][T25151] __nla_validate_parse: 10 callbacks suppressed [ 479.201122][T25151] netlink: 224 bytes leftover after parsing attributes in process `syz-executor.4'. [ 479.225286][ C0] sd 0:0:1:0: tag#6026 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 479.235144][ C0] sd 0:0:1:0: tag#6026 CDB: opcode=0xe5 (vendor) [ 479.241510][ C0] sd 0:0:1:0: tag#6026 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c 09:53:37 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="556ebd0018007f083ffe15b282a380930a03000248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) 09:53:37 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x6, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x900}) 09:53:37 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x9, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000e80)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) io_uring_enter(r1, 0x0, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x50}}], 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {}, {}, 0x3000000, 0x0, 0xa}, [@algo_auth={0x58, 0x1, {{'md5\x00'}, 0x80, "f959fb7b2a535a87359f0b633f54f881"}}]}, 0x148}}, 0x0) 09:53:37 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) mkdirat(r1, &(0x7f00000000c0)='./file0\x00', 0x0) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r3 = syz_io_uring_setup(0x3ede, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000140)) io_uring_enter(r3, 0x2ff, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x5, 0x0, &(0x7f0000000040)=""/18, 0xffffffde}, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, &(0x7f0000000dc0)=[{&(0x7f0000000100)="f4a4848461fb0592d2f8db4c1f3c9e408788e03d28fe5e69dbceea46dd67888cdedd07a068040b956c3af7", 0x2b}, {0x0}, {0x0}], 0x3, &(0x7f0000000540)=ANY=[@ANYBLOB="1400000000000000", @ANYRES32], 0x50}}, {{0x0, 0x0, &(0x7f0000003180)=[{0x0}, {0x0}], 0x2, &(0x7f00000002c0)=ANY=[@ANYBLOB="c9252cdfb191d94ef15953a086ed40b24a018fb18d39f9a1256b33cf339f1d1bb52846ddaaaecd492eb1d0774b26968a44bf794e9d902a3c02af9543bc4096ac7a27", @ANYRES32, @ANYRES32=0x0], 0x50, 0x4041}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYRESDEC, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000003000000000000000010000000100", @ANYRES32, @ANYRES64, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESDEC=r4], 0xd0, 0x20000000}}], 0x3, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x138, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {0xf0ffffff00000000}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x48, 0x1, {{'md5\x00'}}}]}, 0x138}}, 0x0) [ 479.246075][ C1] sd 0:0:1:0: [sg_rq_end_io] Sense Key : Illegal Request [current] [ 479.250543][ C0] sd 0:0:1:0: tag#6026 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 479.258513][ C1] sd 0:0:1:0: [sg_rq_end_io] Add. Sense: Invalid command operation code [ 479.267532][ C0] sd 0:0:1:0: tag#6026 CDB[20]: ba 09:53:37 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0x4c00}}}, 0xf0}}, 0x0) [ 479.413085][T25165] netlink: 224 bytes leftover after parsing attributes in process `syz-executor.4'. [ 479.432543][T25167] loop2: detected capacity change from 0 to 16383 [ 479.446795][ C1] sd 0:0:1:0: [sg_rq_end_io] Sense Key : Illegal Request [current] [ 479.454817][ C1] sd 0:0:1:0: [sg_rq_end_io] Add. Sense: Invalid command operation code [ 479.483067][ T5592] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 479.488386][ T5592] loop2: p1 size 11290111 extends beyond EOD, truncated [ 479.496341][ T5592] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 479.504204][ T5592] loop2: p5 size 11290111 extends beyond EOD, truncated [ 479.511648][ T5592] loop2: p6 size 1912633224 extends beyond EOD, truncated [ 479.522342][T25167] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 479.527769][T25167] loop2: p1 size 11290111 extends beyond EOD, truncated [ 479.535597][T25167] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 479.543552][T25167] loop2: p5 size 11290111 extends beyond EOD, truncated [ 479.551005][T25167] loop2: p6 size 1912633224 extends beyond EOD, truncated [ 479.637988][T25174] netlink: 224 bytes leftover after parsing attributes in process `syz-executor.4'. [ 479.676769][T25167] loop2: detected capacity change from 0 to 16383 [ 479.720267][ T5592] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 479.725491][ T5592] loop2: p1 size 11290111 extends beyond EOD, truncated [ 479.733381][ T5592] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 479.741264][ T5592] loop2: p5 size 11290111 extends beyond EOD, truncated [ 479.748426][ T5592] loop2: p6 size 1912633224 extends beyond EOD, truncated [ 479.758240][T25167] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 479.763701][T25167] loop2: p1 size 11290111 extends beyond EOD, truncated 09:53:37 executing program 2: syz_read_part_table(0x0, 0x2, &(0x7f0000000100)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0000ffffff85000000060000000000024000ffffff82fffe00e100000088770072003007000f00000000000000008000da55aa", 0x40, 0x1c0}, {0x0, 0x0, 0xfffffffffffffffb}]) 09:53:37 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x9, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000e80)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) io_uring_enter(r1, 0x0, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x50}}], 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {}, {}, 0x4000000, 0x0, 0xa}, [@algo_auth={0x58, 0x1, {{'md5\x00'}, 0x80, "f959fb7b2a535a87359f0b633f54f881"}}]}, 0x148}}, 0x0) 09:53:37 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) mkdirat(r1, &(0x7f00000000c0)='./file0\x00', 0x0) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r3 = syz_io_uring_setup(0x3ede, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000140)) io_uring_enter(r3, 0x2ff, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x5, 0x0, &(0x7f0000000040)=""/18, 0xffffffde}, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, &(0x7f0000000dc0)=[{&(0x7f0000000100)="f4a4848461fb0592d2f8db4c1f3c9e408788e03d28fe5e69dbceea46dd67888cdedd07a068040b956c3af7", 0x2b}, {0x0}, {0x0}], 0x3, &(0x7f0000000540)=ANY=[@ANYBLOB="1400000000000000", @ANYRES32], 0x50}}, {{0x0, 0x0, &(0x7f0000003180)=[{0x0}, {0x0}], 0x2, &(0x7f00000002c0)=ANY=[@ANYBLOB="c9252cdfb191d94ef15953a086ed40b24a018fb18d39f9a1256b33cf339f1d1bb52846ddaaaecd492eb1d0774b26968a44bf794e9d902a3c02af9543bc4096ac7a27", @ANYRES32, @ANYRES32=0x0], 0x50, 0x4041}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYRESDEC, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000003000000000000000010000000100", @ANYRES32, @ANYRES64, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESDEC=r4], 0xd0, 0x20000000}}], 0x3, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x138, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {0xfcffffff00000000}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x48, 0x1, {{'md5\x00'}}}]}, 0x138}}, 0x0) 09:53:37 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="5500fc0018007f083ffe15b282a380930a03000248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) 09:53:37 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x6, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd00}) 09:53:37 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0x6000}}}, 0xf0}}, 0x0) [ 479.771455][T25167] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 479.779217][T25167] loop2: p5 size 11290111 extends beyond EOD, truncated [ 479.786626][T25167] loop2: p6 size 1912633224 extends beyond EOD, truncated 09:53:37 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x9, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000e80)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) io_uring_enter(r1, 0x0, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x50}}], 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {}, {}, 0x5000000, 0x0, 0xa}, [@algo_auth={0x58, 0x1, {{'md5\x00'}, 0x80, "f959fb7b2a535a87359f0b633f54f881"}}]}, 0x148}}, 0x0) 09:53:37 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="5500ff0018007f083ffe15b282a380930a03000248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) 09:53:37 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x6, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe00}) 09:53:37 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0x6800}}}, 0xf0}}, 0x0) 09:53:37 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) mkdirat(r1, &(0x7f00000000c0)='./file0\x00', 0x0) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r3 = syz_io_uring_setup(0x3ede, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000140)) io_uring_enter(r3, 0x2ff, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x5, 0x0, &(0x7f0000000040)=""/18, 0xffffffde}, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, &(0x7f0000000dc0)=[{&(0x7f0000000100)="f4a4848461fb0592d2f8db4c1f3c9e408788e03d28fe5e69dbceea46dd67888cdedd07a068040b956c3af7", 0x2b}, {0x0}, {0x0}], 0x3, &(0x7f0000000540)=ANY=[@ANYBLOB="1400000000000000", @ANYRES32], 0x50}}, {{0x0, 0x0, &(0x7f0000003180)=[{0x0}, {0x0}], 0x2, &(0x7f00000002c0)=ANY=[@ANYBLOB="c9252cdfb191d94ef15953a086ed40b24a018fb18d39f9a1256b33cf339f1d1bb52846ddaaaecd492eb1d0774b26968a44bf794e9d902a3c02af9543bc4096ac7a27", @ANYRES32, @ANYRES32=0x0], 0x50, 0x4041}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYRESDEC, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000003000000000000000010000000100", @ANYRES32, @ANYRES64, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESDEC=r4], 0xd0, 0x20000000}}], 0x3, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x138, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {0xfeffffff00000000}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x48, 0x1, {{'md5\x00'}}}]}, 0x138}}, 0x0) [ 479.840715][ C1] sd 0:0:1:0: [sg_rq_end_io] Sense Key : Illegal Request [current] [ 479.848764][ C1] sd 0:0:1:0: [sg_rq_end_io] Add. Sense: Invalid command operation code [ 479.866474][T25185] netlink: 224 bytes leftover after parsing attributes in process `syz-executor.4'. 09:53:38 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="5500000029007f083ffe15b282a380930a03000248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) 09:53:38 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x9, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000e80)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) io_uring_enter(r1, 0x0, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x50}}], 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {}, {}, 0x6000000, 0x0, 0xa}, [@algo_auth={0x58, 0x1, {{'md5\x00'}, 0x80, "f959fb7b2a535a87359f0b633f54f881"}}]}, 0x148}}, 0x0) [ 480.010152][ C1] sd 0:0:1:0: [sg_rq_end_io] Sense Key : Illegal Request [current] [ 480.018156][ C1] sd 0:0:1:0: [sg_rq_end_io] Add. Sense: Invalid command operation code [ 480.040672][T25197] netlink: 224 bytes leftover after parsing attributes in process `syz-executor.4'. [ 480.144060][T25203] loop2: detected capacity change from 0 to 16383 [ 480.163357][ T5592] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 480.166036][T25205] netlink: 49 bytes leftover after parsing attributes in process `syz-executor.5'. [ 480.168641][ T5592] loop2: p1 size 11290111 extends beyond EOD, truncated [ 480.196395][ T5592] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 480.204514][ T5592] loop2: p5 size 11290111 extends beyond EOD, truncated [ 480.212819][ T5592] loop2: p6 size 1912633224 extends beyond EOD, truncated [ 480.223402][T25203] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 480.228651][T25203] loop2: p1 size 11290111 extends beyond EOD, truncated [ 480.236348][T25203] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 480.244011][T25203] loop2: p5 size 11290111 extends beyond EOD, truncated [ 480.251444][T25203] loop2: p6 size 1912633224 extends beyond EOD, truncated [ 480.356179][T25203] loop2: detected capacity change from 0 to 16383 09:53:38 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0x6c00}}}, 0xf0}}, 0x0) 09:53:38 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x6, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1800}) 09:53:38 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) mkdirat(r1, &(0x7f00000000c0)='./file0\x00', 0x0) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r3 = syz_io_uring_setup(0x3ede, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000140)) io_uring_enter(r3, 0x2ff, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x5, 0x0, &(0x7f0000000040)=""/18, 0xffffffde}, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, &(0x7f0000000dc0)=[{&(0x7f0000000100)="f4a4848461fb0592d2f8db4c1f3c9e408788e03d28fe5e69dbceea46dd67888cdedd07a068040b956c3af7", 0x2b}, {0x0}, {0x0}], 0x3, &(0x7f0000000540)=ANY=[@ANYBLOB="1400000000000000", @ANYRES32], 0x50}}, {{0x0, 0x0, &(0x7f0000003180)=[{0x0}, {0x0}], 0x2, &(0x7f00000002c0)=ANY=[@ANYBLOB="c9252cdfb191d94ef15953a086ed40b24a018fb18d39f9a1256b33cf339f1d1bb52846ddaaaecd492eb1d0774b26968a44bf794e9d902a3c02af9543bc4096ac7a27", @ANYRES32, @ANYRES32=0x0], 0x50, 0x4041}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYRESDEC, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000003000000000000000010000000100", @ANYRES32, @ANYRES64, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESDEC=r4], 0xd0, 0x20000000}}], 0x3, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x138, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {0xffffff7f00000000}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x48, 0x1, {{'md5\x00'}}}]}, 0x138}}, 0x0) 09:53:38 executing program 2: syz_read_part_table(0x0, 0x2, &(0x7f0000000100)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0000ffffff85000000060000000000024000ffffff82feff00e100000088770072003007000f00000000000000008000da55aa", 0x40, 0x1c0}, {0x0, 0x0, 0xfffffffffffffffb}]) 09:53:38 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="5500000040007f083ffe15b282a380930a03000248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) 09:53:38 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x9, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000e80)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) io_uring_enter(r1, 0x0, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x50}}], 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {}, {}, 0x7000000, 0x0, 0xa}, [@algo_auth={0x58, 0x1, {{'md5\x00'}, 0x80, "f959fb7b2a535a87359f0b633f54f881"}}]}, 0x148}}, 0x0) [ 480.410646][T25203] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 480.415921][T25203] loop2: p1 size 11290111 extends beyond EOD, truncated [ 480.423596][T25203] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 480.431348][T25203] loop2: p5 size 11290111 extends beyond EOD, truncated [ 480.438570][T25203] loop2: p6 size 1912633224 extends beyond EOD, truncated 09:53:38 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0x7400}}}, 0xf0}}, 0x0) [ 480.486535][T25213] netlink: 224 bytes leftover after parsing attributes in process `syz-executor.4'. [ 480.509492][ C1] sd 0:0:1:0: [sg_rq_end_io] Sense Key : Illegal Request [current] [ 480.517506][ C1] sd 0:0:1:0: [sg_rq_end_io] Add. Sense: Invalid command operation code 09:53:38 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) mkdirat(r1, &(0x7f00000000c0)='./file0\x00', 0x0) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r3 = syz_io_uring_setup(0x3ede, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000140)) io_uring_enter(r3, 0x2ff, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x5, 0x0, &(0x7f0000000040)=""/18, 0xffffffde}, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, &(0x7f0000000dc0)=[{&(0x7f0000000100)="f4a4848461fb0592d2f8db4c1f3c9e408788e03d28fe5e69dbceea46dd67888cdedd07a068040b956c3af7", 0x2b}, {0x0}, {0x0}], 0x3, &(0x7f0000000540)=ANY=[@ANYBLOB="1400000000000000", @ANYRES32], 0x50}}, {{0x0, 0x0, &(0x7f0000003180)=[{0x0}, {0x0}], 0x2, &(0x7f00000002c0)=ANY=[@ANYBLOB="c9252cdfb191d94ef15953a086ed40b24a018fb18d39f9a1256b33cf339f1d1bb52846ddaaaecd492eb1d0774b26968a44bf794e9d902a3c02af9543bc4096ac7a27", @ANYRES32, @ANYRES32=0x0], 0x50, 0x4041}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYRESDEC, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000003000000000000000010000000100", @ANYRES32, @ANYRES64, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESDEC=r4], 0xd0, 0x20000000}}], 0x3, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x138, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {0xffffffff00000000}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x48, 0x1, {{'md5\x00'}}}]}, 0x138}}, 0x0) 09:53:38 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x9, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000e80)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) io_uring_enter(r1, 0x0, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x50}}], 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {}, {}, 0x8000000, 0x0, 0xa}, [@algo_auth={0x58, 0x1, {{'md5\x00'}, 0x80, "f959fb7b2a535a87359f0b633f54f881"}}]}, 0x148}}, 0x0) 09:53:38 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x6, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1d2b}) 09:53:38 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="5500000077007f083ffe15b282a380930a03000248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) [ 480.543700][T25217] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=64 sclass=netlink_route_socket pid=25217 comm=syz-executor.5 09:53:38 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0x7a00}}}, 0xf0}}, 0x0) [ 480.664451][T25225] netlink: 224 bytes leftover after parsing attributes in process `syz-executor.4'. 09:53:38 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x9, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000e80)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) io_uring_enter(r1, 0x0, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x50}}], 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {}, {}, 0x9000000, 0x0, 0xa}, [@algo_auth={0x58, 0x1, {{'md5\x00'}, 0x80, "f959fb7b2a535a87359f0b633f54f881"}}]}, 0x148}}, 0x0) 09:53:38 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x6, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2b1d}) 09:53:38 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) mkdirat(r1, &(0x7f00000000c0)='./file0\x00', 0x0) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r3 = syz_io_uring_setup(0x3ede, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000140)) io_uring_enter(r3, 0x2ff, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x5, 0x0, &(0x7f0000000040)=""/18, 0xffffffde}, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, &(0x7f0000000dc0)=[{&(0x7f0000000100)="f4a4848461fb0592d2f8db4c1f3c9e408788e03d28fe5e69dbceea46dd67888cdedd07a068040b956c3af7", 0x2b}, {0x0}, {0x0}], 0x3, &(0x7f0000000540)=ANY=[@ANYBLOB="1400000000000000", @ANYRES32], 0x50}}, {{0x0, 0x0, &(0x7f0000003180)=[{0x0}, {0x0}], 0x2, &(0x7f00000002c0)=ANY=[@ANYBLOB="c9252cdfb191d94ef15953a086ed40b24a018fb18d39f9a1256b33cf339f1d1bb52846ddaaaecd492eb1d0774b26968a44bf794e9d902a3c02af9543bc4096ac7a27", @ANYRES32, @ANYRES32=0x0], 0x50, 0x4041}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYRESDEC, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000003000000000000000010000000100", @ANYRES32, @ANYRES64, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESDEC=r4], 0xd0, 0x20000000}}], 0x3, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x138, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {0xffffffffffffffff}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x48, 0x1, {{'md5\x00'}}}]}, 0x138}}, 0x0) [ 480.704851][ C1] sd 0:0:1:0: [sg_rq_end_io] Sense Key : Illegal Request [current] [ 480.712889][ C1] sd 0:0:1:0: [sg_rq_end_io] Add. Sense: Invalid command operation code [ 480.739235][T25232] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=119 sclass=netlink_route_socket pid=25232 comm=syz-executor.5 [ 480.813687][T25233] loop2: detected capacity change from 0 to 16383 [ 480.843663][T25233] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 480.848919][T25233] loop2: p1 size 11290111 extends beyond EOD, truncated [ 480.856559][T25233] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 480.864801][T25237] netlink: 224 bytes leftover after parsing attributes in process `syz-executor.4'. [ 480.869622][T25233] loop2: p5 size 11290111 extends beyond EOD, truncated [ 480.882288][T25233] loop2: p6 size 1912633224 extends beyond EOD, truncated [ 480.931055][ C1] sd 0:0:1:0: [sg_rq_end_io] Sense Key : Illegal Request [current] [ 480.939144][ C1] sd 0:0:1:0: [sg_rq_end_io] Add. Sense: Invalid command operation code 09:53:39 executing program 2: syz_read_part_table(0x0, 0x2, &(0x7f0000000100)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0000ffffff85000000060000000000024000ffffff82000200e100000088770072003007000f00000000000000008000da55aa", 0x40, 0x1c0}, {0x0, 0x0, 0xfffffffffffffffb}]) 09:53:39 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="5500020018007f083ffe15b282a380930a03000248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) 09:53:39 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0xc00e}}}, 0xf0}}, 0x0) 09:53:39 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x9, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000e80)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) io_uring_enter(r1, 0x0, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x50}}], 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {}, {}, 0xa000000, 0x0, 0xa}, [@algo_auth={0x58, 0x1, {{'md5\x00'}, 0x80, "f959fb7b2a535a87359f0b633f54f881"}}]}, 0x148}}, 0x0) 09:53:39 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x6, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000}) 09:53:39 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) mkdirat(r1, &(0x7f00000000c0)='./file0\x00', 0x0) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r3 = syz_io_uring_setup(0x3ede, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000140)) io_uring_enter(r3, 0x2ff, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x5, 0x0, &(0x7f0000000040)=""/18, 0xffffffde}, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, &(0x7f0000000dc0)=[{&(0x7f0000000100)="f4a4848461fb0592d2f8db4c1f3c9e408788e03d28fe5e69dbceea46dd67888cdedd07a068040b956c3af7", 0x2b}, {0x0}, {0x0}], 0x3, &(0x7f0000000540)=ANY=[@ANYBLOB="1400000000000000", @ANYRES32], 0x50}}, {{0x0, 0x0, &(0x7f0000003180)=[{0x0}, {0x0}], 0x2, &(0x7f00000002c0)=ANY=[@ANYBLOB="c9252cdfb191d94ef15953a086ed40b24a018fb18d39f9a1256b33cf339f1d1bb52846ddaaaecd492eb1d0774b26968a44bf794e9d902a3c02af9543bc4096ac7a27", @ANYRES32, @ANYRES32=0x0], 0x50, 0x4041}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYRESDEC, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000003000000000000000010000000100", @ANYRES32, @ANYRES64, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESDEC=r4], 0xd0, 0x20000000}}], 0x3, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x138, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {0x0, 0x2}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x48, 0x1, {{'md5\x00'}}}]}, 0x138}}, 0x0) 09:53:39 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="5500030018007f083ffe15b282a380930a03000248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) 09:53:39 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0x34000}}}, 0xf0}}, 0x0) [ 481.066927][T25249] netlink: 224 bytes leftover after parsing attributes in process `syz-executor.4'. 09:53:39 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x9, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000e80)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) io_uring_enter(r1, 0x0, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x50}}], 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {}, {}, 0xb000000, 0x0, 0xa}, [@algo_auth={0x58, 0x1, {{'md5\x00'}, 0x80, "f959fb7b2a535a87359f0b633f54f881"}}]}, 0x148}}, 0x0) 09:53:39 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x6, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e", 0x0, 0x0, 0x0, 0x0, 0x0}) 09:53:39 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) mkdirat(r1, &(0x7f00000000c0)='./file0\x00', 0x0) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r3 = syz_io_uring_setup(0x3ede, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000140)) io_uring_enter(r3, 0x2ff, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x5, 0x0, &(0x7f0000000040)=""/18, 0xffffffde}, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, &(0x7f0000000dc0)=[{&(0x7f0000000100)="f4a4848461fb0592d2f8db4c1f3c9e408788e03d28fe5e69dbceea46dd67888cdedd07a068040b956c3af7", 0x2b}, {0x0}, {0x0}], 0x3, &(0x7f0000000540)=ANY=[@ANYBLOB="1400000000000000", @ANYRES32], 0x50}}, {{0x0, 0x0, &(0x7f0000003180)=[{0x0}, {0x0}], 0x2, &(0x7f00000002c0)=ANY=[@ANYBLOB="c9252cdfb191d94ef15953a086ed40b24a018fb18d39f9a1256b33cf339f1d1bb52846ddaaaecd492eb1d0774b26968a44bf794e9d902a3c02af9543bc4096ac7a27", @ANYRES32, @ANYRES32=0x0], 0x50, 0x4041}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYRESDEC, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000003000000000000000010000000100", @ANYRES32, @ANYRES64, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESDEC=r4], 0xd0, 0x20000000}}], 0x3, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x138, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {0x0, 0x3}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x48, 0x1, {{'md5\x00'}}}]}, 0x138}}, 0x0) [ 481.180573][ C1] sd 0:0:1:0: [sg_rq_end_io] Sense Key : Illegal Request [current] [ 481.188607][ C1] sd 0:0:1:0: [sg_rq_end_io] Add. Sense: Invalid command operation code 09:53:39 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="5500040018007f083ffe15b282a380930a03000248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) [ 481.334216][T25269] loop2: detected capacity change from 0 to 16383 [ 481.379458][ T5592] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 481.384724][ T5592] loop2: p1 size 11290111 extends beyond EOD, truncated [ 481.392838][ T5592] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 481.393547][ C1] sd 0:0:1:0: [sg_rq_end_io] Sense Key : Illegal Request [current] [ 481.401149][ T5592] loop2: p5 size 11290111 extends beyond EOD, [ 481.407971][ C1] sd 0:0:1:0: [sg_rq_end_io] Add. Sense: Invalid command operation code [ 481.422485][ T5592] truncated [ 481.425886][ T5592] loop2: p6 size 1912633224 extends beyond EOD, truncated [ 481.435464][T25269] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 481.440712][T25269] loop2: p1 size 11290111 extends beyond EOD, truncated [ 481.448504][T25269] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 481.456429][T25269] loop2: p5 size 11290111 extends beyond EOD, truncated [ 481.463957][T25269] loop2: p6 size 1912633224 extends beyond EOD, truncated [ 481.590478][T25269] loop2: detected capacity change from 0 to 16383 [ 481.626962][ T5592] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 481.632182][ T5592] loop2: p1 size 11290111 extends beyond EOD, truncated [ 481.640024][ T5592] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 481.647896][ T5592] loop2: p5 size 11290111 extends beyond EOD, truncated [ 481.655093][ T5592] loop2: p6 size 1912633224 extends beyond EOD, truncated [ 481.664760][T25269] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 481.670002][T25269] loop2: p1 size 11290111 extends beyond EOD, truncated [ 481.677658][T25269] loop2: p3 size 1912633224 extends beyond EOD, truncated 09:53:39 executing program 2: syz_read_part_table(0x0, 0x2, &(0x7f0000000100)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0000ffffff85000000060000000000024000ffffff82000300e100000088770072003007000f00000000000000008000da55aa", 0x40, 0x1c0}, {0x0, 0x0, 0xfffffffffffffffb}]) 09:53:39 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x6, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) 09:53:39 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x9, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000e80)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) io_uring_enter(r1, 0x0, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x50}}], 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {}, {}, 0x10000000, 0x0, 0xa}, [@algo_auth={0x58, 0x1, {{'md5\x00'}, 0x80, "f959fb7b2a535a87359f0b633f54f881"}}]}, 0x148}}, 0x0) 09:53:39 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) mkdirat(r1, &(0x7f00000000c0)='./file0\x00', 0x0) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r3 = syz_io_uring_setup(0x3ede, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000140)) io_uring_enter(r3, 0x2ff, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x5, 0x0, &(0x7f0000000040)=""/18, 0xffffffde}, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, &(0x7f0000000dc0)=[{&(0x7f0000000100)="f4a4848461fb0592d2f8db4c1f3c9e408788e03d28fe5e69dbceea46dd67888cdedd07a068040b956c3af7", 0x2b}, {0x0}, {0x0}], 0x3, &(0x7f0000000540)=ANY=[@ANYBLOB="1400000000000000", @ANYRES32], 0x50}}, {{0x0, 0x0, &(0x7f0000003180)=[{0x0}, {0x0}], 0x2, &(0x7f00000002c0)=ANY=[@ANYBLOB="c9252cdfb191d94ef15953a086ed40b24a018fb18d39f9a1256b33cf339f1d1bb52846ddaaaecd492eb1d0774b26968a44bf794e9d902a3c02af9543bc4096ac7a27", @ANYRES32, @ANYRES32=0x0], 0x50, 0x4041}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYRESDEC, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000003000000000000000010000000100", @ANYRES32, @ANYRES64, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESDEC=r4], 0xd0, 0x20000000}}], 0x3, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x138, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {0x0, 0x4}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x48, 0x1, {{'md5\x00'}}}]}, 0x138}}, 0x0) 09:53:39 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0x400300}}}, 0xf0}}, 0x0) 09:53:39 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="5500050018007f083ffe15b282a380930a03000248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) [ 481.685400][T25269] loop2: p5 size 11290111 extends beyond EOD, truncated [ 481.692704][T25269] loop2: p6 size 1912633224 extends beyond EOD, truncated 09:53:39 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000}}}, 0xf0}}, 0x0) 09:53:39 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="5500060018007f083ffe15b282a380930a03000248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) 09:53:39 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x9, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000e80)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) io_uring_enter(r1, 0x0, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x50}}], 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {}, {}, 0x11000000, 0x0, 0xa}, [@algo_auth={0x58, 0x1, {{'md5\x00'}, 0x80, "f959fb7b2a535a87359f0b633f54f881"}}]}, 0x148}}, 0x0) 09:53:39 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) mkdirat(r1, &(0x7f00000000c0)='./file0\x00', 0x0) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r3 = syz_io_uring_setup(0x3ede, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000140)) io_uring_enter(r3, 0x2ff, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x5, 0x0, &(0x7f0000000040)=""/18, 0xffffffde}, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, &(0x7f0000000dc0)=[{&(0x7f0000000100)="f4a4848461fb0592d2f8db4c1f3c9e408788e03d28fe5e69dbceea46dd67888cdedd07a068040b956c3af7", 0x2b}, {0x0}, {0x0}], 0x3, &(0x7f0000000540)=ANY=[@ANYBLOB="1400000000000000", @ANYRES32], 0x50}}, {{0x0, 0x0, &(0x7f0000003180)=[{0x0}, {0x0}], 0x2, &(0x7f00000002c0)=ANY=[@ANYBLOB="c9252cdfb191d94ef15953a086ed40b24a018fb18d39f9a1256b33cf339f1d1bb52846ddaaaecd492eb1d0774b26968a44bf794e9d902a3c02af9543bc4096ac7a27", @ANYRES32, @ANYRES32=0x0], 0x50, 0x4041}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYRESDEC, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000003000000000000000010000000100", @ANYRES32, @ANYRES64, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESDEC=r4], 0xd0, 0x20000000}}], 0x3, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x138, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {0x0, 0x5}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x48, 0x1, {{'md5\x00'}}}]}, 0x138}}, 0x0) 09:53:39 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x6, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}) [ 481.757670][ C1] sd 0:0:1:0: [sg_rq_end_io] Sense Key : Illegal Request [current] [ 481.765694][ C1] sd 0:0:1:0: [sg_rq_end_io] Add. Sense: Invalid command operation code 09:53:39 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="5500070018007f083ffe15b282a380930a03000248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) [ 481.948966][ C1] sd 0:0:1:0: [sg_rq_end_io] Sense Key : Illegal Request [current] [ 481.957002][ C1] sd 0:0:1:0: [sg_rq_end_io] Add. Sense: Invalid command operation code [ 482.019919][T25301] loop2: detected capacity change from 0 to 16383 [ 482.059729][ T5552] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 482.065012][ T5552] loop2: p1 size 11290111 extends beyond EOD, truncated [ 482.072699][ T5552] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 482.081257][ T5552] loop2: p5 size 11290111 extends beyond EOD, truncated [ 482.088696][ T5552] loop2: p6 size 1912633224 extends beyond EOD, truncated [ 482.102151][T25301] loop_reread_partitions: partition scan of loop2 () failed (rc=-16) [ 482.241478][T25301] loop2: detected capacity change from 0 to 16383 [ 482.286464][ T5592] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 482.291722][ T5592] loop2: p1 size 11290111 extends beyond EOD, truncated [ 482.299611][ T5592] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 482.307658][ T5592] loop2: p5 size 11290111 extends beyond EOD, truncated [ 482.315067][ T5592] loop2: p6 size 1912633224 extends beyond EOD, truncated [ 482.324744][T25301] loop2: p1 p2 < > p3 p4 < p5 p6 > 09:53:40 executing program 2: syz_read_part_table(0x0, 0x2, &(0x7f0000000100)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0000ffffff85000000060000000000024000ffffff82000400e100000088770072003007000f00000000000000008000da55aa", 0x40, 0x1c0}, {0x0, 0x0, 0xfffffffffffffffb}]) 09:53:40 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x9, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000e80)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) io_uring_enter(r1, 0x0, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x50}}], 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {}, {}, 0x14000000, 0x0, 0xa}, [@algo_auth={0x58, 0x1, {{'md5\x00'}, 0x80, "f959fb7b2a535a87359f0b633f54f881"}}]}, 0x148}}, 0x0) 09:53:40 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) mkdirat(r1, &(0x7f00000000c0)='./file0\x00', 0x0) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r3 = syz_io_uring_setup(0x3ede, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000140)) io_uring_enter(r3, 0x2ff, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x5, 0x0, &(0x7f0000000040)=""/18, 0xffffffde}, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, &(0x7f0000000dc0)=[{&(0x7f0000000100)="f4a4848461fb0592d2f8db4c1f3c9e408788e03d28fe5e69dbceea46dd67888cdedd07a068040b956c3af7", 0x2b}, {0x0}, {0x0}], 0x3, &(0x7f0000000540)=ANY=[@ANYBLOB="1400000000000000", @ANYRES32], 0x50}}, {{0x0, 0x0, &(0x7f0000003180)=[{0x0}, {0x0}], 0x2, &(0x7f00000002c0)=ANY=[@ANYBLOB="c9252cdfb191d94ef15953a086ed40b24a018fb18d39f9a1256b33cf339f1d1bb52846ddaaaecd492eb1d0774b26968a44bf794e9d902a3c02af9543bc4096ac7a27", @ANYRES32, @ANYRES32=0x0], 0x50, 0x4041}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYRESDEC, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000003000000000000000010000000100", @ANYRES32, @ANYRES64, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESDEC=r4], 0xd0, 0x20000000}}], 0x3, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x138, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {0x0, 0x6}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x48, 0x1, {{'md5\x00'}}}]}, 0x138}}, 0x0) 09:53:40 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x6, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}) 09:53:40 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000}}}, 0xf0}}, 0x0) 09:53:40 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="5500080018007f083ffe15b282a380930a03000248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) [ 482.330086][T25301] loop2: p1 size 11290111 extends beyond EOD, truncated [ 482.337533][T25301] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 482.345394][T25301] loop2: p5 size 11290111 extends beyond EOD, truncated [ 482.352784][T25301] loop2: p6 size 1912633224 extends beyond EOD, truncated 09:53:40 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="5500090018007f083ffe15b282a380930a03000248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) 09:53:40 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0x3000000}}}, 0xf0}}, 0x0) [ 482.413100][ C0] scsi_io_completion_action: 17 callbacks suppressed [ 482.413127][ C0] sd 0:0:1:0: tag#6032 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 482.429676][ C0] sd 0:0:1:0: tag#6032 CDB: opcode=0xe5 (vendor) [ 482.436121][ C0] sd 0:0:1:0: tag#6032 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 482.441370][ C1] sd 0:0:1:0: [sg_rq_end_io] Sense Key : Illegal Request [current] [ 482.445158][ C0] sd 0:0:1:0: tag#6032 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d 09:53:40 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x6, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}) 09:53:40 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x9, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000e80)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) io_uring_enter(r1, 0x0, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x50}}], 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {}, {}, 0x20000000, 0x0, 0xa}, [@algo_auth={0x58, 0x1, {{'md5\x00'}, 0x80, "f959fb7b2a535a87359f0b633f54f881"}}]}, 0x148}}, 0x0) 09:53:40 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) mkdirat(r1, &(0x7f00000000c0)='./file0\x00', 0x0) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r3 = syz_io_uring_setup(0x3ede, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000140)) io_uring_enter(r3, 0x2ff, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x5, 0x0, &(0x7f0000000040)=""/18, 0xffffffde}, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, &(0x7f0000000dc0)=[{&(0x7f0000000100)="f4a4848461fb0592d2f8db4c1f3c9e408788e03d28fe5e69dbceea46dd67888cdedd07a068040b956c3af7", 0x2b}, {0x0}, {0x0}], 0x3, &(0x7f0000000540)=ANY=[@ANYBLOB="1400000000000000", @ANYRES32], 0x50}}, {{0x0, 0x0, &(0x7f0000003180)=[{0x0}, {0x0}], 0x2, &(0x7f00000002c0)=ANY=[@ANYBLOB="c9252cdfb191d94ef15953a086ed40b24a018fb18d39f9a1256b33cf339f1d1bb52846ddaaaecd492eb1d0774b26968a44bf794e9d902a3c02af9543bc4096ac7a27", @ANYRES32, @ANYRES32=0x0], 0x50, 0x4041}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYRESDEC, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000003000000000000000010000000100", @ANYRES32, @ANYRES64, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESDEC=r4], 0xd0, 0x20000000}}], 0x3, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x138, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {0x0, 0x7}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x48, 0x1, {{'md5\x00'}}}]}, 0x138}}, 0x0) [ 482.453145][ C1] sd 0:0:1:0: [sg_rq_end_io] Add. Sense: Invalid command operation code [ 482.462160][ C0] sd 0:0:1:0: tag#6032 CDB[20]: ba 09:53:40 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="55000a0018007f083ffe15b282a380930a03000248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) [ 482.627927][ C1] sd 0:0:1:0: [sg_rq_end_io] Sense Key : Illegal Request [current] [ 482.635966][ C1] sd 0:0:1:0: [sg_rq_end_io] Add. Sense: Invalid command operation code [ 482.655220][ C0] sd 0:0:1:0: tag#6060 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 482.665064][ C0] sd 0:0:1:0: tag#6060 CDB: opcode=0xe5 (vendor) [ 482.671592][ C0] sd 0:0:1:0: tag#6060 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 482.680645][ C0] sd 0:0:1:0: tag#6060 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 482.689682][ C0] sd 0:0:1:0: tag#6060 CDB[20]: ba [ 482.742737][T16174] udevd[16174]: inotify_add_watch(7, /dev/loop2p4, 10) failed: No such file or directory [ 482.742699][ T5428] udevd[5428]: inotify_add_watch(7, /dev/loop2p2, 10) failed: No such file or directory [ 482.755402][T13989] udevd[13989]: inotify_add_watch(7, /dev/loop2p3, 10) failed: No such file or directory [ 482.763961][ T5551] udevd[5551]: inotify_add_watch(7, /dev/loop2p6, 10) failed: No such file or directory [ 482.773551][ T5552] udevd[5552]: inotify_add_watch(7, /dev/loop2p5, 10) failed: No such file or directory [ 482.783016][ T5592] udevd[5592]: inotify_add_watch(7, /dev/loop2p1, 10) failed: No such file or directory [ 482.804862][ T5592] udevd[5592]: inotify_add_watch(7, /dev/loop2p1, 10) failed: No such file or directory [ 482.804979][T13989] udevd[13989]: inotify_add_watch(7, /dev/loop2p3, 10) failed: No such file or directory [ 482.816021][ T5428] udevd[5428]: inotify_add_watch(7, /dev/loop2p2, 10) failed: No such file or directory [ 482.825644][T16174] udevd[16174]: inotify_add_watch(7, /dev/loop2p4, 10) failed: No such file or directory [ 482.875966][T25334] loop2: detected capacity change from 0 to 16383 [ 482.925396][ T5592] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 482.930630][ T5592] loop2: p1 size 11290111 extends beyond EOD, truncated [ 482.938461][ T5592] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 482.946219][ T5592] loop2: p5 size 11290111 extends beyond EOD, truncated [ 482.953364][ T5592] loop2: p6 size 1912633224 extends beyond EOD, truncated [ 482.963337][T25334] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 482.968660][T25334] loop2: p1 size 11290111 extends beyond EOD, truncated [ 482.976284][T25334] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 482.983948][T25334] loop2: p5 size 11290111 extends beyond EOD, truncated [ 482.991201][T25334] loop2: p6 size 1912633224 extends beyond EOD, truncated 09:53:41 executing program 2: syz_read_part_table(0x0, 0x2, &(0x7f0000000100)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0000ffffff85000000060000000000024000ffffff82000500e100000088770072003007000f00000000000000008000da55aa", 0x40, 0x1c0}, {0x0, 0x0, 0xfffffffffffffffb}]) 09:53:41 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000}}}, 0xf0}}, 0x0) 09:53:41 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x6, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd}) 09:53:41 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x9, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000e80)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) io_uring_enter(r1, 0x0, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x50}}], 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {}, {}, 0x3f000000, 0x0, 0xa}, [@algo_auth={0x58, 0x1, {{'md5\x00'}, 0x80, "f959fb7b2a535a87359f0b633f54f881"}}]}, 0x148}}, 0x0) 09:53:41 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) mkdirat(r1, &(0x7f00000000c0)='./file0\x00', 0x0) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r3 = syz_io_uring_setup(0x3ede, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000140)) io_uring_enter(r3, 0x2ff, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x5, 0x0, &(0x7f0000000040)=""/18, 0xffffffde}, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, &(0x7f0000000dc0)=[{&(0x7f0000000100)="f4a4848461fb0592d2f8db4c1f3c9e408788e03d28fe5e69dbceea46dd67888cdedd07a068040b956c3af7", 0x2b}, {0x0}, {0x0}], 0x3, &(0x7f0000000540)=ANY=[@ANYBLOB="1400000000000000", @ANYRES32], 0x50}}, {{0x0, 0x0, &(0x7f0000003180)=[{0x0}, {0x0}], 0x2, &(0x7f00000002c0)=ANY=[@ANYBLOB="c9252cdfb191d94ef15953a086ed40b24a018fb18d39f9a1256b33cf339f1d1bb52846ddaaaecd492eb1d0774b26968a44bf794e9d902a3c02af9543bc4096ac7a27", @ANYRES32, @ANYRES32=0x0], 0x50, 0x4041}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYRESDEC, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000003000000000000000010000000100", @ANYRES32, @ANYRES64, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESDEC=r4], 0xd0, 0x20000000}}], 0x3, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x138, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {0x0, 0x8}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x48, 0x1, {{'md5\x00'}}}]}, 0x138}}, 0x0) 09:53:41 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="55000b0018007f083ffe15b282a380930a03000248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) [ 483.110555][ C1] sd 0:0:1:0: [sg_rq_end_io] Sense Key : Illegal Request [current] [ 483.118697][ C1] sd 0:0:1:0: [sg_rq_end_io] Add. Sense: Invalid command operation code [ 483.131826][ C0] sd 0:0:1:0: tag#6032 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 483.141669][ C0] sd 0:0:1:0: tag#6032 CDB: opcode=0xe5 (vendor) [ 483.148007][ C0] sd 0:0:1:0: tag#6032 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c 09:53:41 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x6, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe}) 09:53:41 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="55000c0018007f083ffe15b282a380930a03000248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) 09:53:41 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x9, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000e80)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) io_uring_enter(r1, 0x0, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x50}}], 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {}, {}, 0x62020000, 0x0, 0xa}, [@algo_auth={0x58, 0x1, {{'md5\x00'}, 0x80, "f959fb7b2a535a87359f0b633f54f881"}}]}, 0x148}}, 0x0) 09:53:41 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0x5000000}}}, 0xf0}}, 0x0) [ 483.157091][ C0] sd 0:0:1:0: tag#6032 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 483.166133][ C0] sd 0:0:1:0: tag#6032 CDB[20]: ba [ 483.186760][ C0] sd 0:0:1:0: tag#6018 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 483.196617][ C0] sd 0:0:1:0: tag#6018 CDB: opcode=0xe5 (vendor) 09:53:41 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) mkdirat(r1, &(0x7f00000000c0)='./file0\x00', 0x0) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r3 = syz_io_uring_setup(0x3ede, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000140)) io_uring_enter(r3, 0x2ff, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x5, 0x0, &(0x7f0000000040)=""/18, 0xffffffde}, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, &(0x7f0000000dc0)=[{&(0x7f0000000100)="f4a4848461fb0592d2f8db4c1f3c9e408788e03d28fe5e69dbceea46dd67888cdedd07a068040b956c3af7", 0x2b}, {0x0}, {0x0}], 0x3, &(0x7f0000000540)=ANY=[@ANYBLOB="1400000000000000", @ANYRES32], 0x50}}, {{0x0, 0x0, &(0x7f0000003180)=[{0x0}, {0x0}], 0x2, &(0x7f00000002c0)=ANY=[@ANYBLOB="c9252cdfb191d94ef15953a086ed40b24a018fb18d39f9a1256b33cf339f1d1bb52846ddaaaecd492eb1d0774b26968a44bf794e9d902a3c02af9543bc4096ac7a27", @ANYRES32, @ANYRES32=0x0], 0x50, 0x4041}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYRESDEC, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000003000000000000000010000000100", @ANYRES32, @ANYRES64, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESDEC=r4], 0xd0, 0x20000000}}], 0x3, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x138, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {0x0, 0x9}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x48, 0x1, {{'md5\x00'}}}]}, 0x138}}, 0x0) [ 483.202964][ C0] sd 0:0:1:0: tag#6018 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 483.212002][ C0] sd 0:0:1:0: tag#6018 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 483.221031][ C0] sd 0:0:1:0: tag#6018 CDB[20]: ba 09:53:41 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x6, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10}) [ 483.296050][ C1] sd 0:0:1:0: [sg_rq_end_io] Sense Key : Illegal Request [current] [ 483.304049][ C1] sd 0:0:1:0: [sg_rq_end_io] Add. Sense: Invalid command operation code [ 483.444974][ C0] sd 0:0:1:0: tag#6039 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 483.454796][ C0] sd 0:0:1:0: tag#6039 CDB: opcode=0xe5 (vendor) [ 483.458492][T25359] loop2: detected capacity change from 0 to 16383 [ 483.461131][ C0] sd 0:0:1:0: tag#6039 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 483.476594][ C0] sd 0:0:1:0: tag#6039 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 483.485620][ C0] sd 0:0:1:0: tag#6039 CDB[20]: ba [ 483.499084][ C1] sd 0:0:1:0: tag#6072 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 483.508912][ C1] sd 0:0:1:0: tag#6072 CDB: opcode=0xe5 (vendor) [ 483.515262][ C1] sd 0:0:1:0: tag#6072 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 483.524267][ C1] sd 0:0:1:0: tag#6072 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 483.533292][ C1] sd 0:0:1:0: tag#6072 CDB[20]: ba [ 483.539133][ T5592] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 483.544465][ T5592] loop2: p1 size 11290111 extends beyond EOD, truncated [ 483.552255][ T5592] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 483.561938][ T5592] loop2: p5 size 11290111 extends beyond EOD, truncated [ 483.570109][ T5592] loop2: p6 size 1912633224 extends beyond EOD, truncated [ 483.579421][ C1] sd 0:0:1:0: [sg_rq_end_io] Sense Key : Illegal Request [current] [ 483.587419][ C1] sd 0:0:1:0: [sg_rq_end_io] Add. Sense: Invalid command operation code [ 483.599280][T25359] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 483.604553][T25359] loop2: p1 size 11290111 extends beyond EOD, truncated [ 483.612282][T25359] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 483.620706][T25359] loop2: p5 size 11290111 extends beyond EOD, truncated [ 483.628052][T25359] loop2: p6 size 1912633224 extends beyond EOD, truncated [ 483.746178][T25359] loop2: detected capacity change from 0 to 16383 [ 483.811658][ T5592] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 483.817023][ T5592] loop2: p1 size 11290111 extends beyond EOD, truncated [ 483.824591][ T5592] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 483.832222][ T5592] loop2: p5 size 11290111 extends beyond EOD, truncated [ 483.839459][ T5592] loop2: p6 size 1912633224 extends beyond EOD, truncated [ 483.849107][T25359] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 483.854340][T25359] loop2: p1 size 11290111 extends beyond EOD, truncated 09:53:41 executing program 2: syz_read_part_table(0x0, 0x2, &(0x7f0000000100)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0000ffffff85000000060000000000024000ffffff82000600e100000088770072003007000f00000000000000008000da55aa", 0x40, 0x1c0}, {0x0, 0x0, 0xfffffffffffffffb}]) 09:53:41 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="55000d0018007f083ffe15b282a380930a03000248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) 09:53:41 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x9, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000e80)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) io_uring_enter(r1, 0x0, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x50}}], 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {}, {}, 0x9effffff, 0x0, 0xa}, [@algo_auth={0x58, 0x1, {{'md5\x00'}, 0x80, "f959fb7b2a535a87359f0b633f54f881"}}]}, 0x148}}, 0x0) 09:53:41 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0x6000000}}}, 0xf0}}, 0x0) 09:53:41 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) mkdirat(r1, &(0x7f00000000c0)='./file0\x00', 0x0) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r3 = syz_io_uring_setup(0x3ede, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000140)) io_uring_enter(r3, 0x2ff, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x5, 0x0, &(0x7f0000000040)=""/18, 0xffffffde}, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, &(0x7f0000000dc0)=[{&(0x7f0000000100)="f4a4848461fb0592d2f8db4c1f3c9e408788e03d28fe5e69dbceea46dd67888cdedd07a068040b956c3af7", 0x2b}, {0x0}, {0x0}], 0x3, &(0x7f0000000540)=ANY=[@ANYBLOB="1400000000000000", @ANYRES32], 0x50}}, {{0x0, 0x0, &(0x7f0000003180)=[{0x0}, {0x0}], 0x2, &(0x7f00000002c0)=ANY=[@ANYBLOB="c9252cdfb191d94ef15953a086ed40b24a018fb18d39f9a1256b33cf339f1d1bb52846ddaaaecd492eb1d0774b26968a44bf794e9d902a3c02af9543bc4096ac7a27", @ANYRES32, @ANYRES32=0x0], 0x50, 0x4041}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYRESDEC, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000003000000000000000010000000100", @ANYRES32, @ANYRES64, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESDEC=r4], 0xd0, 0x20000000}}], 0x3, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x138, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {0x0, 0xa}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x48, 0x1, {{'md5\x00'}}}]}, 0x138}}, 0x0) 09:53:41 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x6, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18}) [ 483.862070][T25359] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 483.869845][T25359] loop2: p5 size 11290111 extends beyond EOD, truncated [ 483.877107][T25359] loop2: p6 size 1912633224 extends beyond EOD, truncated [ 483.947775][ C0] sd 0:0:1:0: tag#6027 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 483.957637][ C0] sd 0:0:1:0: tag#6027 CDB: opcode=0xe5 (vendor) [ 483.963996][ C0] sd 0:0:1:0: tag#6027 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 483.973038][ C0] sd 0:0:1:0: tag#6027 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 483.979440][ C1] sd 0:0:1:0: [sg_rq_end_io] Sense Key : Illegal Request [current] [ 483.982081][ C0] sd 0:0:1:0: tag#6027 CDB[20]: ba 09:53:41 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x9, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000e80)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) io_uring_enter(r1, 0x0, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x50}}], 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {}, {}, 0xeaffffff, 0x0, 0xa}, [@algo_auth={0x58, 0x1, {{'md5\x00'}, 0x80, "f959fb7b2a535a87359f0b633f54f881"}}]}, 0x148}}, 0x0) 09:53:41 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0x7000000}}}, 0xf0}}, 0x0) 09:53:41 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="55000e0018007f083ffe15b282a380930a03000248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) 09:53:41 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x6, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x600}) 09:53:41 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) mkdirat(r1, &(0x7f00000000c0)='./file0\x00', 0x0) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r3 = syz_io_uring_setup(0x3ede, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000140)) io_uring_enter(r3, 0x2ff, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x5, 0x0, &(0x7f0000000040)=""/18, 0xffffffde}, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, &(0x7f0000000dc0)=[{&(0x7f0000000100)="f4a4848461fb0592d2f8db4c1f3c9e408788e03d28fe5e69dbceea46dd67888cdedd07a068040b956c3af7", 0x2b}, {0x0}, {0x0}], 0x3, &(0x7f0000000540)=ANY=[@ANYBLOB="1400000000000000", @ANYRES32], 0x50}}, {{0x0, 0x0, &(0x7f0000003180)=[{0x0}, {0x0}], 0x2, &(0x7f00000002c0)=ANY=[@ANYBLOB="c9252cdfb191d94ef15953a086ed40b24a018fb18d39f9a1256b33cf339f1d1bb52846ddaaaecd492eb1d0774b26968a44bf794e9d902a3c02af9543bc4096ac7a27", @ANYRES32, @ANYRES32=0x0], 0x50, 0x4041}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYRESDEC, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000003000000000000000010000000100", @ANYRES32, @ANYRES64, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESDEC=r4], 0xd0, 0x20000000}}], 0x3, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x138, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {0x0, 0xb}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x48, 0x1, {{'md5\x00'}}}]}, 0x138}}, 0x0) [ 483.990041][ C1] sd 0:0:1:0: [sg_rq_end_io] Add. Sense: Invalid command operation code [ 484.008021][ C1] sd 0:0:1:0: tag#6043 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 484.017860][ C1] sd 0:0:1:0: tag#6043 CDB: opcode=0xe5 (vendor) [ 484.024194][ C1] sd 0:0:1:0: tag#6043 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 484.033247][ C1] sd 0:0:1:0: tag#6043 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 484.042253][ C1] sd 0:0:1:0: tag#6043 CDB[20]: ba 09:53:42 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="55000f0018007f083ffe15b282a380930a03000248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) [ 484.197751][ C1] sd 0:0:1:0: [sg_rq_end_io] Sense Key : Illegal Request [current] [ 484.205912][ C1] sd 0:0:1:0: [sg_rq_end_io] Add. Sense: Invalid command operation code [ 484.225010][ C1] sd 0:0:1:0: tag#6049 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 484.234957][ C1] sd 0:0:1:0: tag#6049 CDB: opcode=0xe5 (vendor) [ 484.241301][ C1] sd 0:0:1:0: tag#6049 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 484.250351][ C1] sd 0:0:1:0: tag#6049 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 484.259393][ C1] sd 0:0:1:0: tag#6049 CDB[20]: ba [ 484.272950][ C0] sd 0:0:1:0: tag#6058 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 484.282793][ C0] sd 0:0:1:0: tag#6058 CDB: opcode=0xe5 (vendor) [ 484.289124][ C0] sd 0:0:1:0: tag#6058 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 484.292246][T25390] loop2: detected capacity change from 0 to 16383 [ 484.298232][ C0] sd 0:0:1:0: tag#6058 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 484.298252][ C0] sd 0:0:1:0: tag#6058 CDB[20]: ba [ 484.368335][ T5592] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 484.373739][ T5592] loop2: p1 size 11290111 extends beyond EOD, truncated [ 484.381474][ T5592] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 484.389193][ T5592] loop2: p5 size 11290111 extends beyond EOD, truncated [ 484.396429][ T5592] loop2: p6 size 1912633224 extends beyond EOD, truncated [ 484.410096][T25390] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 484.415396][T25390] loop2: p1 size 11290111 extends beyond EOD, truncated [ 484.423593][T25390] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 484.431817][T25390] loop2: p5 size 11290111 extends beyond EOD, truncated [ 484.439263][T25390] loop2: p6 size 1912633224 extends beyond EOD, truncated [ 484.550907][T25390] loop2: detected capacity change from 0 to 16383 [ 484.616155][T25390] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 484.621488][T25390] loop2: p1 size 11290111 extends beyond EOD, truncated [ 484.629480][T25390] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 484.637489][T25390] loop2: p5 size 11290111 extends beyond EOD, truncated [ 484.644788][T25390] loop2: p6 size 1912633224 extends beyond EOD, truncated 09:53:42 executing program 2: syz_read_part_table(0x0, 0x2, &(0x7f0000000100)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0000ffffff85000000060000000000024000ffffff82000700e100000088770072003007000f00000000000000008000da55aa", 0x40, 0x1c0}, {0x0, 0x0, 0xfffffffffffffffb}]) 09:53:42 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000}}}, 0xf0}}, 0x0) 09:53:42 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x9, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000e80)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) io_uring_enter(r1, 0x0, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x50}}], 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {}, {}, 0xefffffff, 0x0, 0xa}, [@algo_auth={0x58, 0x1, {{'md5\x00'}, 0x80, "f959fb7b2a535a87359f0b633f54f881"}}]}, 0x148}}, 0x0) 09:53:42 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x6, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x700}) 09:53:42 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="5500100018007f083ffe15b282a380930a03000248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) 09:53:42 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) mkdirat(r1, &(0x7f00000000c0)='./file0\x00', 0x0) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r3 = syz_io_uring_setup(0x3ede, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000140)) io_uring_enter(r3, 0x2ff, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x5, 0x0, &(0x7f0000000040)=""/18, 0xffffffde}, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, &(0x7f0000000dc0)=[{&(0x7f0000000100)="f4a4848461fb0592d2f8db4c1f3c9e408788e03d28fe5e69dbceea46dd67888cdedd07a068040b956c3af7", 0x2b}, {0x0}, {0x0}], 0x3, &(0x7f0000000540)=ANY=[@ANYBLOB="1400000000000000", @ANYRES32], 0x50}}, {{0x0, 0x0, &(0x7f0000003180)=[{0x0}, {0x0}], 0x2, &(0x7f00000002c0)=ANY=[@ANYBLOB="c9252cdfb191d94ef15953a086ed40b24a018fb18d39f9a1256b33cf339f1d1bb52846ddaaaecd492eb1d0774b26968a44bf794e9d902a3c02af9543bc4096ac7a27", @ANYRES32, @ANYRES32=0x0], 0x50, 0x4041}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYRESDEC, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000003000000000000000010000000100", @ANYRES32, @ANYRES64, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESDEC=r4], 0xd0, 0x20000000}}], 0x3, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x138, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {0x0, 0x10}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x48, 0x1, {{'md5\x00'}}}]}, 0x138}}, 0x0) 09:53:42 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x6, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x900}) 09:53:42 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x9, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000e80)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) io_uring_enter(r1, 0x0, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x50}}], 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {}, {}, 0xf0ffffff, 0x0, 0xa}, [@algo_auth={0x58, 0x1, {{'md5\x00'}, 0x80, "f959fb7b2a535a87359f0b633f54f881"}}]}, 0x148}}, 0x0) 09:53:42 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0x9000000}}}, 0xf0}}, 0x0) 09:53:42 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="5500110018007f083ffe15b282a380930a03000248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) [ 484.734318][ C1] sd 0:0:1:0: [sg_rq_end_io] Sense Key : Illegal Request [current] [ 484.742346][ C1] sd 0:0:1:0: [sg_rq_end_io] Add. Sense: Invalid command operation code [ 484.751562][T25402] __nla_validate_parse: 10 callbacks suppressed [ 484.751575][T25402] netlink: 224 bytes leftover after parsing attributes in process `syz-executor.4'. 09:53:42 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) mkdirat(r1, &(0x7f00000000c0)='./file0\x00', 0x0) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r3 = syz_io_uring_setup(0x3ede, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000140)) io_uring_enter(r3, 0x2ff, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x5, 0x0, &(0x7f0000000040)=""/18, 0xffffffde}, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, &(0x7f0000000dc0)=[{&(0x7f0000000100)="f4a4848461fb0592d2f8db4c1f3c9e408788e03d28fe5e69dbceea46dd67888cdedd07a068040b956c3af7", 0x2b}, {0x0}, {0x0}], 0x3, &(0x7f0000000540)=ANY=[@ANYBLOB="1400000000000000", @ANYRES32], 0x50}}, {{0x0, 0x0, &(0x7f0000003180)=[{0x0}, {0x0}], 0x2, &(0x7f00000002c0)=ANY=[@ANYBLOB="c9252cdfb191d94ef15953a086ed40b24a018fb18d39f9a1256b33cf339f1d1bb52846ddaaaecd492eb1d0774b26968a44bf794e9d902a3c02af9543bc4096ac7a27", @ANYRES32, @ANYRES32=0x0], 0x50, 0x4041}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYRESDEC, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000003000000000000000010000000100", @ANYRES32, @ANYRES64, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESDEC=r4], 0xd0, 0x20000000}}], 0x3, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x138, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {0x0, 0x11}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x48, 0x1, {{'md5\x00'}}}]}, 0x138}}, 0x0) 09:53:42 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x6, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd00}) [ 484.890854][ C1] sd 0:0:1:0: [sg_rq_end_io] Sense Key : Illegal Request [current] [ 484.898867][ C1] sd 0:0:1:0: [sg_rq_end_io] Add. Sense: Invalid command operation code [ 484.946291][T25417] netlink: 224 bytes leftover after parsing attributes in process `syz-executor.4'. [ 484.959114][T25419] loop2: detected capacity change from 0 to 16383 [ 484.978379][ T5592] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 484.983690][ T5592] loop2: p1 size 11290111 extends beyond EOD, truncated [ 484.992407][ T5592] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 485.001032][ T5592] loop2: p5 size 11290111 extends beyond EOD, truncated [ 485.009074][ T5592] loop2: p6 size 1912633224 extends beyond EOD, truncated [ 485.020320][T25419] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 485.025609][T25419] loop2: p1 size 11290111 extends beyond EOD, truncated [ 485.034169][T25419] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 485.042023][T25419] loop2: p5 size 11290111 extends beyond EOD, truncated [ 485.049324][T25419] loop2: p6 size 1912633224 extends beyond EOD, truncated [ 485.079974][ C1] sd 0:0:1:0: [sg_rq_end_io] Sense Key : Illegal Request [current] [ 485.088002][ C1] sd 0:0:1:0: [sg_rq_end_io] Add. Sense: Invalid command operation code [ 485.177544][T25419] loop2: detected capacity change from 0 to 16383 [ 485.213394][T25419] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 485.218742][T25419] loop2: p1 size 11290111 extends beyond EOD, truncated [ 485.226496][T25419] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 485.234214][T25419] loop2: p5 size 11290111 extends beyond EOD, truncated [ 485.241418][T25419] loop2: p6 size 1912633224 extends beyond EOD, truncated 09:53:43 executing program 2: syz_read_part_table(0x0, 0x2, &(0x7f0000000100)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0000ffffff85000000060000000000024000ffffff82000800e100000088770072003007000f00000000000000008000da55aa", 0x40, 0x1c0}, {0x0, 0x0, 0xfffffffffffffffb}]) 09:53:43 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="5500120018007f083ffe15b282a380930a03000248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) 09:53:43 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x9, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000e80)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) io_uring_enter(r1, 0x0, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x50}}], 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {}, {}, 0xfcffffff, 0x0, 0xa}, [@algo_auth={0x58, 0x1, {{'md5\x00'}, 0x80, "f959fb7b2a535a87359f0b633f54f881"}}]}, 0x148}}, 0x0) 09:53:43 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0xa000000}}}, 0xf0}}, 0x0) 09:53:43 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) mkdirat(r1, &(0x7f00000000c0)='./file0\x00', 0x0) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r3 = syz_io_uring_setup(0x3ede, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000140)) io_uring_enter(r3, 0x2ff, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x5, 0x0, &(0x7f0000000040)=""/18, 0xffffffde}, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, &(0x7f0000000dc0)=[{&(0x7f0000000100)="f4a4848461fb0592d2f8db4c1f3c9e408788e03d28fe5e69dbceea46dd67888cdedd07a068040b956c3af7", 0x2b}, {0x0}, {0x0}], 0x3, &(0x7f0000000540)=ANY=[@ANYBLOB="1400000000000000", @ANYRES32], 0x50}}, {{0x0, 0x0, &(0x7f0000003180)=[{0x0}, {0x0}], 0x2, &(0x7f00000002c0)=ANY=[@ANYBLOB="c9252cdfb191d94ef15953a086ed40b24a018fb18d39f9a1256b33cf339f1d1bb52846ddaaaecd492eb1d0774b26968a44bf794e9d902a3c02af9543bc4096ac7a27", @ANYRES32, @ANYRES32=0x0], 0x50, 0x4041}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYRESDEC, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000003000000000000000010000000100", @ANYRES32, @ANYRES64, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESDEC=r4], 0xd0, 0x20000000}}], 0x3, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x138, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {0x0, 0x14}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x48, 0x1, {{'md5\x00'}}}]}, 0x138}}, 0x0) 09:53:43 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x6, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe00}) [ 485.349668][ T383] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 485.354968][ T383] loop2: p1 size 11290111 extends beyond EOD, truncated [ 485.368934][ T383] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 485.377138][ T383] loop2: p5 size 11290111 extends beyond EOD, truncated [ 485.384437][ T383] loop2: p6 size 1912633224 extends beyond EOD, truncated 09:53:43 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) mkdirat(r1, &(0x7f00000000c0)='./file0\x00', 0x0) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r3 = syz_io_uring_setup(0x3ede, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000140)) io_uring_enter(r3, 0x2ff, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x5, 0x0, &(0x7f0000000040)=""/18, 0xffffffde}, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, &(0x7f0000000dc0)=[{&(0x7f0000000100)="f4a4848461fb0592d2f8db4c1f3c9e408788e03d28fe5e69dbceea46dd67888cdedd07a068040b956c3af7", 0x2b}, {0x0}, {0x0}], 0x3, &(0x7f0000000540)=ANY=[@ANYBLOB="1400000000000000", @ANYRES32], 0x50}}, {{0x0, 0x0, &(0x7f0000003180)=[{0x0}, {0x0}], 0x2, &(0x7f00000002c0)=ANY=[@ANYBLOB="c9252cdfb191d94ef15953a086ed40b24a018fb18d39f9a1256b33cf339f1d1bb52846ddaaaecd492eb1d0774b26968a44bf794e9d902a3c02af9543bc4096ac7a27", @ANYRES32, @ANYRES32=0x0], 0x50, 0x4041}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYRESDEC, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000003000000000000000010000000100", @ANYRES32, @ANYRES64, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESDEC=r4], 0xd0, 0x20000000}}], 0x3, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x138, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {0x0, 0x2b0}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x48, 0x1, {{'md5\x00'}}}]}, 0x138}}, 0x0) 09:53:43 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="5500250018007f083ffe15b282a380930a03000248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) 09:53:43 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x9, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000e80)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) io_uring_enter(r1, 0x0, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x50}}], 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {}, {}, 0xfeffffff, 0x0, 0xa}, [@algo_auth={0x58, 0x1, {{'md5\x00'}, 0x80, "f959fb7b2a535a87359f0b633f54f881"}}]}, 0x148}}, 0x0) 09:53:43 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0xb000000}}}, 0xf0}}, 0x0) 09:53:43 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x6, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1800}) [ 485.419555][T25431] netlink: 224 bytes leftover after parsing attributes in process `syz-executor.4'. [ 485.429134][ C1] sd 0:0:1:0: [sg_rq_end_io] Sense Key : Illegal Request [current] [ 485.437152][ C1] sd 0:0:1:0: [sg_rq_end_io] Add. Sense: Invalid command operation code 09:53:43 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="5500480018007f083ffe15b282a380930a03000248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) [ 485.594752][T25446] netlink: 224 bytes leftover after parsing attributes in process `syz-executor.4'. [ 485.604703][ C1] sd 0:0:1:0: [sg_rq_end_io] Sense Key : Illegal Request [current] [ 485.612734][ C1] sd 0:0:1:0: [sg_rq_end_io] Add. Sense: Invalid command operation code [ 485.678299][T25451] loop2: detected capacity change from 0 to 16383 [ 485.728596][ T5592] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 485.733961][ T5592] loop2: p1 size 11290111 extends beyond EOD, truncated [ 485.743437][ T5592] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 485.751960][ T5592] loop2: p5 size 11290111 extends beyond EOD, truncated [ 485.759410][ T5592] loop2: p6 size 1912633224 extends beyond EOD, truncated [ 485.769465][T25451] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 485.774812][T25451] loop2: p1 size 11290111 extends beyond EOD, truncated [ 485.782780][T25451] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 485.790766][T25451] loop2: p5 size 11290111 extends beyond EOD, truncated [ 485.797907][T25451] loop2: p6 size 1912633224 extends beyond EOD, truncated [ 485.931604][T25451] loop2: detected capacity change from 0 to 16383 09:53:43 executing program 2: syz_read_part_table(0x0, 0x2, &(0x7f0000000100)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0000ffffff85000000060000000000024000ffffff82000a00e100000088770072003007000f00000000000000008000da55aa", 0x40, 0x1c0}, {0x0, 0x0, 0xfffffffffffffffb}]) 09:53:43 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x9, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000e80)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) io_uring_enter(r1, 0x0, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x50}}], 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {}, {}, 0xffffff7f, 0x0, 0xa}, [@algo_auth={0x58, 0x1, {{'md5\x00'}, 0x80, "f959fb7b2a535a87359f0b633f54f881"}}]}, 0x148}}, 0x0) 09:53:43 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0xc000000}}}, 0xf0}}, 0x0) 09:53:43 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x6, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1d2b}) 09:53:43 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="55004c0018007f083ffe15b282a380930a03000248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) 09:53:43 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) mkdirat(r1, &(0x7f00000000c0)='./file0\x00', 0x0) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r3 = syz_io_uring_setup(0x3ede, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000140)) io_uring_enter(r3, 0x2ff, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x5, 0x0, &(0x7f0000000040)=""/18, 0xffffffde}, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, &(0x7f0000000dc0)=[{&(0x7f0000000100)="f4a4848461fb0592d2f8db4c1f3c9e408788e03d28fe5e69dbceea46dd67888cdedd07a068040b956c3af7", 0x2b}, {0x0}, {0x0}], 0x3, &(0x7f0000000540)=ANY=[@ANYBLOB="1400000000000000", @ANYRES32], 0x50}}, {{0x0, 0x0, &(0x7f0000003180)=[{0x0}, {0x0}], 0x2, &(0x7f00000002c0)=ANY=[@ANYBLOB="c9252cdfb191d94ef15953a086ed40b24a018fb18d39f9a1256b33cf339f1d1bb52846ddaaaecd492eb1d0774b26968a44bf794e9d902a3c02af9543bc4096ac7a27", @ANYRES32, @ANYRES32=0x0], 0x50, 0x4041}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYRESDEC, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000003000000000000000010000000100", @ANYRES32, @ANYRES64, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESDEC=r4], 0xd0, 0x20000000}}], 0x3, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x138, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {0x0, 0x300}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x48, 0x1, {{'md5\x00'}}}]}, 0x138}}, 0x0) [ 485.976782][T25451] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 485.982062][T25451] loop2: p1 size 11290111 extends beyond EOD, truncated [ 485.989867][T25451] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 485.997726][T25451] loop2: p5 size 11290111 extends beyond EOD, truncated [ 486.004957][T25451] loop2: p6 size 1912633224 extends beyond EOD, truncated 09:53:43 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="5500600018007f083ffe15b282a380930a03000248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) 09:53:43 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) mkdirat(r1, &(0x7f00000000c0)='./file0\x00', 0x0) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r3 = syz_io_uring_setup(0x3ede, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000140)) io_uring_enter(r3, 0x2ff, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x5, 0x0, &(0x7f0000000040)=""/18, 0xffffffde}, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, &(0x7f0000000dc0)=[{&(0x7f0000000100)="f4a4848461fb0592d2f8db4c1f3c9e408788e03d28fe5e69dbceea46dd67888cdedd07a068040b956c3af7", 0x2b}, {0x0}, {0x0}], 0x3, &(0x7f0000000540)=ANY=[@ANYBLOB="1400000000000000", @ANYRES32], 0x50}}, {{0x0, 0x0, &(0x7f0000003180)=[{0x0}, {0x0}], 0x2, &(0x7f00000002c0)=ANY=[@ANYBLOB="c9252cdfb191d94ef15953a086ed40b24a018fb18d39f9a1256b33cf339f1d1bb52846ddaaaecd492eb1d0774b26968a44bf794e9d902a3c02af9543bc4096ac7a27", @ANYRES32, @ANYRES32=0x0], 0x50, 0x4041}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYRESDEC, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000003000000000000000010000000100", @ANYRES32, @ANYRES64, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESDEC=r4], 0xd0, 0x20000000}}], 0x3, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x138, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {0x0, 0x500}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x48, 0x1, {{'md5\x00'}}}]}, 0x138}}, 0x0) 09:53:43 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x6, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2b1d}) 09:53:43 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0xd000000}}}, 0xf0}}, 0x0) 09:53:43 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x9, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000e80)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) io_uring_enter(r1, 0x0, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x50}}], 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {}, {}, 0xffffff9e, 0x0, 0xa}, [@algo_auth={0x58, 0x1, {{'md5\x00'}, 0x80, "f959fb7b2a535a87359f0b633f54f881"}}]}, 0x148}}, 0x0) [ 486.076748][T25459] netlink: 224 bytes leftover after parsing attributes in process `syz-executor.4'. [ 486.086662][ C1] sd 0:0:1:0: [sg_rq_end_io] Sense Key : Illegal Request [current] [ 486.094695][ C1] sd 0:0:1:0: [sg_rq_end_io] Add. Sense: Invalid command operation code 09:53:44 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="5500680018007f083ffe15b282a380930a03000248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) 09:53:44 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) mkdirat(r1, &(0x7f00000000c0)='./file0\x00', 0x0) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r3 = syz_io_uring_setup(0x3ede, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000140)) io_uring_enter(r3, 0x2ff, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x5, 0x0, &(0x7f0000000040)=""/18, 0xffffffde}, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, &(0x7f0000000dc0)=[{&(0x7f0000000100)="f4a4848461fb0592d2f8db4c1f3c9e408788e03d28fe5e69dbceea46dd67888cdedd07a068040b956c3af7", 0x2b}, {0x0}, {0x0}], 0x3, &(0x7f0000000540)=ANY=[@ANYBLOB="1400000000000000", @ANYRES32], 0x50}}, {{0x0, 0x0, &(0x7f0000003180)=[{0x0}, {0x0}], 0x2, &(0x7f00000002c0)=ANY=[@ANYBLOB="c9252cdfb191d94ef15953a086ed40b24a018fb18d39f9a1256b33cf339f1d1bb52846ddaaaecd492eb1d0774b26968a44bf794e9d902a3c02af9543bc4096ac7a27", @ANYRES32, @ANYRES32=0x0], 0x50, 0x4041}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYRESDEC, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000003000000000000000010000000100", @ANYRES32, @ANYRES64, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESDEC=r4], 0xd0, 0x20000000}}], 0x3, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x138, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {0x0, 0x600}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x48, 0x1, {{'md5\x00'}}}]}, 0x138}}, 0x0) [ 486.313706][T25476] netlink: 224 bytes leftover after parsing attributes in process `syz-executor.4'. [ 486.324103][ C1] sd 0:0:1:0: [sg_rq_end_io] Sense Key : Illegal Request [current] [ 486.332128][ C1] sd 0:0:1:0: [sg_rq_end_io] Add. Sense: Invalid command operation code [ 486.418437][T25481] loop2: detected capacity change from 0 to 16383 [ 486.440187][T25481] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 486.445458][T25481] loop2: p1 size 11290111 extends beyond EOD, truncated [ 486.453653][T25481] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 486.461790][T25481] loop2: p5 size 11290111 extends beyond EOD, truncated [ 486.469041][T25481] loop2: p6 size 1912633224 extends beyond EOD, truncated [ 486.554443][T25481] loop2: detected capacity change from 0 to 16383 [ 486.604614][ T5592] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 486.609955][ T5592] loop2: p1 size 11290111 extends beyond EOD, truncated [ 486.617463][ T5592] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 486.625267][ T5592] loop2: p5 size 11290111 extends beyond EOD, truncated [ 486.632482][ T5592] loop2: p6 size 1912633224 extends beyond EOD, truncated [ 486.642903][T25481] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 486.648195][T25481] loop2: p1 size 11290111 extends beyond EOD, truncated 09:53:44 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x9, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000e80)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) io_uring_enter(r1, 0x0, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x50}}], 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {}, {}, 0xffffffea, 0x0, 0xa}, [@algo_auth={0x58, 0x1, {{'md5\x00'}, 0x80, "f959fb7b2a535a87359f0b633f54f881"}}]}, 0x148}}, 0x0) 09:53:44 executing program 2: syz_read_part_table(0x0, 0x2, &(0x7f0000000100)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0000ffffff85000000060000000000024000ffffff82000b00e100000088770072003007000f00000000000000008000da55aa", 0x40, 0x1c0}, {0x0, 0x0, 0xfffffffffffffffb}]) 09:53:44 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0xe000000}}}, 0xf0}}, 0x0) 09:53:44 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x6, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000}) 09:53:44 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="55006c0018007f083ffe15b282a380930a03000248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) 09:53:44 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) mkdirat(r1, &(0x7f00000000c0)='./file0\x00', 0x0) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r3 = syz_io_uring_setup(0x3ede, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000140)) io_uring_enter(r3, 0x2ff, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x5, 0x0, &(0x7f0000000040)=""/18, 0xffffffde}, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, &(0x7f0000000dc0)=[{&(0x7f0000000100)="f4a4848461fb0592d2f8db4c1f3c9e408788e03d28fe5e69dbceea46dd67888cdedd07a068040b956c3af7", 0x2b}, {0x0}, {0x0}], 0x3, &(0x7f0000000540)=ANY=[@ANYBLOB="1400000000000000", @ANYRES32], 0x50}}, {{0x0, 0x0, &(0x7f0000003180)=[{0x0}, {0x0}], 0x2, &(0x7f00000002c0)=ANY=[@ANYBLOB="c9252cdfb191d94ef15953a086ed40b24a018fb18d39f9a1256b33cf339f1d1bb52846ddaaaecd492eb1d0774b26968a44bf794e9d902a3c02af9543bc4096ac7a27", @ANYRES32, @ANYRES32=0x0], 0x50, 0x4041}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYRESDEC, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000003000000000000000010000000100", @ANYRES32, @ANYRES64, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESDEC=r4], 0xd0, 0x20000000}}], 0x3, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x138, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {0x0, 0x700}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x48, 0x1, {{'md5\x00'}}}]}, 0x138}}, 0x0) [ 486.655785][T25481] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 486.663582][T25481] loop2: p5 size 11290111 extends beyond EOD, truncated [ 486.670876][T25481] loop2: p6 size 1912633224 extends beyond EOD, truncated 09:53:44 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="5500740018007f083ffe15b282a380930a03000248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) 09:53:44 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0x10000000}}}, 0xf0}}, 0x0) 09:53:44 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x9, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000e80)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) io_uring_enter(r1, 0x0, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x50}}], 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {}, {}, 0xffffffef, 0x0, 0xa}, [@algo_auth={0x58, 0x1, {{'md5\x00'}, 0x80, "f959fb7b2a535a87359f0b633f54f881"}}]}, 0x148}}, 0x0) 09:53:44 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x6, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e", 0x0, 0x0, 0x0, 0x0, 0x0}) 09:53:44 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) mkdirat(r1, &(0x7f00000000c0)='./file0\x00', 0x0) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r3 = syz_io_uring_setup(0x3ede, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000140)) io_uring_enter(r3, 0x2ff, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x5, 0x0, &(0x7f0000000040)=""/18, 0xffffffde}, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, &(0x7f0000000dc0)=[{&(0x7f0000000100)="f4a4848461fb0592d2f8db4c1f3c9e408788e03d28fe5e69dbceea46dd67888cdedd07a068040b956c3af7", 0x2b}, {0x0}, {0x0}], 0x3, &(0x7f0000000540)=ANY=[@ANYBLOB="1400000000000000", @ANYRES32], 0x50}}, {{0x0, 0x0, &(0x7f0000003180)=[{0x0}, {0x0}], 0x2, &(0x7f00000002c0)=ANY=[@ANYBLOB="c9252cdfb191d94ef15953a086ed40b24a018fb18d39f9a1256b33cf339f1d1bb52846ddaaaecd492eb1d0774b26968a44bf794e9d902a3c02af9543bc4096ac7a27", @ANYRES32, @ANYRES32=0x0], 0x50, 0x4041}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYRESDEC, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000003000000000000000010000000100", @ANYRES32, @ANYRES64, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESDEC=r4], 0xd0, 0x20000000}}], 0x3, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x138, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {0x0, 0x900}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x48, 0x1, {{'md5\x00'}}}]}, 0x138}}, 0x0) [ 486.729425][ C1] sd 0:0:1:0: [sg_rq_end_io] Sense Key : Illegal Request [current] [ 486.737450][ C1] sd 0:0:1:0: [sg_rq_end_io] Add. Sense: Invalid command operation code [ 486.746556][T25494] netlink: 224 bytes leftover after parsing attributes in process `syz-executor.4'. 09:53:44 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="55007a0018007f083ffe15b282a380930a03000248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) 09:53:44 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0x11000000}}}, 0xf0}}, 0x0) [ 486.889150][T25506] netlink: 224 bytes leftover after parsing attributes in process `syz-executor.4'. [ 486.904474][ C1] sd 0:0:1:0: [sg_rq_end_io] Sense Key : Illegal Request [current] [ 486.912509][ C1] sd 0:0:1:0: [sg_rq_end_io] Add. Sense: Invalid command operation code [ 487.002221][T25513] loop2: detected capacity change from 0 to 16383 [ 487.044332][T25517] netlink: 224 bytes leftover after parsing attributes in process `syz-executor.4'. [ 487.068415][ T5592] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 487.073672][ T5592] loop2: p1 size 11290111 extends beyond EOD, truncated [ 487.081592][ T5592] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 487.089416][ T5592] loop2: p5 size 11290111 extends beyond EOD, truncated [ 487.096788][ T5592] loop2: p6 size 1912633224 extends beyond EOD, truncated [ 487.107034][T25513] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 487.112296][T25513] loop2: p1 size 11290111 extends beyond EOD, truncated [ 487.120030][T25513] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 487.127809][T25513] loop2: p5 size 11290111 extends beyond EOD, truncated [ 487.135132][T25513] loop2: p6 size 1912633224 extends beyond EOD, truncated [ 487.250504][T25513] loop2: detected capacity change from 0 to 16383 09:53:45 executing program 2: syz_read_part_table(0x0, 0x2, &(0x7f0000000100)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0000ffffff85000000060000000000024000ffffff82001800e100000088770072003007000f00000000000000008000da55aa", 0x40, 0x1c0}, {0x0, 0x0, 0xfffffffffffffffb}]) 09:53:45 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x6, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) 09:53:45 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x9, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000e80)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) io_uring_enter(r1, 0x0, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x50}}], 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {}, {}, 0xfffffff0, 0x0, 0xa}, [@algo_auth={0x58, 0x1, {{'md5\x00'}, 0x80, "f959fb7b2a535a87359f0b633f54f881"}}]}, 0x148}}, 0x0) 09:53:45 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) mkdirat(r1, &(0x7f00000000c0)='./file0\x00', 0x0) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r3 = syz_io_uring_setup(0x3ede, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000140)) io_uring_enter(r3, 0x2ff, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x5, 0x0, &(0x7f0000000040)=""/18, 0xffffffde}, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, &(0x7f0000000dc0)=[{&(0x7f0000000100)="f4a4848461fb0592d2f8db4c1f3c9e408788e03d28fe5e69dbceea46dd67888cdedd07a068040b956c3af7", 0x2b}, {0x0}, {0x0}], 0x3, &(0x7f0000000540)=ANY=[@ANYBLOB="1400000000000000", @ANYRES32], 0x50}}, {{0x0, 0x0, &(0x7f0000003180)=[{0x0}, {0x0}], 0x2, &(0x7f00000002c0)=ANY=[@ANYBLOB="c9252cdfb191d94ef15953a086ed40b24a018fb18d39f9a1256b33cf339f1d1bb52846ddaaaecd492eb1d0774b26968a44bf794e9d902a3c02af9543bc4096ac7a27", @ANYRES32, @ANYRES32=0x0], 0x50, 0x4041}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYRESDEC, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000003000000000000000010000000100", @ANYRES32, @ANYRES64, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESDEC=r4], 0xd0, 0x20000000}}], 0x3, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x138, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {0x0, 0xa00}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x48, 0x1, {{'md5\x00'}}}]}, 0x138}}, 0x0) 09:53:45 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="5500fc0018007f083ffe15b282a380930a03000248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) 09:53:45 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0x12000000}}}, 0xf0}}, 0x0) [ 487.305490][T25513] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 487.310734][T25513] loop2: p1 size 11290111 extends beyond EOD, truncated [ 487.318580][T25513] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 487.326304][T25513] loop2: p5 size 11290111 extends beyond EOD, truncated [ 487.333567][T25513] loop2: p6 size 1912633224 extends beyond EOD, truncated 09:53:45 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0x1e040000}}}, 0xf0}}, 0x0) 09:53:45 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="5500a60118007f083ffe15b282a380930a03000248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) 09:53:45 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x6, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}) 09:53:45 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x9, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000e80)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) io_uring_enter(r1, 0x0, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x50}}], 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {}, {}, 0xfffffffc, 0x0, 0xa}, [@algo_auth={0x58, 0x1, {{'md5\x00'}, 0x80, "f959fb7b2a535a87359f0b633f54f881"}}]}, 0x148}}, 0x0) [ 487.382555][T25523] netlink: 224 bytes leftover after parsing attributes in process `syz-executor.4'. [ 487.394906][ C1] sd 0:0:1:0: [sg_rq_end_io] Sense Key : Illegal Request [current] [ 487.402964][ C1] sd 0:0:1:0: [sg_rq_end_io] Add. Sense: Invalid command operation code 09:53:45 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) mkdirat(r1, &(0x7f00000000c0)='./file0\x00', 0x0) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r3 = syz_io_uring_setup(0x3ede, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000140)) io_uring_enter(r3, 0x2ff, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x5, 0x0, &(0x7f0000000040)=""/18, 0xffffffde}, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, &(0x7f0000000dc0)=[{&(0x7f0000000100)="f4a4848461fb0592d2f8db4c1f3c9e408788e03d28fe5e69dbceea46dd67888cdedd07a068040b956c3af7", 0x2b}, {0x0}, {0x0}], 0x3, &(0x7f0000000540)=ANY=[@ANYBLOB="1400000000000000", @ANYRES32], 0x50}}, {{0x0, 0x0, &(0x7f0000003180)=[{0x0}, {0x0}], 0x2, &(0x7f00000002c0)=ANY=[@ANYBLOB="c9252cdfb191d94ef15953a086ed40b24a018fb18d39f9a1256b33cf339f1d1bb52846ddaaaecd492eb1d0774b26968a44bf794e9d902a3c02af9543bc4096ac7a27", @ANYRES32, @ANYRES32=0x0], 0x50, 0x4041}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYRESDEC, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000003000000000000000010000000100", @ANYRES32, @ANYRES64, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESDEC=r4], 0xd0, 0x20000000}}], 0x3, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x138, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {0x0, 0xb00}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x48, 0x1, {{'md5\x00'}}}]}, 0x138}}, 0x0) 09:53:45 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000}}}, 0xf0}}, 0x0) [ 487.557258][ C1] sd 0:0:1:0: [sg_rq_end_io] Sense Key : Illegal Request [current] [ 487.565324][ C1] sd 0:0:1:0: [sg_rq_end_io] Add. Sense: Invalid command operation code [ 487.601850][ C0] scsi_io_completion_action: 18 callbacks suppressed [ 487.601876][ C0] sd 0:0:1:0: tag#6034 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 487.616918][T25543] loop2: detected capacity change from 0 to 16383 [ 487.618385][ C0] sd 0:0:1:0: tag#6034 CDB: opcode=0xe5 (vendor) [ 487.618406][ C0] sd 0:0:1:0: tag#6034 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 487.640166][ C0] sd 0:0:1:0: tag#6034 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 487.649227][ C0] sd 0:0:1:0: tag#6034 CDB[20]: ba [ 487.666363][ T5592] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 487.671747][ T5592] loop2: p1 size 11290111 extends beyond EOD, truncated [ 487.680590][ T5592] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 487.688420][ T5592] loop2: p5 size 11290111 extends beyond EOD, truncated [ 487.695742][ T5592] loop2: p6 size 1912633224 extends beyond EOD, truncated [ 487.705730][T25543] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 487.711062][T25543] loop2: p1 size 11290111 extends beyond EOD, truncated [ 487.718636][T25543] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 487.726468][T25543] loop2: p5 size 11290111 extends beyond EOD, truncated [ 487.734005][T25543] loop2: p6 size 1912633224 extends beyond EOD, truncated [ 487.826408][T25543] loop2: detected capacity change from 0 to 16383 [ 487.892918][T25543] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 487.898233][T25543] loop2: p1 size 11290111 extends beyond EOD, truncated [ 487.905841][T25543] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 487.913805][T25543] loop2: p5 size 11290111 extends beyond EOD, truncated [ 487.920981][T25543] loop2: p6 size 1912633224 extends beyond EOD, truncated 09:53:45 executing program 2: syz_read_part_table(0x0, 0x2, &(0x7f0000000100)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0000ffffff85000000060000000000024000ffffff82002600e100000088770072003007000f00000000000000008000da55aa", 0x40, 0x1c0}, {0x0, 0x0, 0xfffffffffffffffb}]) 09:53:45 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="5500aa0118007f083ffe15b282a380930a03000248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) 09:53:45 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x6, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}) 09:53:45 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x9, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000e80)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) io_uring_enter(r1, 0x0, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x50}}], 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {}, {}, 0xfffffffe, 0x0, 0xa}, [@algo_auth={0x58, 0x1, {{'md5\x00'}, 0x80, "f959fb7b2a535a87359f0b633f54f881"}}]}, 0x148}}, 0x0) 09:53:45 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) mkdirat(r1, &(0x7f00000000c0)='./file0\x00', 0x0) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r3 = syz_io_uring_setup(0x3ede, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000140)) io_uring_enter(r3, 0x2ff, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x5, 0x0, &(0x7f0000000040)=""/18, 0xffffffde}, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, &(0x7f0000000dc0)=[{&(0x7f0000000100)="f4a4848461fb0592d2f8db4c1f3c9e408788e03d28fe5e69dbceea46dd67888cdedd07a068040b956c3af7", 0x2b}, {0x0}, {0x0}], 0x3, &(0x7f0000000540)=ANY=[@ANYBLOB="1400000000000000", @ANYRES32], 0x50}}, {{0x0, 0x0, &(0x7f0000003180)=[{0x0}, {0x0}], 0x2, &(0x7f00000002c0)=ANY=[@ANYBLOB="c9252cdfb191d94ef15953a086ed40b24a018fb18d39f9a1256b33cf339f1d1bb52846ddaaaecd492eb1d0774b26968a44bf794e9d902a3c02af9543bc4096ac7a27", @ANYRES32, @ANYRES32=0x0], 0x50, 0x4041}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYRESDEC, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000003000000000000000010000000100", @ANYRES32, @ANYRES64, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESDEC=r4], 0xd0, 0x20000000}}], 0x3, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x138, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {0x0, 0x1100}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x48, 0x1, {{'md5\x00'}}}]}, 0x138}}, 0x0) 09:53:45 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0x25000000}}}, 0xf0}}, 0x0) [ 487.966888][ T383] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 487.972152][ T383] loop2: p1 size 11290111 extends beyond EOD, truncated [ 487.989298][ T383] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 487.997424][ T383] loop2: p5 size 11290111 extends beyond EOD, truncated [ 488.005032][ T383] loop2: p6 size 1912633224 extends beyond EOD, truncated 09:53:45 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0x33000000}}}, 0xf0}}, 0x0) 09:53:45 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="5500540218007f083ffe15b282a380930a03000248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) 09:53:45 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x9, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000e80)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) io_uring_enter(r1, 0x0, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x50}}], 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x58, 0x1, {{'md5\x00'}, 0x80, "f959fb7b2a535a87359f0b633f54f881"}}]}, 0x148}}, 0x0) 09:53:45 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x6, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}) [ 488.024488][ C1] sd 0:0:1:0: [sg_rq_end_io] Sense Key : Illegal Request [current] [ 488.032531][ C1] sd 0:0:1:0: [sg_rq_end_io] Add. Sense: Invalid command operation code [ 488.054881][ C0] sd 0:0:1:0: tag#6068 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 488.064785][ C0] sd 0:0:1:0: tag#6068 CDB: opcode=0xe5 (vendor) [ 488.071164][ C0] sd 0:0:1:0: tag#6068 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 488.080192][ C0] sd 0:0:1:0: tag#6068 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 488.089213][ C0] sd 0:0:1:0: tag#6068 CDB[20]: ba [ 488.104361][ C0] sd 0:0:1:0: tag#6046 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 488.114197][ C0] sd 0:0:1:0: tag#6046 CDB: opcode=0xe5 (vendor) 09:53:45 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) mkdirat(r1, &(0x7f00000000c0)='./file0\x00', 0x0) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r3 = syz_io_uring_setup(0x3ede, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000140)) io_uring_enter(r3, 0x2ff, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x5, 0x0, &(0x7f0000000040)=""/18, 0xffffffde}, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, &(0x7f0000000dc0)=[{&(0x7f0000000100)="f4a4848461fb0592d2f8db4c1f3c9e408788e03d28fe5e69dbceea46dd67888cdedd07a068040b956c3af7", 0x2b}, {0x0}, {0x0}], 0x3, &(0x7f0000000540)=ANY=[@ANYBLOB="1400000000000000", @ANYRES32], 0x50}}, {{0x0, 0x0, &(0x7f0000003180)=[{0x0}, {0x0}], 0x2, &(0x7f00000002c0)=ANY=[@ANYBLOB="c9252cdfb191d94ef15953a086ed40b24a018fb18d39f9a1256b33cf339f1d1bb52846ddaaaecd492eb1d0774b26968a44bf794e9d902a3c02af9543bc4096ac7a27", @ANYRES32, @ANYRES32=0x0], 0x50, 0x4041}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYRESDEC, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000003000000000000000010000000100", @ANYRES32, @ANYRES64, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESDEC=r4], 0xd0, 0x20000000}}], 0x3, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x138, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {0x0, 0x1400}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x48, 0x1, {{'md5\x00'}}}]}, 0x138}}, 0x0) [ 488.120571][ C0] sd 0:0:1:0: tag#6046 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 488.129595][ C0] sd 0:0:1:0: tag#6046 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 488.138629][ C0] sd 0:0:1:0: tag#6046 CDB[20]: ba 09:53:46 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="5500580218007f083ffe15b282a380930a03000248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) [ 488.196514][ C1] sd 0:0:1:0: [sg_rq_end_io] Sense Key : Illegal Request [current] [ 488.204548][ C1] sd 0:0:1:0: [sg_rq_end_io] Add. Sense: Invalid command operation code [ 488.279789][T25571] loop2: detected capacity change from 0 to 16383 [ 488.287226][ T5428] udevd[5428]: inotify_add_watch(7, /dev/loop2p2, 10) failed: No such file or directory [ 488.287291][ T5592] udevd[5592]: inotify_add_watch(7, /dev/loop2p1, 10) failed: No such file or directory [ 488.298048][T13989] udevd[13989]: inotify_add_watch(7, /dev/loop2p3, 10) failed: No such file or directory [ 488.307572][T16174] udevd[16174]: inotify_add_watch(7, /dev/loop2p4, 10) failed: No such file or directory [ 488.347371][ C1] sd 0:0:1:0: tag#6032 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 488.357208][ C1] sd 0:0:1:0: tag#6032 CDB: opcode=0xe5 (vendor) [ 488.357450][ T5552] udevd[5552]: inotify_add_watch(7, /dev/loop2p5, 10) failed: No such file or directory [ 488.363528][ C1] sd 0:0:1:0: tag#6032 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 488.375125][ T5551] udevd[5551]: inotify_add_watch(7, /dev/loop2p6, 10) failed: No such file or directory [ 488.382281][ C1] sd 0:0:1:0: tag#6032 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 488.392751][T25571] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 488.401020][ C1] sd 0:0:1:0: tag#6032 CDB[20]: ba [ 488.411471][T25571] loop2: p1 size 11290111 extends beyond EOD, truncated [ 488.420052][T25571] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 488.428075][T25571] loop2: p5 size 11290111 extends beyond EOD, truncated [ 488.436764][T25571] loop2: p6 size 1912633224 extends beyond EOD, truncated 09:53:46 executing program 2: syz_read_part_table(0x0, 0x2, &(0x7f0000000100)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0000ffffff85000000060000000000024000ffffff82007100e100000088770072003007000f00000000000000008000da55aa", 0x40, 0x1c0}, {0x0, 0x0, 0xfffffffffffffffb}]) 09:53:46 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x9, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000e80)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) io_uring_enter(r1, 0x0, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x50}}], 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {}, {}, 0x0, 0x2, 0xa}, [@algo_auth={0x58, 0x1, {{'md5\x00'}, 0x80, "f959fb7b2a535a87359f0b633f54f881"}}]}, 0x148}}, 0x0) 09:53:46 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x6, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd}) 09:53:46 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0x3e010000}}}, 0xf0}}, 0x0) 09:53:46 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) mkdirat(r1, &(0x7f00000000c0)='./file0\x00', 0x0) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r3 = syz_io_uring_setup(0x3ede, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000140)) io_uring_enter(r3, 0x2ff, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x5, 0x0, &(0x7f0000000040)=""/18, 0xffffffde}, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, &(0x7f0000000dc0)=[{&(0x7f0000000100)="f4a4848461fb0592d2f8db4c1f3c9e408788e03d28fe5e69dbceea46dd67888cdedd07a068040b956c3af7", 0x2b}, {0x0}, {0x0}], 0x3, &(0x7f0000000540)=ANY=[@ANYBLOB="1400000000000000", @ANYRES32], 0x50}}, {{0x0, 0x0, &(0x7f0000003180)=[{0x0}, {0x0}], 0x2, &(0x7f00000002c0)=ANY=[@ANYBLOB="c9252cdfb191d94ef15953a086ed40b24a018fb18d39f9a1256b33cf339f1d1bb52846ddaaaecd492eb1d0774b26968a44bf794e9d902a3c02af9543bc4096ac7a27", @ANYRES32, @ANYRES32=0x0], 0x50, 0x4041}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYRESDEC, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000003000000000000000010000000100", @ANYRES32, @ANYRES64, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESDEC=r4], 0xd0, 0x20000000}}], 0x3, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x138, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {0x0, 0x2000}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x48, 0x1, {{'md5\x00'}}}]}, 0x138}}, 0x0) 09:53:46 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="5500000318007f083ffe15b282a380930a03000248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) [ 488.574987][ T5592] udevd[5592]: inotify_add_watch(7, /dev/loop2p1, 10) failed: No such file or directory [ 488.577518][T13989] udevd[13989]: inotify_add_watch(7, /dev/loop2p3, 10) failed: No such file or directory [ 488.585684][ T5428] udevd[5428]: inotify_add_watch(7, /dev/loop2p2, 10) failed: No such file or directory [ 488.596572][ T5552] udevd[5552]: inotify_add_watch(7, /dev/loop2p5, 10) failed: No such file or directory [ 488.653300][ C1] sd 0:0:1:0: [sg_rq_end_io] Sense Key : Illegal Request [current] [ 488.654228][ C0] sd 0:0:1:0: tag#6054 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 488.661340][ C1] sd 0:0:1:0: [sg_rq_end_io] Add. Sense: Invalid command operation code [ 488.671150][ C0] sd 0:0:1:0: tag#6054 CDB: opcode=0xe5 (vendor) [ 488.685754][ C0] sd 0:0:1:0: tag#6054 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 488.694796][ C0] sd 0:0:1:0: tag#6054 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d 09:53:46 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x9, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000e80)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) io_uring_enter(r1, 0x0, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x50}}], 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {}, {}, 0x0, 0x3, 0xa}, [@algo_auth={0x58, 0x1, {{'md5\x00'}, 0x80, "f959fb7b2a535a87359f0b633f54f881"}}]}, 0x148}}, 0x0) 09:53:46 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0x48000000}}}, 0xf0}}, 0x0) 09:53:46 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="5500000518007f083ffe15b282a380930a03000248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) 09:53:46 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x6, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe}) 09:53:46 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) mkdirat(r1, &(0x7f00000000c0)='./file0\x00', 0x0) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r3 = syz_io_uring_setup(0x3ede, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000140)) io_uring_enter(r3, 0x2ff, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x5, 0x0, &(0x7f0000000040)=""/18, 0xffffffde}, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, &(0x7f0000000dc0)=[{&(0x7f0000000100)="f4a4848461fb0592d2f8db4c1f3c9e408788e03d28fe5e69dbceea46dd67888cdedd07a068040b956c3af7", 0x2b}, {0x0}, {0x0}], 0x3, &(0x7f0000000540)=ANY=[@ANYBLOB="1400000000000000", @ANYRES32], 0x50}}, {{0x0, 0x0, &(0x7f0000003180)=[{0x0}, {0x0}], 0x2, &(0x7f00000002c0)=ANY=[@ANYBLOB="c9252cdfb191d94ef15953a086ed40b24a018fb18d39f9a1256b33cf339f1d1bb52846ddaaaecd492eb1d0774b26968a44bf794e9d902a3c02af9543bc4096ac7a27", @ANYRES32, @ANYRES32=0x0], 0x50, 0x4041}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYRESDEC, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000003000000000000000010000000100", @ANYRES32, @ANYRES64, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESDEC=r4], 0xd0, 0x20000000}}], 0x3, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x138, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {0x0, 0x3f00}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x48, 0x1, {{'md5\x00'}}}]}, 0x138}}, 0x0) [ 488.703826][ C0] sd 0:0:1:0: tag#6054 CDB[20]: ba 09:53:46 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x9, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000e80)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) io_uring_enter(r1, 0x0, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x50}}], 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {}, {}, 0x0, 0x4, 0xa}, [@algo_auth={0x58, 0x1, {{'md5\x00'}, 0x80, "f959fb7b2a535a87359f0b633f54f881"}}]}, 0x148}}, 0x0) [ 488.878451][ C1] sd 0:0:1:0: [sg_rq_end_io] Sense Key : Illegal Request [current] [ 488.886472][ C1] sd 0:0:1:0: [sg_rq_end_io] Add. Sense: Invalid command operation code [ 488.896474][ C0] sd 0:0:1:0: tag#6027 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 488.906315][ C0] sd 0:0:1:0: tag#6027 CDB: opcode=0xe5 (vendor) [ 488.912633][ C0] sd 0:0:1:0: tag#6027 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 488.915164][T25603] loop2: detected capacity change from 0 to 16383 [ 488.921655][ C0] sd 0:0:1:0: tag#6027 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 488.921676][ C0] sd 0:0:1:0: tag#6027 CDB[20]: ba [ 488.951280][ C0] sd 0:0:1:0: tag#6075 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 488.961106][ C0] sd 0:0:1:0: tag#6075 CDB: opcode=0xe5 (vendor) [ 488.967426][ C0] sd 0:0:1:0: tag#6075 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 488.976449][ C0] sd 0:0:1:0: tag#6075 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 488.985481][ C0] sd 0:0:1:0: tag#6075 CDB[20]: ba [ 489.016267][ T5592] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 489.021549][ T5592] loop2: p1 size 11290111 extends beyond EOD, truncated [ 489.029351][ T5592] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 489.037232][ T5592] loop2: p5 size 11290111 extends beyond EOD, truncated [ 489.044592][ T5592] loop2: p6 size 1912633224 extends beyond EOD, truncated [ 489.055015][T25603] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 489.060328][T25603] loop2: p1 size 11290111 extends beyond EOD, truncated [ 489.067894][T25603] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 489.075801][T25603] loop2: p5 size 11290111 extends beyond EOD, truncated [ 489.083285][T25603] loop2: p6 size 1912633224 extends beyond EOD, truncated [ 489.177169][T25603] loop2: detected capacity change from 0 to 16383 [ 489.232691][ T5592] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 489.237930][ T5592] loop2: p1 size 11290111 extends beyond EOD, truncated [ 489.245484][ T5592] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 489.253294][ T5592] loop2: p5 size 11290111 extends beyond EOD, truncated [ 489.260572][ T5592] loop2: p6 size 1912633224 extends beyond EOD, truncated [ 489.270681][T25603] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 489.275922][T25603] loop2: p1 size 11290111 extends beyond EOD, truncated 09:53:47 executing program 2: syz_read_part_table(0x0, 0x2, &(0x7f0000000100)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0000ffffff85000000060000000000024000ffffff82007e00e100000088770072003007000f00000000000000008000da55aa", 0x40, 0x1c0}, {0x0, 0x0, 0xfffffffffffffffb}]) 09:53:47 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0x4c000000}}}, 0xf0}}, 0x0) 09:53:47 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x6, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10}) 09:53:47 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="5500000618007f083ffe15b282a380930a03000248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) 09:53:47 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) mkdirat(r1, &(0x7f00000000c0)='./file0\x00', 0x0) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r3 = syz_io_uring_setup(0x3ede, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000140)) io_uring_enter(r3, 0x2ff, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x5, 0x0, &(0x7f0000000040)=""/18, 0xffffffde}, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, &(0x7f0000000dc0)=[{&(0x7f0000000100)="f4a4848461fb0592d2f8db4c1f3c9e408788e03d28fe5e69dbceea46dd67888cdedd07a068040b956c3af7", 0x2b}, {0x0}, {0x0}], 0x3, &(0x7f0000000540)=ANY=[@ANYBLOB="1400000000000000", @ANYRES32], 0x50}}, {{0x0, 0x0, &(0x7f0000003180)=[{0x0}, {0x0}], 0x2, &(0x7f00000002c0)=ANY=[@ANYBLOB="c9252cdfb191d94ef15953a086ed40b24a018fb18d39f9a1256b33cf339f1d1bb52846ddaaaecd492eb1d0774b26968a44bf794e9d902a3c02af9543bc4096ac7a27", @ANYRES32, @ANYRES32=0x0], 0x50, 0x4041}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYRESDEC, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000003000000000000000010000000100", @ANYRES32, @ANYRES64, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESDEC=r4], 0xd0, 0x20000000}}], 0x3, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x138, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {0x0, 0x4000}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x48, 0x1, {{'md5\x00'}}}]}, 0x138}}, 0x0) 09:53:47 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x9, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000e80)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) io_uring_enter(r1, 0x0, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x50}}], 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {}, {}, 0x0, 0x5, 0xa}, [@algo_auth={0x58, 0x1, {{'md5\x00'}, 0x80, "f959fb7b2a535a87359f0b633f54f881"}}]}, 0x148}}, 0x0) [ 489.283494][T25603] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 489.291264][T25603] loop2: p5 size 11290111 extends beyond EOD, truncated [ 489.298611][T25603] loop2: p6 size 1912633224 extends beyond EOD, truncated [ 489.367411][ C0] sd 0:0:1:0: tag#6074 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 489.370669][ C1] sd 0:0:1:0: [sg_rq_end_io] Sense Key : Illegal Request [current] [ 489.377258][ C0] sd 0:0:1:0: tag#6074 CDB: opcode=0xe5 (vendor) [ 489.385205][ C1] sd 0:0:1:0: [sg_rq_end_io] Add. Sense: Invalid command operation code [ 489.391532][ C0] sd 0:0:1:0: tag#6074 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 489.408850][ C0] sd 0:0:1:0: tag#6074 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d 09:53:47 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x6, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18}) 09:53:47 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="5500000718007f083ffe15b282a380930a03000248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) 09:53:47 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x9, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000e80)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) io_uring_enter(r1, 0x0, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x50}}], 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {}, {}, 0x0, 0x6, 0xa}, [@algo_auth={0x58, 0x1, {{'md5\x00'}, 0x80, "f959fb7b2a535a87359f0b633f54f881"}}]}, 0x148}}, 0x0) 09:53:47 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0x60000000}}}, 0xf0}}, 0x0) [ 489.417875][ C0] sd 0:0:1:0: tag#6074 CDB[20]: ba 09:53:47 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) mkdirat(r1, &(0x7f00000000c0)='./file0\x00', 0x0) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r3 = syz_io_uring_setup(0x3ede, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000140)) io_uring_enter(r3, 0x2ff, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x5, 0x0, &(0x7f0000000040)=""/18, 0xffffffde}, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, &(0x7f0000000dc0)=[{&(0x7f0000000100)="f4a4848461fb0592d2f8db4c1f3c9e408788e03d28fe5e69dbceea46dd67888cdedd07a068040b956c3af7", 0x2b}, {0x0}, {0x0}], 0x3, &(0x7f0000000540)=ANY=[@ANYBLOB="1400000000000000", @ANYRES32], 0x50}}, {{0x0, 0x0, &(0x7f0000003180)=[{0x0}, {0x0}], 0x2, &(0x7f00000002c0)=ANY=[@ANYBLOB="c9252cdfb191d94ef15953a086ed40b24a018fb18d39f9a1256b33cf339f1d1bb52846ddaaaecd492eb1d0774b26968a44bf794e9d902a3c02af9543bc4096ac7a27", @ANYRES32, @ANYRES32=0x0], 0x50, 0x4041}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYRESDEC, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000003000000000000000010000000100", @ANYRES32, @ANYRES64, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESDEC=r4], 0xd0, 0x20000000}}], 0x3, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x138, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {0x0, 0xb002}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x48, 0x1, {{'md5\x00'}}}]}, 0x138}}, 0x0) 09:53:47 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x6, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x600}) [ 489.576074][ C1] sd 0:0:1:0: [sg_rq_end_io] Sense Key : Illegal Request [current] [ 489.584103][ C1] sd 0:0:1:0: [sg_rq_end_io] Add. Sense: Invalid command operation code [ 489.634579][ C0] sd 0:0:1:0: tag#6040 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 489.644407][ C0] sd 0:0:1:0: tag#6040 CDB: opcode=0xe5 (vendor) [ 489.650777][ C0] sd 0:0:1:0: tag#6040 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 489.659811][ C0] sd 0:0:1:0: tag#6040 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 489.668847][ C0] sd 0:0:1:0: tag#6040 CDB[20]: ba [ 489.681998][ C1] sd 0:0:1:0: tag#6017 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 489.691868][ C1] sd 0:0:1:0: tag#6017 CDB: opcode=0xe5 (vendor) [ 489.698233][ C1] sd 0:0:1:0: tag#6017 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 489.707276][ C1] sd 0:0:1:0: tag#6017 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 489.716290][ C1] sd 0:0:1:0: tag#6017 CDB[20]: ba [ 489.762404][T25636] loop2: detected capacity change from 0 to 16383 [ 489.799860][ C1] sd 0:0:1:0: [sg_rq_end_io] Sense Key : Illegal Request [current] [ 489.807878][ C1] sd 0:0:1:0: [sg_rq_end_io] Add. Sense: Invalid command operation code [ 489.816865][ T5592] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 489.822200][ T5592] loop2: p1 size 11290111 extends beyond EOD, truncated [ 489.829917][ T5592] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 489.838013][ T5592] loop2: p5 size 11290111 extends beyond EOD, truncated [ 489.845405][ T5592] loop2: p6 size 1912633224 extends beyond EOD, truncated [ 489.855488][T25636] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 489.860753][T25636] loop2: p1 size 11290111 extends beyond EOD, truncated [ 489.868892][T25636] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 489.877096][T25636] loop2: p5 size 11290111 extends beyond EOD, truncated [ 489.884453][T25636] loop2: p6 size 1912633224 extends beyond EOD, truncated [ 489.981395][T25636] loop2: detected capacity change from 0 to 16383 09:53:47 executing program 2: syz_read_part_table(0x0, 0x2, &(0x7f0000000100)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0000ffffff85000000060000000000024000ffffff8200fe00e100000088770072003007000f00000000000000008000da55aa", 0x40, 0x1c0}, {0x0, 0x0, 0xfffffffffffffffb}]) 09:53:47 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0x68000000}}}, 0xf0}}, 0x0) 09:53:47 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x9, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000e80)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) io_uring_enter(r1, 0x0, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x50}}], 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {}, {}, 0x0, 0x7, 0xa}, [@algo_auth={0x58, 0x1, {{'md5\x00'}, 0x80, "f959fb7b2a535a87359f0b633f54f881"}}]}, 0x148}}, 0x0) 09:53:47 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="5500000918007f083ffe15b282a380930a03000248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) 09:53:47 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x6, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x700}) 09:53:47 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) mkdirat(r1, &(0x7f00000000c0)='./file0\x00', 0x0) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r3 = syz_io_uring_setup(0x3ede, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000140)) io_uring_enter(r3, 0x2ff, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x5, 0x0, &(0x7f0000000040)=""/18, 0xffffffde}, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, &(0x7f0000000dc0)=[{&(0x7f0000000100)="f4a4848461fb0592d2f8db4c1f3c9e408788e03d28fe5e69dbceea46dd67888cdedd07a068040b956c3af7", 0x2b}, {0x0}, {0x0}], 0x3, &(0x7f0000000540)=ANY=[@ANYBLOB="1400000000000000", @ANYRES32], 0x50}}, {{0x0, 0x0, &(0x7f0000003180)=[{0x0}, {0x0}], 0x2, &(0x7f00000002c0)=ANY=[@ANYBLOB="c9252cdfb191d94ef15953a086ed40b24a018fb18d39f9a1256b33cf339f1d1bb52846ddaaaecd492eb1d0774b26968a44bf794e9d902a3c02af9543bc4096ac7a27", @ANYRES32, @ANYRES32=0x0], 0x50, 0x4041}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYRESDEC, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000003000000000000000010000000100", @ANYRES32, @ANYRES64, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESDEC=r4], 0xd0, 0x20000000}}], 0x3, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x138, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {0x0, 0x1000000}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x48, 0x1, {{'md5\x00'}}}]}, 0x138}}, 0x0) [ 490.036562][T25636] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 490.041812][T25636] loop2: p1 size 11290111 extends beyond EOD, truncated [ 490.049488][T25636] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 490.057360][T25636] loop2: p5 size 11290111 extends beyond EOD, truncated [ 490.064665][T25636] loop2: p6 size 1912633224 extends beyond EOD, truncated 09:53:47 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0x6c000000}}}, 0xf0}}, 0x0) 09:53:47 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) mkdirat(r1, &(0x7f00000000c0)='./file0\x00', 0x0) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r3 = syz_io_uring_setup(0x3ede, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000140)) io_uring_enter(r3, 0x2ff, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x5, 0x0, &(0x7f0000000040)=""/18, 0xffffffde}, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, &(0x7f0000000dc0)=[{&(0x7f0000000100)="f4a4848461fb0592d2f8db4c1f3c9e408788e03d28fe5e69dbceea46dd67888cdedd07a068040b956c3af7", 0x2b}, {0x0}, {0x0}], 0x3, &(0x7f0000000540)=ANY=[@ANYBLOB="1400000000000000", @ANYRES32], 0x50}}, {{0x0, 0x0, &(0x7f0000003180)=[{0x0}, {0x0}], 0x2, &(0x7f00000002c0)=ANY=[@ANYBLOB="c9252cdfb191d94ef15953a086ed40b24a018fb18d39f9a1256b33cf339f1d1bb52846ddaaaecd492eb1d0774b26968a44bf794e9d902a3c02af9543bc4096ac7a27", @ANYRES32, @ANYRES32=0x0], 0x50, 0x4041}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYRESDEC, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000003000000000000000010000000100", @ANYRES32, @ANYRES64, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESDEC=r4], 0xd0, 0x20000000}}], 0x3, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x138, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {0x0, 0x2000000}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x48, 0x1, {{'md5\x00'}}}]}, 0x138}}, 0x0) 09:53:47 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="5500000a18007f083ffe15b282a380930a03000248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) 09:53:47 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x9, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000e80)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) io_uring_enter(r1, 0x0, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x50}}], 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {}, {}, 0x0, 0x8, 0xa}, [@algo_auth={0x58, 0x1, {{'md5\x00'}, 0x80, "f959fb7b2a535a87359f0b633f54f881"}}]}, 0x148}}, 0x0) 09:53:47 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x6, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x900}) [ 490.123504][T25644] __nla_validate_parse: 9 callbacks suppressed [ 490.123517][T25644] netlink: 224 bytes leftover after parsing attributes in process `syz-executor.4'. [ 490.157090][ C1] sd 0:0:1:0: [sg_rq_end_io] Sense Key : Illegal Request [current] [ 490.165142][ C1] sd 0:0:1:0: [sg_rq_end_io] Add. Sense: Invalid command operation code 09:53:48 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0x74000000}}}, 0xf0}}, 0x0) [ 490.331113][T25657] netlink: 224 bytes leftover after parsing attributes in process `syz-executor.4'. [ 490.368844][ C1] sd 0:0:1:0: [sg_rq_end_io] Sense Key : Illegal Request [current] [ 490.376878][ C1] sd 0:0:1:0: [sg_rq_end_io] Add. Sense: Invalid command operation code [ 490.423475][T25665] loop2: detected capacity change from 0 to 16383 [ 490.459520][T25665] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 490.464897][T25665] loop2: p1 size 11290111 extends beyond EOD, truncated [ 490.472883][T25665] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 490.481136][T25665] loop2: p5 size 11290111 extends beyond EOD, truncated [ 490.488401][T25665] loop2: p6 size 1912633224 extends beyond EOD, truncated [ 490.510722][T25667] netlink: 224 bytes leftover after parsing attributes in process `syz-executor.4'. [ 490.610099][T25665] loop2: detected capacity change from 0 to 16383 09:53:48 executing program 2: syz_read_part_table(0x0, 0x2, &(0x7f0000000100)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0000ffffff85000000060000000000024000ffffff82000402e100000088770072003007000f00000000000000008000da55aa", 0x40, 0x1c0}, {0x0, 0x0, 0xfffffffffffffffb}]) 09:53:48 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="5500000b18007f083ffe15b282a380930a03000248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) 09:53:48 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x6, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd00}) 09:53:48 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x9, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000e80)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) io_uring_enter(r1, 0x0, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x50}}], 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {}, {}, 0x0, 0x9, 0xa}, [@algo_auth={0x58, 0x1, {{'md5\x00'}, 0x80, "f959fb7b2a535a87359f0b633f54f881"}}]}, 0x148}}, 0x0) 09:53:48 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) mkdirat(r1, &(0x7f00000000c0)='./file0\x00', 0x0) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r3 = syz_io_uring_setup(0x3ede, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000140)) io_uring_enter(r3, 0x2ff, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x5, 0x0, &(0x7f0000000040)=""/18, 0xffffffde}, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, &(0x7f0000000dc0)=[{&(0x7f0000000100)="f4a4848461fb0592d2f8db4c1f3c9e408788e03d28fe5e69dbceea46dd67888cdedd07a068040b956c3af7", 0x2b}, {0x0}, {0x0}], 0x3, &(0x7f0000000540)=ANY=[@ANYBLOB="1400000000000000", @ANYRES32], 0x50}}, {{0x0, 0x0, &(0x7f0000003180)=[{0x0}, {0x0}], 0x2, &(0x7f00000002c0)=ANY=[@ANYBLOB="c9252cdfb191d94ef15953a086ed40b24a018fb18d39f9a1256b33cf339f1d1bb52846ddaaaecd492eb1d0774b26968a44bf794e9d902a3c02af9543bc4096ac7a27", @ANYRES32, @ANYRES32=0x0], 0x50, 0x4041}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYRESDEC, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000003000000000000000010000000100", @ANYRES32, @ANYRES64, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESDEC=r4], 0xd0, 0x20000000}}], 0x3, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x138, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {0x0, 0x3000000}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x48, 0x1, {{'md5\x00'}}}]}, 0x138}}, 0x0) 09:53:48 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0x7a000000}}}, 0xf0}}, 0x0) [ 490.655027][T25665] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 490.660294][T25665] loop2: p1 size 11290111 extends beyond EOD, truncated [ 490.668074][T25665] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 490.675963][T25665] loop2: p5 size 11290111 extends beyond EOD, truncated [ 490.683240][T25665] loop2: p6 size 1912633224 extends beyond EOD, truncated 09:53:48 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x6, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe00}) 09:53:48 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="5500000c18007f083ffe15b282a380930a03000248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) 09:53:48 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x9, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000e80)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) io_uring_enter(r1, 0x0, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x50}}], 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {}, {}, 0x0, 0xa, 0xa}, [@algo_auth={0x58, 0x1, {{'md5\x00'}, 0x80, "f959fb7b2a535a87359f0b633f54f881"}}]}, 0x148}}, 0x0) 09:53:48 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0x9effffff}}}, 0xf0}}, 0x0) 09:53:48 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) mkdirat(r1, &(0x7f00000000c0)='./file0\x00', 0x0) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r3 = syz_io_uring_setup(0x3ede, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000140)) io_uring_enter(r3, 0x2ff, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x5, 0x0, &(0x7f0000000040)=""/18, 0xffffffde}, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, &(0x7f0000000dc0)=[{&(0x7f0000000100)="f4a4848461fb0592d2f8db4c1f3c9e408788e03d28fe5e69dbceea46dd67888cdedd07a068040b956c3af7", 0x2b}, {0x0}, {0x0}], 0x3, &(0x7f0000000540)=ANY=[@ANYBLOB="1400000000000000", @ANYRES32], 0x50}}, {{0x0, 0x0, &(0x7f0000003180)=[{0x0}, {0x0}], 0x2, &(0x7f00000002c0)=ANY=[@ANYBLOB="c9252cdfb191d94ef15953a086ed40b24a018fb18d39f9a1256b33cf339f1d1bb52846ddaaaecd492eb1d0774b26968a44bf794e9d902a3c02af9543bc4096ac7a27", @ANYRES32, @ANYRES32=0x0], 0x50, 0x4041}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYRESDEC, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000003000000000000000010000000100", @ANYRES32, @ANYRES64, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESDEC=r4], 0xd0, 0x20000000}}], 0x3, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x138, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {0x0, 0x4000000}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x48, 0x1, {{'md5\x00'}}}]}, 0x138}}, 0x0) [ 490.754879][ C1] sd 0:0:1:0: [sg_rq_end_io] Sense Key : Illegal Request [current] [ 490.762893][ C1] sd 0:0:1:0: [sg_rq_end_io] Add. Sense: Invalid command operation code [ 490.785971][T25677] netlink: 224 bytes leftover after parsing attributes in process `syz-executor.4'. 09:53:48 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x9, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000e80)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) io_uring_enter(r1, 0x0, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x50}}], 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {}, {}, 0x0, 0xb, 0xa}, [@algo_auth={0x58, 0x1, {{'md5\x00'}, 0x80, "f959fb7b2a535a87359f0b633f54f881"}}]}, 0x148}}, 0x0) [ 490.979096][ C1] sd 0:0:1:0: [sg_rq_end_io] Sense Key : Illegal Request [current] [ 490.987202][ C1] sd 0:0:1:0: [sg_rq_end_io] Add. Sense: Invalid command operation code [ 491.013291][T25691] netlink: 224 bytes leftover after parsing attributes in process `syz-executor.4'. [ 491.097181][T25695] loop2: detected capacity change from 0 to 16383 [ 491.129001][T25695] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 491.134372][T25695] loop2: p1 size 11290111 extends beyond EOD, truncated [ 491.143418][T25695] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 491.151325][T25695] loop2: p5 size 11290111 extends beyond EOD, truncated [ 491.158558][T25695] loop2: p6 size 1912633224 extends beyond EOD, truncated [ 491.259524][T25695] loop2: detected capacity change from 0 to 16383 [ 491.304838][T25695] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 491.310163][T25695] loop2: p1 size 11290111 extends beyond EOD, truncated [ 491.317942][T25695] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 491.325715][T25695] loop2: p5 size 11290111 extends beyond EOD, truncated [ 491.332950][T25695] loop2: p6 size 1912633224 extends beyond EOD, truncated 09:53:49 executing program 2: syz_read_part_table(0x0, 0x2, &(0x7f0000000100)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0000ffffff85000000060000000000024000ffffff82000003e100000088770072003007000f00000000000000008000da55aa", 0x40, 0x1c0}, {0x0, 0x0, 0xfffffffffffffffb}]) 09:53:49 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="5500000d18007f083ffe15b282a380930a03000248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) 09:53:49 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x6, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1800}) 09:53:49 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0xc00e0000}}}, 0xf0}}, 0x0) 09:53:49 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) mkdirat(r1, &(0x7f00000000c0)='./file0\x00', 0x0) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r3 = syz_io_uring_setup(0x3ede, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000140)) io_uring_enter(r3, 0x2ff, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x5, 0x0, &(0x7f0000000040)=""/18, 0xffffffde}, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, &(0x7f0000000dc0)=[{&(0x7f0000000100)="f4a4848461fb0592d2f8db4c1f3c9e408788e03d28fe5e69dbceea46dd67888cdedd07a068040b956c3af7", 0x2b}, {0x0}, {0x0}], 0x3, &(0x7f0000000540)=ANY=[@ANYBLOB="1400000000000000", @ANYRES32], 0x50}}, {{0x0, 0x0, &(0x7f0000003180)=[{0x0}, {0x0}], 0x2, &(0x7f00000002c0)=ANY=[@ANYBLOB="c9252cdfb191d94ef15953a086ed40b24a018fb18d39f9a1256b33cf339f1d1bb52846ddaaaecd492eb1d0774b26968a44bf794e9d902a3c02af9543bc4096ac7a27", @ANYRES32, @ANYRES32=0x0], 0x50, 0x4041}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYRESDEC, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000003000000000000000010000000100", @ANYRES32, @ANYRES64, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESDEC=r4], 0xd0, 0x20000000}}], 0x3, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x138, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {0x0, 0x5000000}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x48, 0x1, {{'md5\x00'}}}]}, 0x138}}, 0x0) 09:53:49 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x9, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000e80)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) io_uring_enter(r1, 0x0, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x50}}], 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {}, {}, 0x0, 0x10, 0xa}, [@algo_auth={0x58, 0x1, {{'md5\x00'}, 0x80, "f959fb7b2a535a87359f0b633f54f881"}}]}, 0x148}}, 0x0) 09:53:49 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="5500000e18007f083ffe15b282a380930a03000248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) 09:53:49 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x6, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1d2b}) 09:53:49 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x9, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000e80)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) io_uring_enter(r1, 0x0, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x50}}], 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {}, {}, 0x0, 0x11, 0xa}, [@algo_auth={0x58, 0x1, {{'md5\x00'}, 0x80, "f959fb7b2a535a87359f0b633f54f881"}}]}, 0x148}}, 0x0) 09:53:49 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) mkdirat(r1, &(0x7f00000000c0)='./file0\x00', 0x0) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r3 = syz_io_uring_setup(0x3ede, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000140)) io_uring_enter(r3, 0x2ff, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x5, 0x0, &(0x7f0000000040)=""/18, 0xffffffde}, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, &(0x7f0000000dc0)=[{&(0x7f0000000100)="f4a4848461fb0592d2f8db4c1f3c9e408788e03d28fe5e69dbceea46dd67888cdedd07a068040b956c3af7", 0x2b}, {0x0}, {0x0}], 0x3, &(0x7f0000000540)=ANY=[@ANYBLOB="1400000000000000", @ANYRES32], 0x50}}, {{0x0, 0x0, &(0x7f0000003180)=[{0x0}, {0x0}], 0x2, &(0x7f00000002c0)=ANY=[@ANYBLOB="c9252cdfb191d94ef15953a086ed40b24a018fb18d39f9a1256b33cf339f1d1bb52846ddaaaecd492eb1d0774b26968a44bf794e9d902a3c02af9543bc4096ac7a27", @ANYRES32, @ANYRES32=0x0], 0x50, 0x4041}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYRESDEC, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000003000000000000000010000000100", @ANYRES32, @ANYRES64, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESDEC=r4], 0xd0, 0x20000000}}], 0x3, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x138, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {0x0, 0x6000000}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x48, 0x1, {{'md5\x00'}}}]}, 0x138}}, 0x0) 09:53:49 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0xeaffffff}}}, 0xf0}}, 0x0) [ 491.435188][ C1] sd 0:0:1:0: [sg_rq_end_io] Sense Key : Illegal Request [current] [ 491.435769][T25708] netlink: 224 bytes leftover after parsing attributes in process `syz-executor.4'. [ 491.443203][ C1] sd 0:0:1:0: [sg_rq_end_io] Add. Sense: Invalid command operation code 09:53:49 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="5500000f18007f083ffe15b282a380930a03000248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) [ 491.549523][ C1] sd 0:0:1:0: [sg_rq_end_io] Sense Key : Illegal Request [current] [ 491.557528][ C1] sd 0:0:1:0: [sg_rq_end_io] Add. Sense: Invalid command operation code [ 491.647726][T25724] loop2: detected capacity change from 0 to 16383 [ 491.653024][T25725] netlink: 224 bytes leftover after parsing attributes in process `syz-executor.4'. [ 491.675347][ T5592] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 491.680597][ T5592] loop2: p1 size 11290111 extends beyond EOD, truncated [ 491.688467][ T5592] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 491.696952][ T5592] loop2: p5 size 11290111 extends beyond EOD, truncated [ 491.704188][ T5592] loop2: p6 size 1912633224 extends beyond EOD, truncated [ 491.714055][T25724] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 491.719303][T25724] loop2: p1 size 11290111 extends beyond EOD, truncated [ 491.727218][T25724] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 491.735174][T25724] loop2: p5 size 11290111 extends beyond EOD, truncated [ 491.742789][T25724] loop2: p6 size 1912633224 extends beyond EOD, truncated [ 491.834979][T25724] loop2: detected capacity change from 0 to 16383 [ 491.881417][T25724] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 491.886686][T25724] loop2: p1 size 11290111 extends beyond EOD, truncated [ 491.894475][T25724] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 491.902264][T25724] loop2: p5 size 11290111 extends beyond EOD, truncated [ 491.909702][T25724] loop2: p6 size 1912633224 extends beyond EOD, truncated 09:53:49 executing program 2: syz_read_part_table(0x0, 0x2, &(0x7f0000000100)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0000ffffff85000000060000000000024000ffffff82000204e100000088770072003007000f00000000000000008000da55aa", 0x40, 0x1c0}, {0x0, 0x0, 0xfffffffffffffffb}]) 09:53:49 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x6, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2b1d}) 09:53:49 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x9, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000e80)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) io_uring_enter(r1, 0x0, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x50}}], 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {}, {}, 0x0, 0x14, 0xa}, [@algo_auth={0x58, 0x1, {{'md5\x00'}, 0x80, "f959fb7b2a535a87359f0b633f54f881"}}]}, 0x148}}, 0x0) 09:53:49 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) mkdirat(r1, &(0x7f00000000c0)='./file0\x00', 0x0) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r3 = syz_io_uring_setup(0x3ede, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000140)) io_uring_enter(r3, 0x2ff, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x5, 0x0, &(0x7f0000000040)=""/18, 0xffffffde}, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, &(0x7f0000000dc0)=[{&(0x7f0000000100)="f4a4848461fb0592d2f8db4c1f3c9e408788e03d28fe5e69dbceea46dd67888cdedd07a068040b956c3af7", 0x2b}, {0x0}, {0x0}], 0x3, &(0x7f0000000540)=ANY=[@ANYBLOB="1400000000000000", @ANYRES32], 0x50}}, {{0x0, 0x0, &(0x7f0000003180)=[{0x0}, {0x0}], 0x2, &(0x7f00000002c0)=ANY=[@ANYBLOB="c9252cdfb191d94ef15953a086ed40b24a018fb18d39f9a1256b33cf339f1d1bb52846ddaaaecd492eb1d0774b26968a44bf794e9d902a3c02af9543bc4096ac7a27", @ANYRES32, @ANYRES32=0x0], 0x50, 0x4041}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYRESDEC, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000003000000000000000010000000100", @ANYRES32, @ANYRES64, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESDEC=r4], 0xd0, 0x20000000}}], 0x3, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x138, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {0x0, 0x7000000}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x48, 0x1, {{'md5\x00'}}}]}, 0x138}}, 0x0) 09:53:49 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0xefffffff}}}, 0xf0}}, 0x0) 09:53:49 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="5500001118007f083ffe15b282a380930a03000248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) [ 491.955226][ T383] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 491.960463][ T383] loop2: p1 size 11290111 extends beyond EOD, truncated [ 491.977018][ T383] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 491.985043][ T383] loop2: p5 size 11290111 extends beyond EOD, truncated [ 491.992270][ T383] loop2: p6 size 1912633224 extends beyond EOD, truncated 09:53:49 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x9, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000e80)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) io_uring_enter(r1, 0x0, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x50}}], 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {}, {}, 0x0, 0x262, 0xa}, [@algo_auth={0x58, 0x1, {{'md5\x00'}, 0x80, "f959fb7b2a535a87359f0b633f54f881"}}]}, 0x148}}, 0x0) 09:53:49 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="5500001218007f083ffe15b282a380930a03000248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) 09:53:49 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0xf0ffffff}}}, 0xf0}}, 0x0) 09:53:49 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) mkdirat(r1, &(0x7f00000000c0)='./file0\x00', 0x0) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r3 = syz_io_uring_setup(0x3ede, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000140)) io_uring_enter(r3, 0x2ff, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x5, 0x0, &(0x7f0000000040)=""/18, 0xffffffde}, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, &(0x7f0000000dc0)=[{&(0x7f0000000100)="f4a4848461fb0592d2f8db4c1f3c9e408788e03d28fe5e69dbceea46dd67888cdedd07a068040b956c3af7", 0x2b}, {0x0}, {0x0}], 0x3, &(0x7f0000000540)=ANY=[@ANYBLOB="1400000000000000", @ANYRES32], 0x50}}, {{0x0, 0x0, &(0x7f0000003180)=[{0x0}, {0x0}], 0x2, &(0x7f00000002c0)=ANY=[@ANYBLOB="c9252cdfb191d94ef15953a086ed40b24a018fb18d39f9a1256b33cf339f1d1bb52846ddaaaecd492eb1d0774b26968a44bf794e9d902a3c02af9543bc4096ac7a27", @ANYRES32, @ANYRES32=0x0], 0x50, 0x4041}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYRESDEC, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000003000000000000000010000000100", @ANYRES32, @ANYRES64, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESDEC=r4], 0xd0, 0x20000000}}], 0x3, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x138, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {0x0, 0x8000000}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x48, 0x1, {{'md5\x00'}}}]}, 0x138}}, 0x0) 09:53:49 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x6, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000}) [ 492.011258][T25738] netlink: 224 bytes leftover after parsing attributes in process `syz-executor.4'. [ 492.020764][ C1] sd 0:0:1:0: [sg_rq_end_io] Sense Key : Illegal Request [current] [ 492.028785][ C1] sd 0:0:1:0: [sg_rq_end_io] Add. Sense: Invalid command operation code 09:53:49 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x9, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000e80)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) io_uring_enter(r1, 0x0, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x50}}], 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {}, {}, 0x0, 0x300, 0xa}, [@algo_auth={0x58, 0x1, {{'md5\x00'}, 0x80, "f959fb7b2a535a87359f0b633f54f881"}}]}, 0x148}}, 0x0) [ 492.192598][T25749] netlink: 224 bytes leftover after parsing attributes in process `syz-executor.4'. [ 492.220334][T25752] netlink: 72 bytes leftover after parsing attributes in process `syz-executor.1'. [ 492.230922][ C1] sd 0:0:1:0: [sg_rq_end_io] Sense Key : Illegal Request [current] [ 492.238921][ C1] sd 0:0:1:0: [sg_rq_end_io] Add. Sense: Invalid command operation code [ 492.306493][T25755] loop2: detected capacity change from 0 to 16383 [ 492.345103][ T5592] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 492.350474][ T5592] loop2: p1 size 11290111 extends beyond EOD, truncated [ 492.358177][ T5592] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 492.365874][ T5592] loop2: p5 size 11290111 extends beyond EOD, truncated [ 492.373263][ T5592] loop2: p6 size 1912633224 extends beyond EOD, truncated [ 492.383979][T25755] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 492.389305][T25755] loop2: p1 size 11290111 extends beyond EOD, truncated [ 492.401441][T25755] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 492.409458][T25755] loop2: p5 size 11290111 extends beyond EOD, truncated [ 492.416783][T25755] loop2: p6 size 1912633224 extends beyond EOD, truncated 09:53:50 executing program 2: syz_read_part_table(0x0, 0x2, &(0x7f0000000100)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0000ffffff85000000060000000000024000ffffff82000604e100000088770072003007000f00000000000000008000da55aa", 0x40, 0x1c0}, {0x0, 0x0, 0xfffffffffffffffb}]) 09:53:50 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0xfeffffff}}}, 0xf0}}, 0x0) 09:53:50 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="5500002018007f083ffe15b282a380930a03000248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) 09:53:50 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x6, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000}) 09:53:50 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) mkdirat(r1, &(0x7f00000000c0)='./file0\x00', 0x0) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r3 = syz_io_uring_setup(0x3ede, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000140)) io_uring_enter(r3, 0x2ff, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x5, 0x0, &(0x7f0000000040)=""/18, 0xffffffde}, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, &(0x7f0000000dc0)=[{&(0x7f0000000100)="f4a4848461fb0592d2f8db4c1f3c9e408788e03d28fe5e69dbceea46dd67888cdedd07a068040b956c3af7", 0x2b}, {0x0}, {0x0}], 0x3, &(0x7f0000000540)=ANY=[@ANYBLOB="1400000000000000", @ANYRES32], 0x50}}, {{0x0, 0x0, &(0x7f0000003180)=[{0x0}, {0x0}], 0x2, &(0x7f00000002c0)=ANY=[@ANYBLOB="c9252cdfb191d94ef15953a086ed40b24a018fb18d39f9a1256b33cf339f1d1bb52846ddaaaecd492eb1d0774b26968a44bf794e9d902a3c02af9543bc4096ac7a27", @ANYRES32, @ANYRES32=0x0], 0x50, 0x4041}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYRESDEC, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000003000000000000000010000000100", @ANYRES32, @ANYRES64, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESDEC=r4], 0xd0, 0x20000000}}], 0x3, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x138, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {0x0, 0x9000000}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x48, 0x1, {{'md5\x00'}}}]}, 0x138}}, 0x0) 09:53:50 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x9, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000e80)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) io_uring_enter(r1, 0x0, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x50}}], 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {}, {}, 0x0, 0x500, 0xa}, [@algo_auth={0x58, 0x1, {{'md5\x00'}, 0x80, "f959fb7b2a535a87359f0b633f54f881"}}]}, 0x148}}, 0x0) 09:53:50 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="5500002518007f083ffe15b282a380930a03000248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) 09:53:50 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0xffffff7f}}}, 0xf0}}, 0x0) 09:53:50 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x9, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000e80)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) io_uring_enter(r1, 0x0, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x50}}], 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {}, {}, 0x0, 0x600, 0xa}, [@algo_auth={0x58, 0x1, {{'md5\x00'}, 0x80, "f959fb7b2a535a87359f0b633f54f881"}}]}, 0x148}}, 0x0) 09:53:50 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x6, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000}) [ 492.530744][ C1] sd 0:0:1:0: [sg_rq_end_io] Sense Key : Illegal Request [current] [ 492.538774][ C1] sd 0:0:1:0: [sg_rq_end_io] Add. Sense: Invalid command operation code 09:53:50 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) mkdirat(r1, &(0x7f00000000c0)='./file0\x00', 0x0) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r3 = syz_io_uring_setup(0x3ede, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000140)) io_uring_enter(r3, 0x2ff, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x5, 0x0, &(0x7f0000000040)=""/18, 0xffffffde}, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, &(0x7f0000000dc0)=[{&(0x7f0000000100)="f4a4848461fb0592d2f8db4c1f3c9e408788e03d28fe5e69dbceea46dd67888cdedd07a068040b956c3af7", 0x2b}, {0x0}, {0x0}], 0x3, &(0x7f0000000540)=ANY=[@ANYBLOB="1400000000000000", @ANYRES32], 0x50}}, {{0x0, 0x0, &(0x7f0000003180)=[{0x0}, {0x0}], 0x2, &(0x7f00000002c0)=ANY=[@ANYBLOB="c9252cdfb191d94ef15953a086ed40b24a018fb18d39f9a1256b33cf339f1d1bb52846ddaaaecd492eb1d0774b26968a44bf794e9d902a3c02af9543bc4096ac7a27", @ANYRES32, @ANYRES32=0x0], 0x50, 0x4041}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYRESDEC, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000003000000000000000010000000100", @ANYRES32, @ANYRES64, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESDEC=r4], 0xd0, 0x20000000}}], 0x3, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x138, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {0x0, 0xa000000}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x48, 0x1, {{'md5\x00'}}}]}, 0x138}}, 0x0) 09:53:50 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="5500003f18007f083ffe15b282a380930a03000248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) [ 492.700624][ C1] sd 0:0:1:0: [sg_rq_end_io] Sense Key : Illegal Request [current] [ 492.708654][ C1] sd 0:0:1:0: [sg_rq_end_io] Add. Sense: Invalid command operation code [ 492.717725][T25783] loop2: detected capacity change from 0 to 16383 [ 492.757460][ T5592] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 492.762736][ T5592] loop2: p1 size 11290111 extends beyond EOD, truncated [ 492.770510][ T5592] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 492.778730][ T5592] loop2: p5 size 11290111 extends beyond EOD, truncated [ 492.786109][ T5592] loop2: p6 size 1912633224 extends beyond EOD, truncated [ 492.796319][T25783] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 492.801619][T25783] loop2: p1 size 11290111 extends beyond EOD, truncated [ 492.809368][T25783] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 492.817229][T25783] loop2: p5 size 11290111 extends beyond EOD, truncated [ 492.824946][T25783] loop2: p6 size 1912633224 extends beyond EOD, truncated [ 492.938215][T25783] loop2: detected capacity change from 0 to 16383 [ 493.004722][ T5592] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 493.010074][ T5592] loop2: p1 size 11290111 extends beyond EOD, truncated [ 493.017681][ T5592] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 493.025469][ T5592] loop2: p5 size 11290111 extends beyond EOD, truncated [ 493.032652][ T5592] loop2: p6 size 1912633224 extends beyond EOD, truncated [ 493.042160][T25783] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 493.047486][T25783] loop2: p1 size 11290111 extends beyond EOD, truncated 09:53:50 executing program 2: syz_read_part_table(0x0, 0x2, &(0x7f0000000100)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0000ffffff85000000060000000000024000ffffff82000005e100000088770072003007000f00000000000000008000da55aa", 0x40, 0x1c0}, {0x0, 0x0, 0xfffffffffffffffb}]) 09:53:50 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x6, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6000000}) 09:53:50 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x9, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000e80)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) io_uring_enter(r1, 0x0, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x50}}], 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {}, {}, 0x0, 0x700, 0xa}, [@algo_auth={0x58, 0x1, {{'md5\x00'}, 0x80, "f959fb7b2a535a87359f0b633f54f881"}}]}, 0x148}}, 0x0) 09:53:50 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) mkdirat(r1, &(0x7f00000000c0)='./file0\x00', 0x0) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r3 = syz_io_uring_setup(0x3ede, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000140)) io_uring_enter(r3, 0x2ff, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x5, 0x0, &(0x7f0000000040)=""/18, 0xffffffde}, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, &(0x7f0000000dc0)=[{&(0x7f0000000100)="f4a4848461fb0592d2f8db4c1f3c9e408788e03d28fe5e69dbceea46dd67888cdedd07a068040b956c3af7", 0x2b}, {0x0}, {0x0}], 0x3, &(0x7f0000000540)=ANY=[@ANYBLOB="1400000000000000", @ANYRES32], 0x50}}, {{0x0, 0x0, &(0x7f0000003180)=[{0x0}, {0x0}], 0x2, &(0x7f00000002c0)=ANY=[@ANYBLOB="c9252cdfb191d94ef15953a086ed40b24a018fb18d39f9a1256b33cf339f1d1bb52846ddaaaecd492eb1d0774b26968a44bf794e9d902a3c02af9543bc4096ac7a27", @ANYRES32, @ANYRES32=0x0], 0x50, 0x4041}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYRESDEC, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000003000000000000000010000000100", @ANYRES32, @ANYRES64, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESDEC=r4], 0xd0, 0x20000000}}], 0x3, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x138, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {0x0, 0xb000000}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x48, 0x1, {{'md5\x00'}}}]}, 0x138}}, 0x0) 09:53:50 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0xffffff9e}}}, 0xf0}}, 0x0) 09:53:50 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="5500004818007f083ffe15b282a380930a03000248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) [ 493.055037][T25783] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 493.062920][T25783] loop2: p5 size 11290111 extends beyond EOD, truncated [ 493.070149][T25783] loop2: p6 size 1912633224 extends beyond EOD, truncated 09:53:50 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x9, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000e80)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) io_uring_enter(r1, 0x0, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x50}}], 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {}, {}, 0x0, 0x900, 0xa}, [@algo_auth={0x58, 0x1, {{'md5\x00'}, 0x80, "f959fb7b2a535a87359f0b633f54f881"}}]}, 0x148}}, 0x0) 09:53:50 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="5500004c18007f083ffe15b282a380930a03000248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) 09:53:50 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffea}}}, 0xf0}}, 0x0) [ 493.140908][ C1] sd 0:0:1:0: [sg_rq_end_io] Sense Key : Illegal Request [current] [ 493.148970][ C1] sd 0:0:1:0: [sg_rq_end_io] Add. Sense: Invalid command operation code [ 493.158872][ C1] scsi_io_completion_action: 18 callbacks suppressed [ 493.158897][ C1] sd 0:0:1:0: tag#6031 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 493.175413][ C1] sd 0:0:1:0: tag#6031 CDB: opcode=0xe5 (vendor) [ 493.181780][ C1] sd 0:0:1:0: tag#6031 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c 09:53:50 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x6, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7000000}) [ 493.190885][ C1] sd 0:0:1:0: tag#6031 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 493.199883][ C1] sd 0:0:1:0: tag#6031 CDB[20]: ba [ 493.216411][ C0] sd 0:0:1:0: tag#6048 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 493.226230][ C0] sd 0:0:1:0: tag#6048 CDB: opcode=0xe5 (vendor) [ 493.232567][ C0] sd 0:0:1:0: tag#6048 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c 09:53:50 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) mkdirat(r1, &(0x7f00000000c0)='./file0\x00', 0x0) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r3 = syz_io_uring_setup(0x3ede, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000140)) io_uring_enter(r3, 0x2ff, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x5, 0x0, &(0x7f0000000040)=""/18, 0xffffffde}, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, &(0x7f0000000dc0)=[{&(0x7f0000000100)="f4a4848461fb0592d2f8db4c1f3c9e408788e03d28fe5e69dbceea46dd67888cdedd07a068040b956c3af7", 0x2b}, {0x0}, {0x0}], 0x3, &(0x7f0000000540)=ANY=[@ANYBLOB="1400000000000000", @ANYRES32], 0x50}}, {{0x0, 0x0, &(0x7f0000003180)=[{0x0}, {0x0}], 0x2, &(0x7f00000002c0)=ANY=[@ANYBLOB="c9252cdfb191d94ef15953a086ed40b24a018fb18d39f9a1256b33cf339f1d1bb52846ddaaaecd492eb1d0774b26968a44bf794e9d902a3c02af9543bc4096ac7a27", @ANYRES32, @ANYRES32=0x0], 0x50, 0x4041}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYRESDEC, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000003000000000000000010000000100", @ANYRES32, @ANYRES64, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESDEC=r4], 0xd0, 0x20000000}}], 0x3, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x138, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {0x0, 0x10000000}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x48, 0x1, {{'md5\x00'}}}]}, 0x138}}, 0x0) [ 493.241585][ C0] sd 0:0:1:0: tag#6048 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 493.250591][ C0] sd 0:0:1:0: tag#6048 CDB[20]: ba 09:53:51 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="5500025418007f083ffe15b282a380930a03000248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) [ 493.371428][ C1] sd 0:0:1:0: [sg_rq_end_io] Sense Key : Illegal Request [current] [ 493.379460][ C1] sd 0:0:1:0: [sg_rq_end_io] Add. Sense: Invalid command operation code [ 493.460083][ C1] sd 0:0:1:0: tag#6039 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 493.462414][ T5428] udevd[5428]: inotify_add_watch(7, /dev/loop2p2, 10) failed: No such file or directory [ 493.469947][ C1] sd 0:0:1:0: tag#6039 CDB: opcode=0xe5 (vendor) [ 493.469976][ C1] sd 0:0:1:0: tag#6039 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 493.485700][ T5592] udevd[5592]: inotify_add_watch(7, /dev/loop2p1, 10) failed: No such file or directory [ 493.485998][ C1] sd 0:0:1:0: tag#6039 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 493.496147][ T5552] udevd[5552]: inotify_add_watch(7, /dev/loop2p5, 10) failed: No such file or directory [ 493.504745][ C1] sd 0:0:1:0: tag#6039 CDB[20]: ba [ 493.514773][ T5551] udevd[5551]: inotify_add_watch(7, /dev/loop2p6, 10) failed: No such file or directory [ 493.525103][T13989] udevd[13989]: inotify_add_watch(7, /dev/loop2p3, 10) failed: No such file or directory [ 493.533825][T16174] udevd[16174]: inotify_add_watch(7, /dev/loop2p4, 10) failed: No such file or directory [ 493.596711][T25819] loop2: detected capacity change from 0 to 16383 [ 493.633353][ T5592] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 493.638733][ T5592] loop2: p1 size 11290111 extends beyond EOD, truncated [ 493.646508][ T5592] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 493.655044][ T5592] loop2: p5 size 11290111 extends beyond EOD, truncated [ 493.662412][ T5592] loop2: p6 size 1912633224 extends beyond EOD, truncated [ 493.672345][T25819] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 493.677665][T25819] loop2: p1 size 11290111 extends beyond EOD, truncated [ 493.685372][T25819] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 493.693121][T25819] loop2: p5 size 11290111 extends beyond EOD, truncated [ 493.700661][T25819] loop2: p6 size 1912633224 extends beyond EOD, truncated [ 493.789495][T25819] loop2: detected capacity change from 0 to 16383 [ 493.829237][T25819] loop2: p1 p2 < > p3 p4 < p5 p6 > 09:53:51 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x9, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000e80)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) io_uring_enter(r1, 0x0, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x50}}], 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {}, {}, 0x0, 0xa00, 0xa}, [@algo_auth={0x58, 0x1, {{'md5\x00'}, 0x80, "f959fb7b2a535a87359f0b633f54f881"}}]}, 0x148}}, 0x0) 09:53:51 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffef}}}, 0xf0}}, 0x0) 09:53:51 executing program 2: syz_read_part_table(0x0, 0x2, &(0x7f0000000100)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0000ffffff85000000060000000000024000ffffff82000006e100000088770072003007000f00000000000000008000da55aa", 0x40, 0x1c0}, {0x0, 0x0, 0xfffffffffffffffb}]) 09:53:51 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="5500025818007f083ffe15b282a380930a03000248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) 09:53:51 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x6, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9000000}) 09:53:51 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) mkdirat(r1, &(0x7f00000000c0)='./file0\x00', 0x0) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r3 = syz_io_uring_setup(0x3ede, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000140)) io_uring_enter(r3, 0x2ff, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x5, 0x0, &(0x7f0000000040)=""/18, 0xffffffde}, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, &(0x7f0000000dc0)=[{&(0x7f0000000100)="f4a4848461fb0592d2f8db4c1f3c9e408788e03d28fe5e69dbceea46dd67888cdedd07a068040b956c3af7", 0x2b}, {0x0}, {0x0}], 0x3, &(0x7f0000000540)=ANY=[@ANYBLOB="1400000000000000", @ANYRES32], 0x50}}, {{0x0, 0x0, &(0x7f0000003180)=[{0x0}, {0x0}], 0x2, &(0x7f00000002c0)=ANY=[@ANYBLOB="c9252cdfb191d94ef15953a086ed40b24a018fb18d39f9a1256b33cf339f1d1bb52846ddaaaecd492eb1d0774b26968a44bf794e9d902a3c02af9543bc4096ac7a27", @ANYRES32, @ANYRES32=0x0], 0x50, 0x4041}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYRESDEC, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000003000000000000000010000000100", @ANYRES32, @ANYRES64, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESDEC=r4], 0xd0, 0x20000000}}], 0x3, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x138, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {0x0, 0x11000000}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x48, 0x1, {{'md5\x00'}}}]}, 0x138}}, 0x0) [ 493.834525][T25819] loop2: p1 size 11290111 extends beyond EOD, truncated [ 493.842381][T25819] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 493.850423][T25819] loop2: p5 size 11290111 extends beyond EOD, truncated [ 493.857693][T25819] loop2: p6 size 1912633224 extends beyond EOD, truncated 09:53:51 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="5500006018007f083ffe15b282a380930a03000248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) 09:53:51 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x9, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000e80)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) io_uring_enter(r1, 0x0, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x50}}], 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {}, {}, 0x0, 0xb00, 0xa}, [@algo_auth={0x58, 0x1, {{'md5\x00'}, 0x80, "f959fb7b2a535a87359f0b633f54f881"}}]}, 0x148}}, 0x0) 09:53:51 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffff0}}}, 0xf0}}, 0x0) 09:53:51 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x6, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd000000}) [ 493.930777][ C1] sd 0:0:1:0: [sg_rq_end_io] Sense Key : Illegal Request [current] [ 493.938843][ C1] sd 0:0:1:0: [sg_rq_end_io] Add. Sense: Invalid command operation code [ 493.952972][ C0] sd 0:0:1:0: tag#6021 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 493.962806][ C0] sd 0:0:1:0: tag#6021 CDB: opcode=0xe5 (vendor) [ 493.969184][ C0] sd 0:0:1:0: tag#6021 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c 09:53:51 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) mkdirat(r1, &(0x7f00000000c0)='./file0\x00', 0x0) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r3 = syz_io_uring_setup(0x3ede, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000140)) io_uring_enter(r3, 0x2ff, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x5, 0x0, &(0x7f0000000040)=""/18, 0xffffffde}, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, &(0x7f0000000dc0)=[{&(0x7f0000000100)="f4a4848461fb0592d2f8db4c1f3c9e408788e03d28fe5e69dbceea46dd67888cdedd07a068040b956c3af7", 0x2b}, {0x0}, {0x0}], 0x3, &(0x7f0000000540)=ANY=[@ANYBLOB="1400000000000000", @ANYRES32], 0x50}}, {{0x0, 0x0, &(0x7f0000003180)=[{0x0}, {0x0}], 0x2, &(0x7f00000002c0)=ANY=[@ANYBLOB="c9252cdfb191d94ef15953a086ed40b24a018fb18d39f9a1256b33cf339f1d1bb52846ddaaaecd492eb1d0774b26968a44bf794e9d902a3c02af9543bc4096ac7a27", @ANYRES32, @ANYRES32=0x0], 0x50, 0x4041}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYRESDEC, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000003000000000000000010000000100", @ANYRES32, @ANYRES64, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESDEC=r4], 0xd0, 0x20000000}}], 0x3, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x138, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {0x0, 0x14000000}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x48, 0x1, {{'md5\x00'}}}]}, 0x138}}, 0x0) [ 493.978226][ C0] sd 0:0:1:0: tag#6021 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 493.987259][ C0] sd 0:0:1:0: tag#6021 CDB[20]: ba 09:53:51 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="5500006818007f083ffe15b282a380930a03000248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) 09:53:51 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe}}}, 0xf0}}, 0x0) 09:53:51 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x9, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000e80)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) io_uring_enter(r1, 0x0, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x50}}], 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {}, {}, 0x0, 0x1100, 0xa}, [@algo_auth={0x58, 0x1, {{'md5\x00'}, 0x80, "f959fb7b2a535a87359f0b633f54f881"}}]}, 0x148}}, 0x0) [ 494.145242][ C1] sd 0:0:1:0: [sg_rq_end_io] Sense Key : Illegal Request [current] [ 494.153253][ C1] sd 0:0:1:0: [sg_rq_end_io] Add. Sense: Invalid command operation code [ 494.182089][ C1] sd 0:0:1:0: tag#6065 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 494.191945][ C1] sd 0:0:1:0: tag#6065 CDB: opcode=0xe5 (vendor) [ 494.198255][ C1] sd 0:0:1:0: tag#6065 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 494.207273][ C1] sd 0:0:1:0: tag#6065 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 494.216277][ C1] sd 0:0:1:0: tag#6065 CDB[20]: ba [ 494.285193][ T5428] udevd[5428]: inotify_add_watch(7, /dev/loop2p2, 10) failed: No such file or directory [ 494.285305][T16174] udevd[16174]: inotify_add_watch(7, /dev/loop2p4, 10) failed: No such file or directory [ 494.301020][T13989] udevd[13989]: inotify_add_watch(7, /dev/loop2p3, 10) failed: No such file or directory [ 494.305510][ T5552] udevd[5552]: inotify_add_watch(7, /dev/loop2p5, 10) failed: No such file or directory [ 494.369837][T25852] loop2: detected capacity change from 0 to 16383 [ 494.416762][ T5592] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 494.422163][ T5592] loop2: p1 size 11290111 extends beyond EOD, truncated [ 494.430051][ T5592] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 494.437930][ T5592] loop2: p5 size 11290111 extends beyond EOD, truncated [ 494.445366][ T5592] loop2: p6 size 1912633224 extends beyond EOD, truncated [ 494.455413][T25852] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 494.460710][T25852] loop2: p1 size 11290111 extends beyond EOD, truncated [ 494.468334][T25852] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 494.476006][T25852] loop2: p5 size 11290111 extends beyond EOD, truncated [ 494.483403][T25852] loop2: p6 size 1912633224 extends beyond EOD, truncated [ 494.608951][T25852] loop2: detected capacity change from 0 to 16383 [ 494.653683][ T5592] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 494.658939][ T5592] loop2: p1 size 11290111 extends beyond EOD, truncated [ 494.666600][ T5592] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 494.674387][ T5592] loop2: p5 size 11290111 extends beyond EOD, truncated [ 494.681627][ T5592] loop2: p6 size 1912633224 extends beyond EOD, truncated [ 494.691252][T25852] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 494.696503][T25852] loop2: p1 size 11290111 extends beyond EOD, truncated 09:53:52 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) mkdirat(r1, &(0x7f00000000c0)='./file0\x00', 0x0) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r3 = syz_io_uring_setup(0x3ede, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000140)) io_uring_enter(r3, 0x2ff, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x5, 0x0, &(0x7f0000000040)=""/18, 0xffffffde}, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, &(0x7f0000000dc0)=[{&(0x7f0000000100)="f4a4848461fb0592d2f8db4c1f3c9e408788e03d28fe5e69dbceea46dd67888cdedd07a068040b956c3af7", 0x2b}, {0x0}, {0x0}], 0x3, &(0x7f0000000540)=ANY=[@ANYBLOB="1400000000000000", @ANYRES32], 0x50}}, {{0x0, 0x0, &(0x7f0000003180)=[{0x0}, {0x0}], 0x2, &(0x7f00000002c0)=ANY=[@ANYBLOB="c9252cdfb191d94ef15953a086ed40b24a018fb18d39f9a1256b33cf339f1d1bb52846ddaaaecd492eb1d0774b26968a44bf794e9d902a3c02af9543bc4096ac7a27", @ANYRES32, @ANYRES32=0x0], 0x50, 0x4041}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYRESDEC, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000003000000000000000010000000100", @ANYRES32, @ANYRES64, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESDEC=r4], 0xd0, 0x20000000}}], 0x3, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x138, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {0x0, 0x20000000}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x48, 0x1, {{'md5\x00'}}}]}, 0x138}}, 0x0) 09:53:52 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x9, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000e80)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) io_uring_enter(r1, 0x0, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x50}}], 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {}, {}, 0x0, 0x1400, 0xa}, [@algo_auth={0x58, 0x1, {{'md5\x00'}, 0x80, "f959fb7b2a535a87359f0b633f54f881"}}]}, 0x148}}, 0x0) 09:53:52 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="5500006c18007f083ffe15b282a380930a03000248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) 09:53:52 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0x40030000000000}}}, 0xf0}}, 0x0) 09:53:52 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x6, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe000000}) 09:53:52 executing program 2: syz_read_part_table(0x0, 0x2, &(0x7f0000000100)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0000ffffff85000000060000000000024000ffffff82000406e100000088770072003007000f00000000000000008000da55aa", 0x40, 0x1c0}, {0x0, 0x0, 0xfffffffffffffffb}]) [ 494.704188][T25852] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 494.712094][T25852] loop2: p5 size 11290111 extends beyond EOD, truncated [ 494.719394][T25852] loop2: p6 size 1912633224 extends beyond EOD, truncated 09:53:52 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x9, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000e80)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) io_uring_enter(r1, 0x0, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x50}}], 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {}, {}, 0x0, 0x2000, 0xa}, [@algo_auth={0x58, 0x1, {{'md5\x00'}, 0x80, "f959fb7b2a535a87359f0b633f54f881"}}]}, 0x148}}, 0x0) 09:53:52 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0x100000000000000}}}, 0xf0}}, 0x0) [ 494.778161][ C1] sd 0:0:1:0: tag#6038 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 494.788030][ C1] sd 0:0:1:0: tag#6038 CDB: opcode=0xe5 (vendor) [ 494.794355][ C1] sd 0:0:1:0: tag#6038 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 494.803393][ C1] sd 0:0:1:0: tag#6038 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 494.812413][ C1] sd 0:0:1:0: tag#6038 CDB[20]: ba 09:53:52 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="5500bd6e18007f083ffe15b282a380930a03000248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) 09:53:52 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) mkdirat(r1, &(0x7f00000000c0)='./file0\x00', 0x0) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r3 = syz_io_uring_setup(0x3ede, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000140)) io_uring_enter(r3, 0x2ff, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x5, 0x0, &(0x7f0000000040)=""/18, 0xffffffde}, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, &(0x7f0000000dc0)=[{&(0x7f0000000100)="f4a4848461fb0592d2f8db4c1f3c9e408788e03d28fe5e69dbceea46dd67888cdedd07a068040b956c3af7", 0x2b}, {0x0}, {0x0}], 0x3, &(0x7f0000000540)=ANY=[@ANYBLOB="1400000000000000", @ANYRES32], 0x50}}, {{0x0, 0x0, &(0x7f0000003180)=[{0x0}, {0x0}], 0x2, &(0x7f00000002c0)=ANY=[@ANYBLOB="c9252cdfb191d94ef15953a086ed40b24a018fb18d39f9a1256b33cf339f1d1bb52846ddaaaecd492eb1d0774b26968a44bf794e9d902a3c02af9543bc4096ac7a27", @ANYRES32, @ANYRES32=0x0], 0x50, 0x4041}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYRESDEC, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000003000000000000000010000000100", @ANYRES32, @ANYRES64, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESDEC=r4], 0xd0, 0x20000000}}], 0x3, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x138, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {0x0, 0x3f000000}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x48, 0x1, {{'md5\x00'}}}]}, 0x138}}, 0x0) 09:53:52 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x6, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffff}) [ 494.828117][ C1] sd 0:0:1:0: [sg_rq_end_io] Sense Key : Illegal Request [current] [ 494.836136][ C1] sd 0:0:1:0: [sg_rq_end_io] Add. Sense: Invalid command operation code 09:53:52 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0x200000000000000}}}, 0xf0}}, 0x0) 09:53:52 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x9, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000e80)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) io_uring_enter(r1, 0x0, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x50}}], 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {}, {}, 0x0, 0x3f00, 0xa}, [@algo_auth={0x58, 0x1, {{'md5\x00'}, 0x80, "f959fb7b2a535a87359f0b633f54f881"}}]}, 0x148}}, 0x0) [ 494.995598][ C0] sd 0:0:1:0: tag#6045 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 495.005477][ C0] sd 0:0:1:0: tag#6045 CDB: opcode=0xe5 (vendor) [ 495.009345][ C1] sd 0:0:1:0: [sg_rq_end_io] Sense Key : Illegal Request [current] [ 495.011800][ C0] sd 0:0:1:0: tag#6045 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 495.011820][ C0] sd 0:0:1:0: tag#6045 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 495.011836][ C0] sd 0:0:1:0: tag#6045 CDB[20]: ba [ 495.019838][ C1] sd 0:0:1:0: [sg_rq_end_io] Add. Sense: Invalid command operation code [ 495.041242][ C0] sd 0:0:1:0: tag#6053 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 495.061039][ C0] sd 0:0:1:0: tag#6053 CDB: opcode=0xe5 (vendor) [ 495.067428][ C0] sd 0:0:1:0: tag#6053 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 495.076524][ C0] sd 0:0:1:0: tag#6053 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 495.085533][ C0] sd 0:0:1:0: tag#6053 CDB[20]: ba [ 495.200035][T25888] loop2: detected capacity change from 0 to 16383 [ 495.251746][T25888] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 495.257058][T25888] loop2: p1 size 11290111 extends beyond EOD, truncated [ 495.264799][T25888] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 495.272748][T25888] loop2: p5 size 11290111 extends beyond EOD, truncated [ 495.279975][T25888] loop2: p6 size 1912633224 extends beyond EOD, truncated [ 495.392688][T25888] loop2: detected capacity change from 0 to 16383 [ 495.467978][ T5592] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 495.473228][ T5592] loop2: p1 size 11290111 extends beyond EOD, truncated [ 495.480774][ T5592] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 495.488531][ T5592] loop2: p5 size 11290111 extends beyond EOD, truncated [ 495.495693][ T5592] loop2: p6 size 1912633224 extends beyond EOD, truncated [ 495.505308][T25888] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 495.510557][T25888] loop2: p1 size 11290111 extends beyond EOD, truncated 09:53:53 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x6, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000000}) 09:53:53 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="5500007418007f083ffe15b282a380930a03000248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) 09:53:53 executing program 2: syz_read_part_table(0x0, 0x2, &(0x7f0000000100)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0000ffffff85000000060000000000024000ffffff82000007e100000088770072003007000f00000000000000008000da55aa", 0x40, 0x1c0}, {0x0, 0x0, 0xfffffffffffffffb}]) 09:53:53 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) mkdirat(r1, &(0x7f00000000c0)='./file0\x00', 0x0) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r3 = syz_io_uring_setup(0x3ede, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000140)) io_uring_enter(r3, 0x2ff, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x5, 0x0, &(0x7f0000000040)=""/18, 0xffffffde}, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, &(0x7f0000000dc0)=[{&(0x7f0000000100)="f4a4848461fb0592d2f8db4c1f3c9e408788e03d28fe5e69dbceea46dd67888cdedd07a068040b956c3af7", 0x2b}, {0x0}, {0x0}], 0x3, &(0x7f0000000540)=ANY=[@ANYBLOB="1400000000000000", @ANYRES32], 0x50}}, {{0x0, 0x0, &(0x7f0000003180)=[{0x0}, {0x0}], 0x2, &(0x7f00000002c0)=ANY=[@ANYBLOB="c9252cdfb191d94ef15953a086ed40b24a018fb18d39f9a1256b33cf339f1d1bb52846ddaaaecd492eb1d0774b26968a44bf794e9d902a3c02af9543bc4096ac7a27", @ANYRES32, @ANYRES32=0x0], 0x50, 0x4041}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYRESDEC, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000003000000000000000010000000100", @ANYRES32, @ANYRES64, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESDEC=r4], 0xd0, 0x20000000}}], 0x3, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x138, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {0x0, 0x40000000}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x48, 0x1, {{'md5\x00'}}}]}, 0x138}}, 0x0) 09:53:53 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0x300000000000000}}}, 0xf0}}, 0x0) 09:53:53 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x9, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000e80)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) io_uring_enter(r1, 0x0, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x50}}], 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {}, {}, 0x0, 0x6202, 0xa}, [@algo_auth={0x58, 0x1, {{'md5\x00'}, 0x80, "f959fb7b2a535a87359f0b633f54f881"}}]}, 0x148}}, 0x0) [ 495.518102][T25888] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 495.525781][T25888] loop2: p5 size 11290111 extends beyond EOD, truncated [ 495.532945][T25888] loop2: p6 size 1912633224 extends beyond EOD, truncated 09:53:53 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x9, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000e80)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) io_uring_enter(r1, 0x0, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x50}}], 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {}, {}, 0x0, 0x1000000, 0xa}, [@algo_auth={0x58, 0x1, {{'md5\x00'}, 0x80, "f959fb7b2a535a87359f0b633f54f881"}}]}, 0x148}}, 0x0) 09:53:53 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0x400000000000000}}}, 0xf0}}, 0x0) 09:53:53 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="5500007a18007f083ffe15b282a380930a03000248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) [ 495.586560][T25896] __nla_validate_parse: 11 callbacks suppressed [ 495.586575][T25896] netlink: 224 bytes leftover after parsing attributes in process `syz-executor.4'. [ 495.597658][ C1] sd 0:0:1:0: tag#6057 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 495.612041][ C1] sd 0:0:1:0: tag#6057 CDB: opcode=0xe5 (vendor) [ 495.618388][ C1] sd 0:0:1:0: tag#6057 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 495.627417][ C1] sd 0:0:1:0: tag#6057 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d 09:53:53 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x6, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18000000}) [ 495.636448][ C1] sd 0:0:1:0: tag#6057 CDB[20]: ba [ 495.643404][ C1] sd 0:0:1:0: [sg_rq_end_io] Sense Key : Illegal Request [current] [ 495.651410][ C1] sd 0:0:1:0: [sg_rq_end_io] Add. Sense: Invalid command operation code [ 495.653370][ C0] sd 0:0:1:0: tag#6061 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 495.669559][ C0] sd 0:0:1:0: tag#6061 CDB: opcode=0xe5 (vendor) [ 495.675902][ C0] sd 0:0:1:0: tag#6061 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c 09:53:53 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) mkdirat(r1, &(0x7f00000000c0)='./file0\x00', 0x0) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r3 = syz_io_uring_setup(0x3ede, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000140)) io_uring_enter(r3, 0x2ff, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x5, 0x0, &(0x7f0000000040)=""/18, 0xffffffde}, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, &(0x7f0000000dc0)=[{&(0x7f0000000100)="f4a4848461fb0592d2f8db4c1f3c9e408788e03d28fe5e69dbceea46dd67888cdedd07a068040b956c3af7", 0x2b}, {0x0}, {0x0}], 0x3, &(0x7f0000000540)=ANY=[@ANYBLOB="1400000000000000", @ANYRES32], 0x50}}, {{0x0, 0x0, &(0x7f0000003180)=[{0x0}, {0x0}], 0x2, &(0x7f00000002c0)=ANY=[@ANYBLOB="c9252cdfb191d94ef15953a086ed40b24a018fb18d39f9a1256b33cf339f1d1bb52846ddaaaecd492eb1d0774b26968a44bf794e9d902a3c02af9543bc4096ac7a27", @ANYRES32, @ANYRES32=0x0], 0x50, 0x4041}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYRESDEC, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000003000000000000000010000000100", @ANYRES32, @ANYRES64, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESDEC=r4], 0xd0, 0x20000000}}], 0x3, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x138, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {0x0, 0x9effffff}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x48, 0x1, {{'md5\x00'}}}]}, 0x138}}, 0x0) [ 495.684948][ C0] sd 0:0:1:0: tag#6061 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 495.693968][ C0] sd 0:0:1:0: tag#6061 CDB[20]: ba 09:53:53 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x9, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000e80)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) io_uring_enter(r1, 0x0, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x50}}], 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {}, {}, 0x0, 0x2000000, 0xa}, [@algo_auth={0x58, 0x1, {{'md5\x00'}, 0x80, "f959fb7b2a535a87359f0b633f54f881"}}]}, 0x148}}, 0x0) 09:53:53 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="550001a618007f083ffe15b282a380930a03000248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) 09:53:53 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0x500000000000000}}}, 0xf0}}, 0x0) 09:53:53 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x6, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1d2b0000}) [ 495.849482][T25908] netlink: 224 bytes leftover after parsing attributes in process `syz-executor.4'. [ 495.873799][ C1] sd 0:0:1:0: [sg_rq_end_io] Sense Key : Illegal Request [current] [ 495.881852][ C1] sd 0:0:1:0: [sg_rq_end_io] Add. Sense: Invalid command operation code [ 496.016114][T25918] loop2: detected capacity change from 0 to 16383 [ 496.066439][T25924] netlink: 224 bytes leftover after parsing attributes in process `syz-executor.4'. [ 496.066758][T25918] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 496.081188][T25918] loop2: p1 size 11290111 extends beyond EOD, truncated [ 496.089245][T25918] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 496.097850][T25918] loop2: p5 size 11290111 extends beyond EOD, truncated [ 496.105308][T25918] loop2: p6 size 1912633224 extends beyond EOD, truncated [ 496.112653][ C1] sd 0:0:1:0: [sg_rq_end_io] Sense Key : Illegal Request [current] [ 496.120708][ C1] sd 0:0:1:0: [sg_rq_end_io] Add. Sense: Invalid command operation code [ 496.207910][T25918] loop2: detected capacity change from 0 to 16383 [ 496.240897][ T5592] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 496.246140][ T5592] loop2: p1 size 11290111 extends beyond EOD, truncated [ 496.253872][ T5592] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 496.261713][ T5592] loop2: p5 size 11290111 extends beyond EOD, truncated [ 496.269051][ T5592] loop2: p6 size 1912633224 extends beyond EOD, truncated [ 496.279203][T25918] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 496.284496][T25918] loop2: p1 size 11290111 extends beyond EOD, truncated [ 496.292403][T25918] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 496.300268][T25918] loop2: p5 size 11290111 extends beyond EOD, truncated 09:53:53 executing program 2: syz_read_part_table(0x0, 0x2, &(0x7f0000000100)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0000ffffff85000000060000000000024000ffffff8200000ae100000088770072003007000f00000000000000008000da55aa", 0x40, 0x1c0}, {0x0, 0x0, 0xfffffffffffffffb}]) 09:53:53 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) mkdirat(r1, &(0x7f00000000c0)='./file0\x00', 0x0) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r3 = syz_io_uring_setup(0x3ede, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000140)) io_uring_enter(r3, 0x2ff, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x5, 0x0, &(0x7f0000000040)=""/18, 0xffffffde}, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, &(0x7f0000000dc0)=[{&(0x7f0000000100)="f4a4848461fb0592d2f8db4c1f3c9e408788e03d28fe5e69dbceea46dd67888cdedd07a068040b956c3af7", 0x2b}, {0x0}, {0x0}], 0x3, &(0x7f0000000540)=ANY=[@ANYBLOB="1400000000000000", @ANYRES32], 0x50}}, {{0x0, 0x0, &(0x7f0000003180)=[{0x0}, {0x0}], 0x2, &(0x7f00000002c0)=ANY=[@ANYBLOB="c9252cdfb191d94ef15953a086ed40b24a018fb18d39f9a1256b33cf339f1d1bb52846ddaaaecd492eb1d0774b26968a44bf794e9d902a3c02af9543bc4096ac7a27", @ANYRES32, @ANYRES32=0x0], 0x50, 0x4041}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYRESDEC, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000003000000000000000010000000100", @ANYRES32, @ANYRES64, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESDEC=r4], 0xd0, 0x20000000}}], 0x3, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x138, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {0x0, 0xb0020000}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x48, 0x1, {{'md5\x00'}}}]}, 0x138}}, 0x0) 09:53:53 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="550001aa18007f083ffe15b282a380930a03000248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) 09:53:53 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x9, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000e80)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) io_uring_enter(r1, 0x0, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x50}}], 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {}, {}, 0x0, 0x3000000, 0xa}, [@algo_auth={0x58, 0x1, {{'md5\x00'}, 0x80, "f959fb7b2a535a87359f0b633f54f881"}}]}, 0x148}}, 0x0) 09:53:53 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0x600000000000000}}}, 0xf0}}, 0x0) 09:53:53 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x6, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40000000}) [ 496.307691][T25918] loop2: p6 size 1912633224 extends beyond EOD, truncated 09:53:53 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0x700000000000000}}}, 0xf0}}, 0x0) 09:53:53 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="55006ebd18007f083ffe15b282a380930a03000248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) 09:53:53 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x9, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000e80)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) io_uring_enter(r1, 0x0, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x50}}], 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {}, {}, 0x0, 0x4000000, 0xa}, [@algo_auth={0x58, 0x1, {{'md5\x00'}, 0x80, "f959fb7b2a535a87359f0b633f54f881"}}]}, 0x148}}, 0x0) 09:53:54 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x6, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf5ffffff}) 09:53:54 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) mkdirat(r1, &(0x7f00000000c0)='./file0\x00', 0x0) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r3 = syz_io_uring_setup(0x3ede, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000140)) io_uring_enter(r3, 0x2ff, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x5, 0x0, &(0x7f0000000040)=""/18, 0xffffffde}, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, &(0x7f0000000dc0)=[{&(0x7f0000000100)="f4a4848461fb0592d2f8db4c1f3c9e408788e03d28fe5e69dbceea46dd67888cdedd07a068040b956c3af7", 0x2b}, {0x0}, {0x0}], 0x3, &(0x7f0000000540)=ANY=[@ANYBLOB="1400000000000000", @ANYRES32], 0x50}}, {{0x0, 0x0, &(0x7f0000003180)=[{0x0}, {0x0}], 0x2, &(0x7f00000002c0)=ANY=[@ANYBLOB="c9252cdfb191d94ef15953a086ed40b24a018fb18d39f9a1256b33cf339f1d1bb52846ddaaaecd492eb1d0774b26968a44bf794e9d902a3c02af9543bc4096ac7a27", @ANYRES32, @ANYRES32=0x0], 0x50, 0x4041}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYRESDEC, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000003000000000000000010000000100", @ANYRES32, @ANYRES64, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESDEC=r4], 0xd0, 0x20000000}}], 0x3, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x138, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {0x0, 0xeaffffff}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x48, 0x1, {{'md5\x00'}}}]}, 0x138}}, 0x0) [ 496.389742][T25933] netlink: 224 bytes leftover after parsing attributes in process `syz-executor.4'. [ 496.412210][ C1] sd 0:0:1:0: [sg_rq_end_io] Sense Key : Illegal Request [current] [ 496.420259][ C1] sd 0:0:1:0: [sg_rq_end_io] Add. Sense: Invalid command operation code 09:53:54 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0x800000000000000}}}, 0xf0}}, 0x0) [ 496.601084][T25944] netlink: 224 bytes leftover after parsing attributes in process `syz-executor.4'. [ 496.629424][ C1] sd 0:0:1:0: [sg_rq_end_io] Sense Key : Illegal Request [current] [ 496.637476][ C1] sd 0:0:1:0: [sg_rq_end_io] Add. Sense: Invalid command operation code [ 496.742887][T25954] loop2: detected capacity change from 0 to 16383 [ 496.749615][T25955] netlink: 224 bytes leftover after parsing attributes in process `syz-executor.4'. [ 496.787049][ T5592] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 496.792374][ T5592] loop2: p1 size 11290111 extends beyond EOD, truncated [ 496.800228][ T5592] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 496.808067][ T5592] loop2: p5 size 11290111 extends beyond EOD, truncated [ 496.815275][ T5592] loop2: p6 size 1912633224 extends beyond EOD, truncated [ 496.824925][T25954] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 496.830181][T25954] loop2: p1 size 11290111 extends beyond EOD, truncated [ 496.837705][T25954] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 496.845606][T25954] loop2: p5 size 11290111 extends beyond EOD, truncated [ 496.853107][T25954] loop2: p6 size 1912633224 extends beyond EOD, truncated 09:53:54 executing program 2: syz_read_part_table(0x0, 0x2, &(0x7f0000000100)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0000ffffff85000000060000000000024000ffffff8200000be100000088770072003007000f00000000000000008000da55aa", 0x40, 0x1c0}, {0x0, 0x0, 0xfffffffffffffffb}]) 09:53:54 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x9, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000e80)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) io_uring_enter(r1, 0x0, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x50}}], 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {}, {}, 0x0, 0x5000000, 0xa}, [@algo_auth={0x58, 0x1, {{'md5\x00'}, 0x80, "f959fb7b2a535a87359f0b633f54f881"}}]}, 0x148}}, 0x0) 09:53:54 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="550000fc18007f083ffe15b282a380930a03000248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) 09:53:54 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x6, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfbffffff}) 09:53:54 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0x900000000000000}}}, 0xf0}}, 0x0) 09:53:54 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) mkdirat(r1, &(0x7f00000000c0)='./file0\x00', 0x0) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r3 = syz_io_uring_setup(0x3ede, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000140)) io_uring_enter(r3, 0x2ff, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x5, 0x0, &(0x7f0000000040)=""/18, 0xffffffde}, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, &(0x7f0000000dc0)=[{&(0x7f0000000100)="f4a4848461fb0592d2f8db4c1f3c9e408788e03d28fe5e69dbceea46dd67888cdedd07a068040b956c3af7", 0x2b}, {0x0}, {0x0}], 0x3, &(0x7f0000000540)=ANY=[@ANYBLOB="1400000000000000", @ANYRES32], 0x50}}, {{0x0, 0x0, &(0x7f0000003180)=[{0x0}, {0x0}], 0x2, &(0x7f00000002c0)=ANY=[@ANYBLOB="c9252cdfb191d94ef15953a086ed40b24a018fb18d39f9a1256b33cf339f1d1bb52846ddaaaecd492eb1d0774b26968a44bf794e9d902a3c02af9543bc4096ac7a27", @ANYRES32, @ANYRES32=0x0], 0x50, 0x4041}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYRESDEC, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000003000000000000000010000000100", @ANYRES32, @ANYRES64, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESDEC=r4], 0xd0, 0x20000000}}], 0x3, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x138, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {0x0, 0xefffffff}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x48, 0x1, {{'md5\x00'}}}]}, 0x138}}, 0x0) 09:53:54 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x9, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000e80)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) io_uring_enter(r1, 0x0, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x50}}], 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {}, {}, 0x0, 0x6000000, 0xa}, [@algo_auth={0x58, 0x1, {{'md5\x00'}, 0x80, "f959fb7b2a535a87359f0b633f54f881"}}]}, 0x148}}, 0x0) 09:53:54 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="550000ff18007f083ffe15b282a380930a03000248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) 09:53:54 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) mkdirat(r1, &(0x7f00000000c0)='./file0\x00', 0x0) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r3 = syz_io_uring_setup(0x3ede, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000140)) io_uring_enter(r3, 0x2ff, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x5, 0x0, &(0x7f0000000040)=""/18, 0xffffffde}, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, &(0x7f0000000dc0)=[{&(0x7f0000000100)="f4a4848461fb0592d2f8db4c1f3c9e408788e03d28fe5e69dbceea46dd67888cdedd07a068040b956c3af7", 0x2b}, {0x0}, {0x0}], 0x3, &(0x7f0000000540)=ANY=[@ANYBLOB="1400000000000000", @ANYRES32], 0x50}}, {{0x0, 0x0, &(0x7f0000003180)=[{0x0}, {0x0}], 0x2, &(0x7f00000002c0)=ANY=[@ANYBLOB="c9252cdfb191d94ef15953a086ed40b24a018fb18d39f9a1256b33cf339f1d1bb52846ddaaaecd492eb1d0774b26968a44bf794e9d902a3c02af9543bc4096ac7a27", @ANYRES32, @ANYRES32=0x0], 0x50, 0x4041}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYRESDEC, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000003000000000000000010000000100", @ANYRES32, @ANYRES64, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESDEC=r4], 0xd0, 0x20000000}}], 0x3, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x138, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {0x0, 0xf0ffffff}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x48, 0x1, {{'md5\x00'}}}]}, 0x138}}, 0x0) 09:53:54 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0xa00000000000000}}}, 0xf0}}, 0x0) 09:53:54 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x6, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdfdffff}) [ 496.958558][ C1] sd 0:0:1:0: [sg_rq_end_io] Sense Key : Illegal Request [current] [ 496.966594][ C1] sd 0:0:1:0: [sg_rq_end_io] Add. Sense: Invalid command operation code [ 496.989746][T25967] netlink: 224 bytes leftover after parsing attributes in process `syz-executor.4'. 09:53:54 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x9, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000e80)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) io_uring_enter(r1, 0x0, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x50}}], 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {}, {}, 0x0, 0x7000000, 0xa}, [@algo_auth={0x58, 0x1, {{'md5\x00'}, 0x80, "f959fb7b2a535a87359f0b633f54f881"}}]}, 0x148}}, 0x0) [ 497.244123][T25975] netlink: 224 bytes leftover after parsing attributes in process `syz-executor.4'. [ 497.256568][ C1] sd 0:0:1:0: [sg_rq_end_io] Sense Key : Illegal Request [current] [ 497.264608][ C1] sd 0:0:1:0: [sg_rq_end_io] Add. Sense: Invalid command operation code [ 497.335540][T25981] loop2: detected capacity change from 0 to 16383 [ 497.395013][ T5592] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 497.400288][ T5592] loop2: p1 size 11290111 extends beyond EOD, truncated [ 497.408098][ T5592] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 497.416557][ T5592] loop2: p5 size 11290111 extends beyond EOD, truncated [ 497.423821][ T5592] loop2: p6 size 1912633224 extends beyond EOD, truncated [ 497.433849][T25981] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 497.439111][T25981] loop2: p1 size 11290111 extends beyond EOD, truncated [ 497.446924][T25981] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 497.457593][T25981] loop2: p5 size 11290111 extends beyond EOD, truncated [ 497.464829][T25981] loop2: p6 size 1912633224 extends beyond EOD, truncated [ 497.587039][T25981] loop2: detected capacity change from 0 to 16383 [ 497.621936][ T5592] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 497.627171][ T5592] loop2: p1 size 11290111 extends beyond EOD, truncated [ 497.634761][ T5592] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 497.642783][ T5592] loop2: p5 size 11290111 extends beyond EOD, truncated [ 497.650025][ T5592] loop2: p6 size 1912633224 extends beyond EOD, truncated [ 497.659642][T25981] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 497.665066][T25981] loop2: p1 size 11290111 extends beyond EOD, truncated [ 497.672776][T25981] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 497.680506][T25981] loop2: p5 size 11290111 extends beyond EOD, truncated 09:53:55 executing program 2: syz_read_part_table(0x0, 0x2, &(0x7f0000000100)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0000ffffff85000000060000000000024000ffffff82000018e100000088770072003007000f00000000000000008000da55aa", 0x40, 0x1c0}, {0x0, 0x0, 0xfffffffffffffffb}]) 09:53:55 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="5500000011007f083ffe15b282a380930a03000248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) 09:53:55 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0xb00000000000000}}}, 0xf0}}, 0x0) 09:53:55 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x6, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfeffffff}) 09:53:55 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) mkdirat(r1, &(0x7f00000000c0)='./file0\x00', 0x0) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r3 = syz_io_uring_setup(0x3ede, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000140)) io_uring_enter(r3, 0x2ff, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x5, 0x0, &(0x7f0000000040)=""/18, 0xffffffde}, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, &(0x7f0000000dc0)=[{&(0x7f0000000100)="f4a4848461fb0592d2f8db4c1f3c9e408788e03d28fe5e69dbceea46dd67888cdedd07a068040b956c3af7", 0x2b}, {0x0}, {0x0}], 0x3, &(0x7f0000000540)=ANY=[@ANYBLOB="1400000000000000", @ANYRES32], 0x50}}, {{0x0, 0x0, &(0x7f0000003180)=[{0x0}, {0x0}], 0x2, &(0x7f00000002c0)=ANY=[@ANYBLOB="c9252cdfb191d94ef15953a086ed40b24a018fb18d39f9a1256b33cf339f1d1bb52846ddaaaecd492eb1d0774b26968a44bf794e9d902a3c02af9543bc4096ac7a27", @ANYRES32, @ANYRES32=0x0], 0x50, 0x4041}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYRESDEC, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000003000000000000000010000000100", @ANYRES32, @ANYRES64, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESDEC=r4], 0xd0, 0x20000000}}], 0x3, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x138, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {0x0, 0xfcffffff}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x48, 0x1, {{'md5\x00'}}}]}, 0x138}}, 0x0) 09:53:55 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x9, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000e80)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) io_uring_enter(r1, 0x0, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x50}}], 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {}, {}, 0x0, 0x8000000, 0xa}, [@algo_auth={0x58, 0x1, {{'md5\x00'}, 0x80, "f959fb7b2a535a87359f0b633f54f881"}}]}, 0x148}}, 0x0) [ 497.687842][T25981] loop2: p6 size 1912633224 extends beyond EOD, truncated 09:53:55 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="5500000012007f083ffe15b282a380930a03000248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) 09:53:55 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x6, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffdfd}) 09:53:55 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0xc00000000000000}}}, 0xf0}}, 0x0) 09:53:55 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x9, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000e80)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) io_uring_enter(r1, 0x0, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x50}}], 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {}, {}, 0x0, 0x9000000, 0xa}, [@algo_auth={0x58, 0x1, {{'md5\x00'}, 0x80, "f959fb7b2a535a87359f0b633f54f881"}}]}, 0x148}}, 0x0) 09:53:55 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) mkdirat(r1, &(0x7f00000000c0)='./file0\x00', 0x0) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r3 = syz_io_uring_setup(0x3ede, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000140)) io_uring_enter(r3, 0x2ff, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x5, 0x0, &(0x7f0000000040)=""/18, 0xffffffde}, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, &(0x7f0000000dc0)=[{&(0x7f0000000100)="f4a4848461fb0592d2f8db4c1f3c9e408788e03d28fe5e69dbceea46dd67888cdedd07a068040b956c3af7", 0x2b}, {0x0}, {0x0}], 0x3, &(0x7f0000000540)=ANY=[@ANYBLOB="1400000000000000", @ANYRES32], 0x50}}, {{0x0, 0x0, &(0x7f0000003180)=[{0x0}, {0x0}], 0x2, &(0x7f00000002c0)=ANY=[@ANYBLOB="c9252cdfb191d94ef15953a086ed40b24a018fb18d39f9a1256b33cf339f1d1bb52846ddaaaecd492eb1d0774b26968a44bf794e9d902a3c02af9543bc4096ac7a27", @ANYRES32, @ANYRES32=0x0], 0x50, 0x4041}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYRESDEC, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000003000000000000000010000000100", @ANYRES32, @ANYRES64, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESDEC=r4], 0xd0, 0x20000000}}], 0x3, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x138, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {0x0, 0xfeffffff}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x48, 0x1, {{'md5\x00'}}}]}, 0x138}}, 0x0) [ 497.752553][ C1] sd 0:0:1:0: [sg_rq_end_io] Sense Key : Illegal Request [current] [ 497.760611][ C1] sd 0:0:1:0: [sg_rq_end_io] Add. Sense: Invalid command operation code [ 497.783215][T25993] netlink: 224 bytes leftover after parsing attributes in process `syz-executor.4'. 09:53:55 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="5500000013007f083ffe15b282a380930a03000248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) [ 497.972233][ C1] sd 0:0:1:0: [sg_rq_end_io] Sense Key : Illegal Request [current] [ 497.980257][ C1] sd 0:0:1:0: [sg_rq_end_io] Add. Sense: Invalid command operation code [ 498.015988][T26006] netlink: 224 bytes leftover after parsing attributes in process `syz-executor.4'. [ 498.130279][T26015] loop2: detected capacity change from 0 to 16383 [ 498.178943][T26015] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 498.184218][T26015] loop2: p1 size 11290111 extends beyond EOD, truncated [ 498.192073][T26015] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 498.200032][T26015] loop2: p5 size 11290111 extends beyond EOD, truncated [ 498.207378][T26015] loop2: p6 size 1912633224 extends beyond EOD, truncated [ 498.297379][T26015] loop2: detected capacity change from 0 to 16383 [ 498.343226][ T5592] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 498.348476][ T5592] loop2: p1 size 11290111 extends beyond EOD, truncated [ 498.356140][ T5592] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 498.363932][ T5592] loop2: p5 size 11290111 extends beyond EOD, truncated [ 498.371151][ T5592] loop2: p6 size 1912633224 extends beyond EOD, truncated [ 498.381480][T26015] loop2: p1 p2 < > p3 p4 < p5 p6 > 09:53:55 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x9, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000e80)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) io_uring_enter(r1, 0x0, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x50}}], 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {}, {}, 0x0, 0xa000000, 0xa}, [@algo_auth={0x58, 0x1, {{'md5\x00'}, 0x80, "f959fb7b2a535a87359f0b633f54f881"}}]}, 0x148}}, 0x0) 09:53:55 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x6, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffff0f}) 09:53:55 executing program 2: syz_read_part_table(0x0, 0x2, &(0x7f0000000100)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0000ffffff85000000060000000000024000ffffff82000020e100000088770072003007000f00000000000000008000da55aa", 0x40, 0x1c0}, {0x0, 0x0, 0xfffffffffffffffb}]) 09:53:55 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0xd00000000000000}}}, 0xf0}}, 0x0) 09:53:55 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="5500000014007f083ffe15b282a380930a03000248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) 09:53:55 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) mkdirat(r1, &(0x7f00000000c0)='./file0\x00', 0x0) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r3 = syz_io_uring_setup(0x3ede, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000140)) io_uring_enter(r3, 0x2ff, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x5, 0x0, &(0x7f0000000040)=""/18, 0xffffffde}, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, &(0x7f0000000dc0)=[{&(0x7f0000000100)="f4a4848461fb0592d2f8db4c1f3c9e408788e03d28fe5e69dbceea46dd67888cdedd07a068040b956c3af7", 0x2b}, {0x0}, {0x0}], 0x3, &(0x7f0000000540)=ANY=[@ANYBLOB="1400000000000000", @ANYRES32], 0x50}}, {{0x0, 0x0, &(0x7f0000003180)=[{0x0}, {0x0}], 0x2, &(0x7f00000002c0)=ANY=[@ANYBLOB="c9252cdfb191d94ef15953a086ed40b24a018fb18d39f9a1256b33cf339f1d1bb52846ddaaaecd492eb1d0774b26968a44bf794e9d902a3c02af9543bc4096ac7a27", @ANYRES32, @ANYRES32=0x0], 0x50, 0x4041}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYRESDEC, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000003000000000000000010000000100", @ANYRES32, @ANYRES64, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESDEC=r4], 0xd0, 0x20000000}}], 0x3, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x138, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {0x0, 0xffffff7f}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x48, 0x1, {{'md5\x00'}}}]}, 0x138}}, 0x0) [ 498.386782][T26015] loop2: p1 size 11290111 extends beyond EOD, truncated [ 498.394500][T26015] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 498.402239][T26015] loop2: p5 size 11290111 extends beyond EOD, truncated [ 498.409610][T26015] loop2: p6 size 1912633224 extends beyond EOD, truncated 09:53:56 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0xe00000000000000}}}, 0xf0}}, 0x0) [ 498.471475][ C0] scsi_io_completion_action: 11 callbacks suppressed [ 498.471502][ C0] sd 0:0:1:0: tag#6077 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 498.488036][ C0] sd 0:0:1:0: tag#6077 CDB: opcode=0xe5 (vendor) [ 498.494363][ C0] sd 0:0:1:0: tag#6077 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 498.503345][ C1] sd 0:0:1:0: [sg_rq_end_io] Sense Key : Illegal Request [current] [ 498.503379][ C1] sd 0:0:1:0: [sg_rq_end_io] Add. Sense: Invalid command operation code 09:53:56 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x9, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000e80)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) io_uring_enter(r1, 0x0, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x50}}], 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {}, {}, 0x0, 0xb000000, 0xa}, [@algo_auth={0x58, 0x1, {{'md5\x00'}, 0x80, "f959fb7b2a535a87359f0b633f54f881"}}]}, 0x148}}, 0x0) 09:53:56 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x6, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffff7f}) [ 498.511347][ C0] sd 0:0:1:0: tag#6077 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 498.511365][ C0] sd 0:0:1:0: tag#6077 CDB[20]: ba [ 498.536437][ C0] sd 0:0:1:0: tag#6027 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 498.546262][ C0] sd 0:0:1:0: tag#6027 CDB: opcode=0xe5 (vendor) [ 498.552618][ C0] sd 0:0:1:0: tag#6027 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 498.561654][ C0] sd 0:0:1:0: tag#6027 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d 09:53:56 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) mkdirat(r1, &(0x7f00000000c0)='./file0\x00', 0x0) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r3 = syz_io_uring_setup(0x3ede, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000140)) io_uring_enter(r3, 0x2ff, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x5, 0x0, &(0x7f0000000040)=""/18, 0xffffffde}, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, &(0x7f0000000dc0)=[{&(0x7f0000000100)="f4a4848461fb0592d2f8db4c1f3c9e408788e03d28fe5e69dbceea46dd67888cdedd07a068040b956c3af7", 0x2b}, {0x0}, {0x0}], 0x3, &(0x7f0000000540)=ANY=[@ANYBLOB="1400000000000000", @ANYRES32], 0x50}}, {{0x0, 0x0, &(0x7f0000003180)=[{0x0}, {0x0}], 0x2, &(0x7f00000002c0)=ANY=[@ANYBLOB="c9252cdfb191d94ef15953a086ed40b24a018fb18d39f9a1256b33cf339f1d1bb52846ddaaaecd492eb1d0774b26968a44bf794e9d902a3c02af9543bc4096ac7a27", @ANYRES32, @ANYRES32=0x0], 0x50, 0x4041}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYRESDEC, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000003000000000000000010000000100", @ANYRES32, @ANYRES64, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESDEC=r4], 0xd0, 0x20000000}}], 0x3, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x138, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {0x0, 0xffffff9e}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x48, 0x1, {{'md5\x00'}}}]}, 0x138}}, 0x0) 09:53:56 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="5500000015007f083ffe15b282a380930a03000248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) [ 498.570687][ C0] sd 0:0:1:0: tag#6027 CDB[20]: ba 09:53:56 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000000000000}}}, 0xf0}}, 0x0) 09:53:56 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x9, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000e80)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) io_uring_enter(r1, 0x0, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x50}}], 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {}, {}, 0x0, 0x10000000, 0xa}, [@algo_auth={0x58, 0x1, {{'md5\x00'}, 0x80, "f959fb7b2a535a87359f0b633f54f881"}}]}, 0x148}}, 0x0) 09:53:56 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x6, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffff5}) [ 498.669299][ C1] sd 0:0:1:0: [sg_rq_end_io] Sense Key : Illegal Request [current] [ 498.677321][ C1] sd 0:0:1:0: [sg_rq_end_io] Add. Sense: Invalid command operation code [ 498.727212][ C1] sd 0:0:1:0: tag#6036 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 498.737031][ C1] sd 0:0:1:0: tag#6036 CDB: opcode=0xe5 (vendor) [ 498.743357][ C1] sd 0:0:1:0: tag#6036 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 498.752368][ C1] sd 0:0:1:0: tag#6036 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 498.761437][ C1] sd 0:0:1:0: tag#6036 CDB[20]: ba [ 498.770410][T16174] udevd[16174]: inotify_add_watch(7, /dev/loop2p4, 10) failed: No such file or directory [ 498.770485][ T5428] udevd[5428]: inotify_add_watch(7, /dev/loop2p2, 10) failed: No such file or directory [ 498.780348][T13989] udevd[13989]: inotify_add_watch(7, /dev/loop2p3, 10) failed: No such file or directory [ 498.791255][ T5552] udevd[5552]: inotify_add_watch(7, /dev/loop2p5, 10) failed: No such file or directory [ 498.800929][ T5551] udevd[5551]: inotify_add_watch(7, /dev/loop2p6, 10) failed: No such file or directory [ 498.810403][ T5592] udevd[5592]: inotify_add_watch(7, /dev/loop2p1, 10) failed: No such file or directory [ 498.834567][ T5428] udevd[5428]: inotify_add_watch(7, /dev/loop2p2, 10) failed: No such file or directory [ 498.840112][ C1] sd 0:0:1:0: tag#6043 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 498.845262][T13989] udevd[13989]: inotify_add_watch(7, /dev/loop2p3, 10) failed: No such file or directory [ 498.854126][ C1] sd 0:0:1:0: tag#6043 CDB: opcode=0xe5 (vendor) [ 498.864871][T16174] udevd[16174]: inotify_add_watch(7, /dev/loop2p4, 10) failed: No such file or directory [ 498.870217][ C1] sd 0:0:1:0: tag#6043 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 498.880808][ T5552] udevd[5552]: inotify_add_watch(7, /dev/loop2p5, 10) failed: No such file or directory [ 498.889003][ C1] sd 0:0:1:0: tag#6043 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 498.907732][ C1] sd 0:0:1:0: tag#6043 CDB[20]: ba [ 498.964155][T26146] loop2: detected capacity change from 0 to 16383 [ 499.013537][T26146] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 499.018790][T26146] loop2: p1 size 11290111 extends beyond EOD, truncated [ 499.026702][T26146] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 499.034640][T26146] loop2: p5 size 11290111 extends beyond EOD, truncated [ 499.042097][T26146] loop2: p6 size 1912633224 extends beyond EOD, truncated [ 499.072784][ C1] sd 0:0:1:0: [sg_rq_end_io] Sense Key : Illegal Request [current] [ 499.080822][ C1] sd 0:0:1:0: [sg_rq_end_io] Add. Sense: Invalid command operation code [ 499.175600][T26146] loop2: detected capacity change from 0 to 16383 09:53:56 executing program 2: syz_read_part_table(0x0, 0x2, &(0x7f0000000100)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0000ffffff85000000060000000000024000ffffff82000026e100000088770072003007000f00000000000000008000da55aa", 0x40, 0x1c0}, {0x0, 0x0, 0xfffffffffffffffb}]) 09:53:56 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) mkdirat(r1, &(0x7f00000000c0)='./file0\x00', 0x0) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r3 = syz_io_uring_setup(0x3ede, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000140)) io_uring_enter(r3, 0x2ff, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x5, 0x0, &(0x7f0000000040)=""/18, 0xffffffde}, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, &(0x7f0000000dc0)=[{&(0x7f0000000100)="f4a4848461fb0592d2f8db4c1f3c9e408788e03d28fe5e69dbceea46dd67888cdedd07a068040b956c3af7", 0x2b}, {0x0}, {0x0}], 0x3, &(0x7f0000000540)=ANY=[@ANYBLOB="1400000000000000", @ANYRES32], 0x50}}, {{0x0, 0x0, &(0x7f0000003180)=[{0x0}, {0x0}], 0x2, &(0x7f00000002c0)=ANY=[@ANYBLOB="c9252cdfb191d94ef15953a086ed40b24a018fb18d39f9a1256b33cf339f1d1bb52846ddaaaecd492eb1d0774b26968a44bf794e9d902a3c02af9543bc4096ac7a27", @ANYRES32, @ANYRES32=0x0], 0x50, 0x4041}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYRESDEC, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000003000000000000000010000000100", @ANYRES32, @ANYRES64, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESDEC=r4], 0xd0, 0x20000000}}], 0x3, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x138, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {0x0, 0xffffffea}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x48, 0x1, {{'md5\x00'}}}]}, 0x138}}, 0x0) 09:53:56 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0x1100000000000000}}}, 0xf0}}, 0x0) 09:53:56 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="5500000016007f083ffe15b282a380930a03000248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) 09:53:56 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x6, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffb}) 09:53:56 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x9, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000e80)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) io_uring_enter(r1, 0x0, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x50}}], 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {}, {}, 0x0, 0x11000000, 0xa}, [@algo_auth={0x58, 0x1, {{'md5\x00'}, 0x80, "f959fb7b2a535a87359f0b633f54f881"}}]}, 0x148}}, 0x0) [ 499.229693][T26146] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 499.235016][T26146] loop2: p1 size 11290111 extends beyond EOD, truncated [ 499.242876][T26146] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 499.250702][T26146] loop2: p5 size 11290111 extends beyond EOD, truncated [ 499.258145][T26146] loop2: p6 size 1912633224 extends beyond EOD, truncated 09:53:56 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0x1200000000000000}}}, 0xf0}}, 0x0) 09:53:56 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="5500000218007f083ffe15b282a380930a03000248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) [ 499.323939][ C1] sd 0:0:1:0: [sg_rq_end_io] Sense Key : Illegal Request [current] [ 499.331965][ C1] sd 0:0:1:0: [sg_rq_end_io] Add. Sense: Invalid command operation code [ 499.358045][ C1] sd 0:0:1:0: tag#6064 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 499.367924][ C1] sd 0:0:1:0: tag#6064 CDB: opcode=0xe5 (vendor) 09:53:56 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x9, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000e80)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) io_uring_enter(r1, 0x0, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x50}}], 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {}, {}, 0x0, 0x14000000, 0xa}, [@algo_auth={0x58, 0x1, {{'md5\x00'}, 0x80, "f959fb7b2a535a87359f0b633f54f881"}}]}, 0x148}}, 0x0) 09:53:56 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x6, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe}) 09:53:56 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) mkdirat(r1, &(0x7f00000000c0)='./file0\x00', 0x0) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r3 = syz_io_uring_setup(0x3ede, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000140)) io_uring_enter(r3, 0x2ff, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x5, 0x0, &(0x7f0000000040)=""/18, 0xffffffde}, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, &(0x7f0000000dc0)=[{&(0x7f0000000100)="f4a4848461fb0592d2f8db4c1f3c9e408788e03d28fe5e69dbceea46dd67888cdedd07a068040b956c3af7", 0x2b}, {0x0}, {0x0}], 0x3, &(0x7f0000000540)=ANY=[@ANYBLOB="1400000000000000", @ANYRES32], 0x50}}, {{0x0, 0x0, &(0x7f0000003180)=[{0x0}, {0x0}], 0x2, &(0x7f00000002c0)=ANY=[@ANYBLOB="c9252cdfb191d94ef15953a086ed40b24a018fb18d39f9a1256b33cf339f1d1bb52846ddaaaecd492eb1d0774b26968a44bf794e9d902a3c02af9543bc4096ac7a27", @ANYRES32, @ANYRES32=0x0], 0x50, 0x4041}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYRESDEC, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000003000000000000000010000000100", @ANYRES32, @ANYRES64, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESDEC=r4], 0xd0, 0x20000000}}], 0x3, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x138, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {0x0, 0xffffffef}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x48, 0x1, {{'md5\x00'}}}]}, 0x138}}, 0x0) [ 499.374275][ C1] sd 0:0:1:0: tag#6064 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 499.383303][ C1] sd 0:0:1:0: tag#6064 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 499.392341][ C1] sd 0:0:1:0: tag#6064 CDB[20]: ba 09:53:57 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0x1e04000000000000}}}, 0xf0}}, 0x0) [ 499.664506][ C1] sd 0:0:1:0: [sg_rq_end_io] Sense Key : Illegal Request [current] [ 499.672650][ C1] sd 0:0:1:0: [sg_rq_end_io] Add. Sense: Invalid command operation code [ 499.692113][ C0] sd 0:0:1:0: tag#6071 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 499.701935][ C0] sd 0:0:1:0: tag#6071 CDB: opcode=0xe5 (vendor) [ 499.708281][ C0] sd 0:0:1:0: tag#6071 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 499.717308][ C0] sd 0:0:1:0: tag#6071 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 499.726350][ C0] sd 0:0:1:0: tag#6071 CDB[20]: ba [ 499.844542][T26179] loop2: detected capacity change from 0 to 16383 [ 499.901260][T26179] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 499.906674][T26179] loop2: p1 size 11290111 extends beyond EOD, truncated [ 499.914311][T26179] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 499.922247][T26179] loop2: p5 size 11290111 extends beyond EOD, truncated [ 499.929514][T26179] loop2: p6 size 1912633224 extends beyond EOD, truncated [ 500.081261][T26179] loop2: detected capacity change from 0 to 16383 [ 500.126314][T26179] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 500.131638][T26179] loop2: p1 size 11290111 extends beyond EOD, truncated [ 500.139295][T26179] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 500.147107][T26179] loop2: p5 size 11290111 extends beyond EOD, truncated [ 500.154389][T26179] loop2: p6 size 1912633224 extends beyond EOD, truncated 09:53:57 executing program 2: syz_read_part_table(0x0, 0x2, &(0x7f0000000100)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0000ffffff85000000060000000000024000ffffff8200003fe100000088770072003007000f00000000000000008000da55aa", 0x40, 0x1c0}, {0x0, 0x0, 0xfffffffffffffffb}]) 09:53:57 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="5500000318007f083ffe15b282a380930a03000248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) 09:53:57 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x9, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000e80)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) io_uring_enter(r1, 0x0, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x50}}], 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {}, {}, 0x0, 0x20000000, 0xa}, [@algo_auth={0x58, 0x1, {{'md5\x00'}, 0x80, "f959fb7b2a535a87359f0b633f54f881"}}]}, 0x148}}, 0x0) 09:53:57 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x6, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e", 0x0, 0x0, 0x0, 0x0, 0x0}) 09:53:57 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) mkdirat(r1, &(0x7f00000000c0)='./file0\x00', 0x0) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r3 = syz_io_uring_setup(0x3ede, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000140)) io_uring_enter(r3, 0x2ff, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x5, 0x0, &(0x7f0000000040)=""/18, 0xffffffde}, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, &(0x7f0000000dc0)=[{&(0x7f0000000100)="f4a4848461fb0592d2f8db4c1f3c9e408788e03d28fe5e69dbceea46dd67888cdedd07a068040b956c3af7", 0x2b}, {0x0}, {0x0}], 0x3, &(0x7f0000000540)=ANY=[@ANYBLOB="1400000000000000", @ANYRES32], 0x50}}, {{0x0, 0x0, &(0x7f0000003180)=[{0x0}, {0x0}], 0x2, &(0x7f00000002c0)=ANY=[@ANYBLOB="c9252cdfb191d94ef15953a086ed40b24a018fb18d39f9a1256b33cf339f1d1bb52846ddaaaecd492eb1d0774b26968a44bf794e9d902a3c02af9543bc4096ac7a27", @ANYRES32, @ANYRES32=0x0], 0x50, 0x4041}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYRESDEC, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000003000000000000000010000000100", @ANYRES32, @ANYRES64, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESDEC=r4], 0xd0, 0x20000000}}], 0x3, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x138, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {0x0, 0xfffffff0}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x48, 0x1, {{'md5\x00'}}}]}, 0x138}}, 0x0) 09:53:57 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000000000000}}}, 0xf0}}, 0x0) [ 500.200264][ T383] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 500.205566][ T383] loop2: p1 size 11290111 extends beyond EOD, truncated [ 500.213354][ T383] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 500.221426][ T383] loop2: p5 size 11290111 extends beyond EOD, truncated [ 500.229762][ T383] loop2: p6 size 1912633224 extends beyond EOD, truncated 09:53:57 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x9, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000e80)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) io_uring_enter(r1, 0x0, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x50}}], 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {}, {}, 0x0, 0x3f000000, 0xa}, [@algo_auth={0x58, 0x1, {{'md5\x00'}, 0x80, "f959fb7b2a535a87359f0b633f54f881"}}]}, 0x148}}, 0x0) 09:53:57 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0x2500000000000000}}}, 0xf0}}, 0x0) 09:53:57 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="5500000418007f083ffe15b282a380930a03000248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) 09:53:57 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x6, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) [ 500.281945][ C1] sd 0:0:1:0: [sg_rq_end_io] Sense Key : Illegal Request [current] [ 500.289978][ C1] sd 0:0:1:0: [sg_rq_end_io] Add. Sense: Invalid command operation code [ 500.312288][ C0] sd 0:0:1:0: tag#6030 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 500.322119][ C0] sd 0:0:1:0: tag#6030 CDB: opcode=0xe5 (vendor) 09:53:57 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) mkdirat(r1, &(0x7f00000000c0)='./file0\x00', 0x0) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r3 = syz_io_uring_setup(0x3ede, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000140)) io_uring_enter(r3, 0x2ff, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x5, 0x0, &(0x7f0000000040)=""/18, 0xffffffde}, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, &(0x7f0000000dc0)=[{&(0x7f0000000100)="f4a4848461fb0592d2f8db4c1f3c9e408788e03d28fe5e69dbceea46dd67888cdedd07a068040b956c3af7", 0x2b}, {0x0}, {0x0}], 0x3, &(0x7f0000000540)=ANY=[@ANYBLOB="1400000000000000", @ANYRES32], 0x50}}, {{0x0, 0x0, &(0x7f0000003180)=[{0x0}, {0x0}], 0x2, &(0x7f00000002c0)=ANY=[@ANYBLOB="c9252cdfb191d94ef15953a086ed40b24a018fb18d39f9a1256b33cf339f1d1bb52846ddaaaecd492eb1d0774b26968a44bf794e9d902a3c02af9543bc4096ac7a27", @ANYRES32, @ANYRES32=0x0], 0x50, 0x4041}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYRESDEC, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000003000000000000000010000000100", @ANYRES32, @ANYRES64, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESDEC=r4], 0xd0, 0x20000000}}], 0x3, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x138, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {0x0, 0xfffffffc}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x48, 0x1, {{'md5\x00'}}}]}, 0x138}}, 0x0) [ 500.328437][ C0] sd 0:0:1:0: tag#6030 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 500.337460][ C0] sd 0:0:1:0: tag#6030 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 500.346483][ C0] sd 0:0:1:0: tag#6030 CDB[20]: ba 09:53:57 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0x3300000000000000}}}, 0xf0}}, 0x0) [ 500.520084][ C1] sd 0:0:1:0: [sg_rq_end_io] Sense Key : Illegal Request [current] [ 500.528087][ C1] sd 0:0:1:0: [sg_rq_end_io] Add. Sense: Invalid command operation code [ 500.578034][ C1] sd 0:0:1:0: tag#6078 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 500.587887][ C1] sd 0:0:1:0: tag#6078 CDB: opcode=0xe5 (vendor) [ 500.594203][ C1] sd 0:0:1:0: tag#6078 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 500.603221][ C1] sd 0:0:1:0: tag#6078 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 500.612258][ C1] sd 0:0:1:0: tag#6078 CDB[20]: ba [ 500.695494][T26210] loop2: detected capacity change from 0 to 16383 [ 500.734769][T26210] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 500.740028][T26210] loop2: p1 size 11290111 extends beyond EOD, truncated [ 500.747890][T26210] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 500.755757][T26210] loop2: p5 size 11290111 extends beyond EOD, truncated [ 500.763178][T26210] loop2: p6 size 1912633224 extends beyond EOD, truncated [ 500.864389][T26210] loop2: detected capacity change from 0 to 16383 09:53:58 executing program 2: syz_read_part_table(0x0, 0x2, &(0x7f0000000100)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0000ffffff85000000060000000000024000ffffff82000040e100000088770072003007000f00000000000000008000da55aa", 0x40, 0x1c0}, {0x0, 0x0, 0xfffffffffffffffb}]) 09:53:58 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x9, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000e80)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) io_uring_enter(r1, 0x0, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x50}}], 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {}, {}, 0x0, 0x62020000, 0xa}, [@algo_auth={0x58, 0x1, {{'md5\x00'}, 0x80, "f959fb7b2a535a87359f0b633f54f881"}}]}, 0x148}}, 0x0) 09:53:58 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="5500000518007f083ffe15b282a380930a03000248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) 09:53:58 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x6, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}) 09:53:58 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) mkdirat(r1, &(0x7f00000000c0)='./file0\x00', 0x0) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r3 = syz_io_uring_setup(0x3ede, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000140)) io_uring_enter(r3, 0x2ff, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x5, 0x0, &(0x7f0000000040)=""/18, 0xffffffde}, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, &(0x7f0000000dc0)=[{&(0x7f0000000100)="f4a4848461fb0592d2f8db4c1f3c9e408788e03d28fe5e69dbceea46dd67888cdedd07a068040b956c3af7", 0x2b}, {0x0}, {0x0}], 0x3, &(0x7f0000000540)=ANY=[@ANYBLOB="1400000000000000", @ANYRES32], 0x50}}, {{0x0, 0x0, &(0x7f0000003180)=[{0x0}, {0x0}], 0x2, &(0x7f00000002c0)=ANY=[@ANYBLOB="c9252cdfb191d94ef15953a086ed40b24a018fb18d39f9a1256b33cf339f1d1bb52846ddaaaecd492eb1d0774b26968a44bf794e9d902a3c02af9543bc4096ac7a27", @ANYRES32, @ANYRES32=0x0], 0x50, 0x4041}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYRESDEC, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000003000000000000000010000000100", @ANYRES32, @ANYRES64, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESDEC=r4], 0xd0, 0x20000000}}], 0x3, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x138, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {0x0, 0xfffffffe}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x48, 0x1, {{'md5\x00'}}}]}, 0x138}}, 0x0) 09:53:58 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0x3e01000000000000}}}, 0xf0}}, 0x0) [ 500.942017][T26210] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 500.947276][T26210] loop2: p1 size 11290111 extends beyond EOD, truncated [ 500.954975][T26210] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 500.962586][T26210] loop2: p5 size 11290111 extends beyond EOD, truncated [ 500.969936][T26210] loop2: p6 size 1912633224 extends beyond EOD, truncated [ 501.044756][ C1] sd 0:0:1:0: [sg_rq_end_io] Sense Key : Illegal Request [current] [ 501.046558][ C0] sd 0:0:1:0: tag#6060 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 501.052766][ C1] sd 0:0:1:0: [sg_rq_end_io] Add. Sense: Invalid command operation code [ 501.062565][ C0] sd 0:0:1:0: tag#6060 CDB: opcode=0xe5 (vendor) [ 501.077193][ C0] sd 0:0:1:0: tag#6060 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 501.085837][T26220] __nla_validate_parse: 11 callbacks suppressed 09:53:58 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0x4800000000000000}}}, 0xf0}}, 0x0) 09:53:58 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="5500000618007f083ffe15b282a380930a03000248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) 09:53:58 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x9, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000e80)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) io_uring_enter(r1, 0x0, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x50}}], 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {}, {}, 0x0, 0x9effffff, 0xa}, [@algo_auth={0x58, 0x1, {{'md5\x00'}, 0x80, "f959fb7b2a535a87359f0b633f54f881"}}]}, 0x148}}, 0x0) 09:53:58 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x6, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}) 09:53:58 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) mkdirat(r1, &(0x7f00000000c0)='./file0\x00', 0x0) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r3 = syz_io_uring_setup(0x3ede, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000140)) io_uring_enter(r3, 0x2ff, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x5, 0x0, &(0x7f0000000040)=""/18, 0xffffffde}, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, &(0x7f0000000dc0)=[{&(0x7f0000000100)="f4a4848461fb0592d2f8db4c1f3c9e408788e03d28fe5e69dbceea46dd67888cdedd07a068040b956c3af7", 0x2b}, {0x0}, {0x0}], 0x3, &(0x7f0000000540)=ANY=[@ANYBLOB="1400000000000000", @ANYRES32], 0x50}}, {{0x0, 0x0, &(0x7f0000003180)=[{0x0}, {0x0}], 0x2, &(0x7f00000002c0)=ANY=[@ANYBLOB="c9252cdfb191d94ef15953a086ed40b24a018fb18d39f9a1256b33cf339f1d1bb52846ddaaaecd492eb1d0774b26968a44bf794e9d902a3c02af9543bc4096ac7a27", @ANYRES32, @ANYRES32=0x0], 0x50, 0x4041}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYRESDEC, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000003000000000000000010000000100", @ANYRES32, @ANYRES64, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESDEC=r4], 0xd0, 0x20000000}}], 0x3, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x138, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {0x0, 0x21028ec53e}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x48, 0x1, {{'md5\x00'}}}]}, 0x138}}, 0x0) [ 501.085849][T26220] netlink: 224 bytes leftover after parsing attributes in process `syz-executor.4'. [ 501.086240][ C0] sd 0:0:1:0: tag#6060 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 501.110807][ C0] sd 0:0:1:0: tag#6060 CDB[20]: ba 09:53:58 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="5500000718007f083ffe15b282a380930a03000248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) [ 501.274203][T26232] netlink: 224 bytes leftover after parsing attributes in process `syz-executor.4'. [ 501.306872][ C1] sd 0:0:1:0: [sg_rq_end_io] Sense Key : Illegal Request [current] [ 501.314908][ C1] sd 0:0:1:0: [sg_rq_end_io] Add. Sense: Invalid command operation code [ 501.332346][ C0] sd 0:0:1:0: tag#6040 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 501.342192][ C0] sd 0:0:1:0: tag#6040 CDB: opcode=0xe5 (vendor) [ 501.348537][ C0] sd 0:0:1:0: tag#6040 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 501.351703][T26238] loop2: detected capacity change from 0 to 16383 [ 501.357593][ C0] sd 0:0:1:0: tag#6040 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 501.357612][ C0] sd 0:0:1:0: tag#6040 CDB[20]: ba [ 501.415493][T26238] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 501.420875][T26238] loop2: p1 size 11290111 extends beyond EOD, truncated [ 501.428703][T26238] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 501.436825][T26238] loop2: p5 size 11290111 extends beyond EOD, truncated [ 501.444127][T26238] loop2: p6 size 1912633224 extends beyond EOD, truncated [ 501.574635][T26238] loop2: detected capacity change from 0 to 16383 09:53:59 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x9, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000e80)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) io_uring_enter(r1, 0x0, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x50}}], 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {}, {}, 0x0, 0xeaffffff, 0xa}, [@algo_auth={0x58, 0x1, {{'md5\x00'}, 0x80, "f959fb7b2a535a87359f0b633f54f881"}}]}, 0x148}}, 0x0) 09:53:59 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0x4c00000000000000}}}, 0xf0}}, 0x0) 09:53:59 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="5500000818007f083ffe15b282a380930a03000248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) 09:53:59 executing program 2: syz_read_part_table(0x0, 0x2, &(0x7f0000000100)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0000ffffff85000000060000000000024000ffffff82000071e100000088770072003007000f00000000000000008000da55aa", 0x40, 0x1c0}, {0x0, 0x0, 0xfffffffffffffffb}]) 09:53:59 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x6, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}) 09:53:59 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) mkdirat(r1, &(0x7f00000000c0)='./file0\x00', 0x0) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r3 = syz_io_uring_setup(0x3ede, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000140)) io_uring_enter(r3, 0x2ff, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x5, 0x0, &(0x7f0000000040)=""/18, 0xffffffde}, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, &(0x7f0000000dc0)=[{&(0x7f0000000100)="f4a4848461fb0592d2f8db4c1f3c9e408788e03d28fe5e69dbceea46dd67888cdedd07a068040b956c3af7", 0x2b}, {0x0}, {0x0}], 0x3, &(0x7f0000000540)=ANY=[@ANYBLOB="1400000000000000", @ANYRES32], 0x50}}, {{0x0, 0x0, &(0x7f0000003180)=[{0x0}, {0x0}], 0x2, &(0x7f00000002c0)=ANY=[@ANYBLOB="c9252cdfb191d94ef15953a086ed40b24a018fb18d39f9a1256b33cf339f1d1bb52846ddaaaecd492eb1d0774b26968a44bf794e9d902a3c02af9543bc4096ac7a27", @ANYRES32, @ANYRES32=0x0], 0x50, 0x4041}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYRESDEC, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000003000000000000000010000000100", @ANYRES32, @ANYRES64, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESDEC=r4], 0xd0, 0x20000000}}], 0x3, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x138, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {0x0, 0x100000000000000}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x48, 0x1, {{'md5\x00'}}}]}, 0x138}}, 0x0) [ 501.630942][T26238] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 501.636262][T26238] loop2: p1 size 11290111 extends beyond EOD, truncated [ 501.644071][T26238] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 501.651978][T26238] loop2: p5 size 11290111 extends beyond EOD, truncated [ 501.659311][T26238] loop2: p6 size 1912633224 extends beyond EOD, truncated 09:53:59 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0x6000000000000000}}}, 0xf0}}, 0x0) 09:53:59 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="5500000918007f083ffe15b282a380930a03000248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) 09:53:59 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x9, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000e80)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) io_uring_enter(r1, 0x0, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x50}}], 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {}, {}, 0x0, 0xefffffff, 0xa}, [@algo_auth={0x58, 0x1, {{'md5\x00'}, 0x80, "f959fb7b2a535a87359f0b633f54f881"}}]}, 0x148}}, 0x0) 09:53:59 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x6, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd}) [ 501.746124][ C1] sd 0:0:1:0: [sg_rq_end_io] Sense Key : Illegal Request [current] [ 501.749326][T26251] netlink: 224 bytes leftover after parsing attributes in process `syz-executor.4'. [ 501.754143][ C1] sd 0:0:1:0: [sg_rq_end_io] Add. Sense: Invalid command operation code 09:53:59 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) mkdirat(r1, &(0x7f00000000c0)='./file0\x00', 0x0) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r3 = syz_io_uring_setup(0x3ede, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000140)) io_uring_enter(r3, 0x2ff, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x5, 0x0, &(0x7f0000000040)=""/18, 0xffffffde}, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, &(0x7f0000000dc0)=[{&(0x7f0000000100)="f4a4848461fb0592d2f8db4c1f3c9e408788e03d28fe5e69dbceea46dd67888cdedd07a068040b956c3af7", 0x2b}, {0x0}, {0x0}], 0x3, &(0x7f0000000540)=ANY=[@ANYBLOB="1400000000000000", @ANYRES32], 0x50}}, {{0x0, 0x0, &(0x7f0000003180)=[{0x0}, {0x0}], 0x2, &(0x7f00000002c0)=ANY=[@ANYBLOB="c9252cdfb191d94ef15953a086ed40b24a018fb18d39f9a1256b33cf339f1d1bb52846ddaaaecd492eb1d0774b26968a44bf794e9d902a3c02af9543bc4096ac7a27", @ANYRES32, @ANYRES32=0x0], 0x50, 0x4041}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYRESDEC, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000003000000000000000010000000100", @ANYRES32, @ANYRES64, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESDEC=r4], 0xd0, 0x20000000}}], 0x3, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x138, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {0x0, 0x200000000000000}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x48, 0x1, {{'md5\x00'}}}]}, 0x138}}, 0x0) 09:53:59 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0x6800000000000000}}}, 0xf0}}, 0x0) [ 501.926075][T26260] netlink: 224 bytes leftover after parsing attributes in process `syz-executor.4'. [ 501.964137][ C1] sd 0:0:1:0: [sg_rq_end_io] Sense Key : Illegal Request [current] 09:53:59 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="5500000a18007f083ffe15b282a380930a03000248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) 09:53:59 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x9, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000e80)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) io_uring_enter(r1, 0x0, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x50}}], 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {}, {}, 0x0, 0xf0ffffff, 0xa}, [@algo_auth={0x58, 0x1, {{'md5\x00'}, 0x80, "f959fb7b2a535a87359f0b633f54f881"}}]}, 0x148}}, 0x0) [ 501.972213][ C1] sd 0:0:1:0: [sg_rq_end_io] Add. Sense: Invalid command operation code [ 502.044906][T26269] loop2: detected capacity change from 0 to 16383 [ 502.063824][ T5592] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 502.069126][ T5592] loop2: p1 size 11290111 extends beyond EOD, truncated [ 502.077029][ T5592] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 502.084896][ T5592] loop2: p5 size 11290111 extends beyond EOD, truncated [ 502.092234][ T5592] loop2: p6 size 1912633224 extends beyond EOD, truncated [ 502.102242][T26269] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 502.107529][T26269] loop2: p1 size 11290111 extends beyond EOD, truncated [ 502.115383][T26269] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 502.122675][T26273] netlink: 224 bytes leftover after parsing attributes in process `syz-executor.4'. [ 502.123133][T26269] loop2: p5 size 11290111 extends beyond EOD, truncated [ 502.160542][T26269] loop2: p6 size 1912633224 extends beyond EOD, truncated 09:53:59 executing program 2: syz_read_part_table(0x0, 0x2, &(0x7f0000000100)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0000ffffff85000000060000000000024000ffffff8200007ee100000088770072003007000f00000000000000008000da55aa", 0x40, 0x1c0}, {0x0, 0x0, 0xfffffffffffffffb}]) 09:53:59 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x6, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe}) 09:53:59 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) mkdirat(r1, &(0x7f00000000c0)='./file0\x00', 0x0) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r3 = syz_io_uring_setup(0x3ede, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000140)) io_uring_enter(r3, 0x2ff, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x5, 0x0, &(0x7f0000000040)=""/18, 0xffffffde}, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, &(0x7f0000000dc0)=[{&(0x7f0000000100)="f4a4848461fb0592d2f8db4c1f3c9e408788e03d28fe5e69dbceea46dd67888cdedd07a068040b956c3af7", 0x2b}, {0x0}, {0x0}], 0x3, &(0x7f0000000540)=ANY=[@ANYBLOB="1400000000000000", @ANYRES32], 0x50}}, {{0x0, 0x0, &(0x7f0000003180)=[{0x0}, {0x0}], 0x2, &(0x7f00000002c0)=ANY=[@ANYBLOB="c9252cdfb191d94ef15953a086ed40b24a018fb18d39f9a1256b33cf339f1d1bb52846ddaaaecd492eb1d0774b26968a44bf794e9d902a3c02af9543bc4096ac7a27", @ANYRES32, @ANYRES32=0x0], 0x50, 0x4041}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYRESDEC, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000003000000000000000010000000100", @ANYRES32, @ANYRES64, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESDEC=r4], 0xd0, 0x20000000}}], 0x3, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x138, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {0x0, 0x300000000000000}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x48, 0x1, {{'md5\x00'}}}]}, 0x138}}, 0x0) 09:53:59 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="5500000b18007f083ffe15b282a380930a03000248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) 09:53:59 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0x6c00000000000000}}}, 0xf0}}, 0x0) 09:53:59 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x9, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000e80)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) io_uring_enter(r1, 0x0, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x50}}], 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {}, {}, 0x0, 0xfcffffff, 0xa}, [@algo_auth={0x58, 0x1, {{'md5\x00'}, 0x80, "f959fb7b2a535a87359f0b633f54f881"}}]}, 0x148}}, 0x0) 09:53:59 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x6, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10}) 09:53:59 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) mkdirat(r1, &(0x7f00000000c0)='./file0\x00', 0x0) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r3 = syz_io_uring_setup(0x3ede, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000140)) io_uring_enter(r3, 0x2ff, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x5, 0x0, &(0x7f0000000040)=""/18, 0xffffffde}, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, &(0x7f0000000dc0)=[{&(0x7f0000000100)="f4a4848461fb0592d2f8db4c1f3c9e408788e03d28fe5e69dbceea46dd67888cdedd07a068040b956c3af7", 0x2b}, {0x0}, {0x0}], 0x3, &(0x7f0000000540)=ANY=[@ANYBLOB="1400000000000000", @ANYRES32], 0x50}}, {{0x0, 0x0, &(0x7f0000003180)=[{0x0}, {0x0}], 0x2, &(0x7f00000002c0)=ANY=[@ANYBLOB="c9252cdfb191d94ef15953a086ed40b24a018fb18d39f9a1256b33cf339f1d1bb52846ddaaaecd492eb1d0774b26968a44bf794e9d902a3c02af9543bc4096ac7a27", @ANYRES32, @ANYRES32=0x0], 0x50, 0x4041}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYRESDEC, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000003000000000000000010000000100", @ANYRES32, @ANYRES64, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESDEC=r4], 0xd0, 0x20000000}}], 0x3, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x138, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {0x0, 0x400000000000000}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x48, 0x1, {{'md5\x00'}}}]}, 0x138}}, 0x0) 09:53:59 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="5500000c18007f083ffe15b282a380930a03000248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) [ 502.280357][ C1] sd 0:0:1:0: [sg_rq_end_io] Sense Key : Illegal Request [current] [ 502.288374][ C1] sd 0:0:1:0: [sg_rq_end_io] Add. Sense: Invalid command operation code 09:53:59 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x9, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000e80)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) io_uring_enter(r1, 0x0, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x50}}], 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {}, {}, 0x0, 0xfeffffff, 0xa}, [@algo_auth={0x58, 0x1, {{'md5\x00'}, 0x80, "f959fb7b2a535a87359f0b633f54f881"}}]}, 0x148}}, 0x0) 09:53:59 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0x7400000000000000}}}, 0xf0}}, 0x0) [ 502.331220][T26289] netlink: 224 bytes leftover after parsing attributes in process `syz-executor.4'. 09:53:59 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="5500000d18007f083ffe15b282a380930a03000248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) [ 502.431636][ C1] sd 0:0:1:0: [sg_rq_end_io] Sense Key : Illegal Request [current] [ 502.439664][ C1] sd 0:0:1:0: [sg_rq_end_io] Add. Sense: Invalid command operation code [ 502.493777][T26305] netlink: 224 bytes leftover after parsing attributes in process `syz-executor.4'. [ 502.531946][T26306] loop2: detected capacity change from 0 to 16383 [ 502.579037][T26306] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 502.584322][T26306] loop2: p1 size 11290111 extends beyond EOD, truncated [ 502.592238][T26306] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 502.600132][T26306] loop2: p5 size 11290111 extends beyond EOD, truncated [ 502.607326][T26306] loop2: p6 size 1912633224 extends beyond EOD, truncated [ 502.751166][T26306] loop2: detected capacity change from 0 to 16383 [ 502.795570][ T5592] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 502.800956][ T5592] loop2: p1 size 11290111 extends beyond EOD, truncated [ 502.808572][ T5592] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 502.816516][ T5592] loop2: p5 size 11290111 extends beyond EOD, truncated [ 502.823906][ T5592] loop2: p6 size 1912633224 extends beyond EOD, truncated [ 502.833892][T26306] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 502.839115][T26306] loop2: p1 size 11290111 extends beyond EOD, truncated 09:54:00 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x6, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18}) 09:54:00 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) mkdirat(r1, &(0x7f00000000c0)='./file0\x00', 0x0) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r3 = syz_io_uring_setup(0x3ede, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000140)) io_uring_enter(r3, 0x2ff, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x5, 0x0, &(0x7f0000000040)=""/18, 0xffffffde}, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, &(0x7f0000000dc0)=[{&(0x7f0000000100)="f4a4848461fb0592d2f8db4c1f3c9e408788e03d28fe5e69dbceea46dd67888cdedd07a068040b956c3af7", 0x2b}, {0x0}, {0x0}], 0x3, &(0x7f0000000540)=ANY=[@ANYBLOB="1400000000000000", @ANYRES32], 0x50}}, {{0x0, 0x0, &(0x7f0000003180)=[{0x0}, {0x0}], 0x2, &(0x7f00000002c0)=ANY=[@ANYBLOB="c9252cdfb191d94ef15953a086ed40b24a018fb18d39f9a1256b33cf339f1d1bb52846ddaaaecd492eb1d0774b26968a44bf794e9d902a3c02af9543bc4096ac7a27", @ANYRES32, @ANYRES32=0x0], 0x50, 0x4041}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYRESDEC, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000003000000000000000010000000100", @ANYRES32, @ANYRES64, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESDEC=r4], 0xd0, 0x20000000}}], 0x3, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x138, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {0x0, 0x500000000000000}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x48, 0x1, {{'md5\x00'}}}]}, 0x138}}, 0x0) 09:54:00 executing program 2: syz_read_part_table(0x0, 0x2, &(0x7f0000000100)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0000ffffff85000000060000000000024000ffffff8200fdefe100000088770072003007000f00000000000000008000da55aa", 0x40, 0x1c0}, {0x0, 0x0, 0xfffffffffffffffb}]) 09:54:00 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0x7a00000000000000}}}, 0xf0}}, 0x0) 09:54:00 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="5500000e18007f083ffe15b282a380930a03000248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) 09:54:00 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x9, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000e80)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) io_uring_enter(r1, 0x0, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x50}}], 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {}, {}, 0x0, 0xffffff7f, 0xa}, [@algo_auth={0x58, 0x1, {{'md5\x00'}, 0x80, "f959fb7b2a535a87359f0b633f54f881"}}]}, 0x148}}, 0x0) [ 502.846574][T26306] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 502.854374][T26306] loop2: p5 size 11290111 extends beyond EOD, truncated [ 502.861841][T26306] loop2: p6 size 1912633224 extends beyond EOD, truncated 09:54:00 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="5500000f18007f083ffe15b282a380930a03000248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) 09:54:00 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000000000}}}, 0xf0}}, 0x0) 09:54:00 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x9, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000e80)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) io_uring_enter(r1, 0x0, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x50}}], 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {}, {}, 0x0, 0xffffff9e, 0xa}, [@algo_auth={0x58, 0x1, {{'md5\x00'}, 0x80, "f959fb7b2a535a87359f0b633f54f881"}}]}, 0x148}}, 0x0) 09:54:00 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x6, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x600}) 09:54:00 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) mkdirat(r1, &(0x7f00000000c0)='./file0\x00', 0x0) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r3 = syz_io_uring_setup(0x3ede, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000140)) io_uring_enter(r3, 0x2ff, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x5, 0x0, &(0x7f0000000040)=""/18, 0xffffffde}, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, &(0x7f0000000dc0)=[{&(0x7f0000000100)="f4a4848461fb0592d2f8db4c1f3c9e408788e03d28fe5e69dbceea46dd67888cdedd07a068040b956c3af7", 0x2b}, {0x0}, {0x0}], 0x3, &(0x7f0000000540)=ANY=[@ANYBLOB="1400000000000000", @ANYRES32], 0x50}}, {{0x0, 0x0, &(0x7f0000003180)=[{0x0}, {0x0}], 0x2, &(0x7f00000002c0)=ANY=[@ANYBLOB="c9252cdfb191d94ef15953a086ed40b24a018fb18d39f9a1256b33cf339f1d1bb52846ddaaaecd492eb1d0774b26968a44bf794e9d902a3c02af9543bc4096ac7a27", @ANYRES32, @ANYRES32=0x0], 0x50, 0x4041}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYRESDEC, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000003000000000000000010000000100", @ANYRES32, @ANYRES64, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESDEC=r4], 0xd0, 0x20000000}}], 0x3, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x138, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {0x0, 0x600000000000000}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x48, 0x1, {{'md5\x00'}}}]}, 0x138}}, 0x0) [ 502.919135][T26315] netlink: 224 bytes leftover after parsing attributes in process `syz-executor.4'. [ 502.932637][ C1] sd 0:0:1:0: [sg_rq_end_io] Sense Key : Illegal Request [current] [ 502.940658][ C1] sd 0:0:1:0: [sg_rq_end_io] Add. Sense: Invalid command operation code 09:54:00 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="5500001018007f083ffe15b282a380930a03000248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) 09:54:00 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x9, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000e80)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) io_uring_enter(r1, 0x0, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x50}}], 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {}, {}, 0x0, 0xffffffea, 0xa}, [@algo_auth={0x58, 0x1, {{'md5\x00'}, 0x80, "f959fb7b2a535a87359f0b633f54f881"}}]}, 0x148}}, 0x0) 09:54:00 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0x9effffff00000000}}}, 0xf0}}, 0x0) [ 503.148715][T26325] netlink: 224 bytes leftover after parsing attributes in process `syz-executor.4'. [ 503.170206][ C1] sd 0:0:1:0: [sg_rq_end_io] Sense Key : Illegal Request [current] [ 503.178234][ C1] sd 0:0:1:0: [sg_rq_end_io] Add. Sense: Invalid command operation code [ 503.297589][T26335] loop2: detected capacity change from 0 to 16383 [ 503.362396][ T5592] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 503.367718][ T5592] loop2: p1 size 11290111 extends beyond EOD, truncated [ 503.375341][ T5592] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 503.383265][ T5592] loop2: p5 size 11290111 extends beyond EOD, truncated [ 503.386824][T26341] netlink: 224 bytes leftover after parsing attributes in process `syz-executor.4'. [ 503.401711][ T5592] loop2: p6 size 1912633224 extends beyond EOD, truncated [ 503.412004][T26335] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 503.417312][T26335] loop2: p1 size 11290111 extends beyond EOD, truncated [ 503.425075][T26335] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 503.433008][T26335] loop2: p5 size 11290111 extends beyond EOD, truncated [ 503.440388][T26335] loop2: p6 size 1912633224 extends beyond EOD, truncated [ 503.573785][T26335] loop2: detected capacity change from 0 to 16383 09:54:01 executing program 2: syz_read_part_table(0x0, 0x2, &(0x7f0000000100)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0000ffffff85000000060000000000024000ffffff8200effde100000088770072003007000f00000000000000008000da55aa", 0x40, 0x1c0}, {0x0, 0x0, 0xfffffffffffffffb}]) 09:54:01 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x6, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x700}) 09:54:01 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) mkdirat(r1, &(0x7f00000000c0)='./file0\x00', 0x0) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r3 = syz_io_uring_setup(0x3ede, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000140)) io_uring_enter(r3, 0x2ff, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x5, 0x0, &(0x7f0000000040)=""/18, 0xffffffde}, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, &(0x7f0000000dc0)=[{&(0x7f0000000100)="f4a4848461fb0592d2f8db4c1f3c9e408788e03d28fe5e69dbceea46dd67888cdedd07a068040b956c3af7", 0x2b}, {0x0}, {0x0}], 0x3, &(0x7f0000000540)=ANY=[@ANYBLOB="1400000000000000", @ANYRES32], 0x50}}, {{0x0, 0x0, &(0x7f0000003180)=[{0x0}, {0x0}], 0x2, &(0x7f00000002c0)=ANY=[@ANYBLOB="c9252cdfb191d94ef15953a086ed40b24a018fb18d39f9a1256b33cf339f1d1bb52846ddaaaecd492eb1d0774b26968a44bf794e9d902a3c02af9543bc4096ac7a27", @ANYRES32, @ANYRES32=0x0], 0x50, 0x4041}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYRESDEC, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000003000000000000000010000000100", @ANYRES32, @ANYRES64, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESDEC=r4], 0xd0, 0x20000000}}], 0x3, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x138, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {0x0, 0x700000000000000}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x48, 0x1, {{'md5\x00'}}}]}, 0x138}}, 0x0) 09:54:01 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="5500001118007f083ffe15b282a380930a03000248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) 09:54:01 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x9, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000e80)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) io_uring_enter(r1, 0x0, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x50}}], 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {}, {}, 0x0, 0xffffffef, 0xa}, [@algo_auth={0x58, 0x1, {{'md5\x00'}, 0x80, "f959fb7b2a535a87359f0b633f54f881"}}]}, 0x148}}, 0x0) 09:54:01 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0xc00e000000000000}}}, 0xf0}}, 0x0) [ 503.620098][T26335] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 503.625424][T26335] loop2: p1 size 11290111 extends beyond EOD, truncated [ 503.633059][T26335] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 503.640762][T26335] loop2: p5 size 11290111 extends beyond EOD, truncated [ 503.648022][T26335] loop2: p6 size 1912633224 extends beyond EOD, truncated 09:54:01 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="5500001218007f083ffe15b282a380930a03000248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) [ 503.741448][ C1] sd 0:0:1:0: [sg_rq_end_io] Sense Key : Illegal Request [current] [ 503.749454][ C1] sd 0:0:1:0: [sg_rq_end_io] Add. Sense: Invalid command operation code [ 503.768125][ C1] scsi_io_completion_action: 11 callbacks suppressed [ 503.768154][ C1] sd 0:0:1:0: tag#6041 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 503.784698][ C1] sd 0:0:1:0: tag#6041 CDB: opcode=0xe5 (vendor) 09:54:01 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0xeaffffff00000000}}}, 0xf0}}, 0x0) 09:54:01 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x9, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000e80)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) io_uring_enter(r1, 0x0, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x50}}], 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {}, {}, 0x0, 0xfffffff0, 0xa}, [@algo_auth={0x58, 0x1, {{'md5\x00'}, 0x80, "f959fb7b2a535a87359f0b633f54f881"}}]}, 0x148}}, 0x0) 09:54:01 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x6, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x900}) 09:54:01 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) mkdirat(r1, &(0x7f00000000c0)='./file0\x00', 0x0) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r3 = syz_io_uring_setup(0x3ede, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000140)) io_uring_enter(r3, 0x2ff, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x5, 0x0, &(0x7f0000000040)=""/18, 0xffffffde}, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, &(0x7f0000000dc0)=[{&(0x7f0000000100)="f4a4848461fb0592d2f8db4c1f3c9e408788e03d28fe5e69dbceea46dd67888cdedd07a068040b956c3af7", 0x2b}, {0x0}, {0x0}], 0x3, &(0x7f0000000540)=ANY=[@ANYBLOB="1400000000000000", @ANYRES32], 0x50}}, {{0x0, 0x0, &(0x7f0000003180)=[{0x0}, {0x0}], 0x2, &(0x7f00000002c0)=ANY=[@ANYBLOB="c9252cdfb191d94ef15953a086ed40b24a018fb18d39f9a1256b33cf339f1d1bb52846ddaaaecd492eb1d0774b26968a44bf794e9d902a3c02af9543bc4096ac7a27", @ANYRES32, @ANYRES32=0x0], 0x50, 0x4041}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYRESDEC, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000003000000000000000010000000100", @ANYRES32, @ANYRES64, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESDEC=r4], 0xd0, 0x20000000}}], 0x3, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x138, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {0x0, 0x800000000000000}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x48, 0x1, {{'md5\x00'}}}]}, 0x138}}, 0x0) [ 503.791022][ C1] sd 0:0:1:0: tag#6041 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 503.800065][ C1] sd 0:0:1:0: tag#6041 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 503.809126][ C1] sd 0:0:1:0: tag#6041 CDB[20]: ba 09:54:01 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0xefffffff00000000}}}, 0xf0}}, 0x0) [ 504.091434][ C1] sd 0:0:1:0: [sg_rq_end_io] Sense Key : Illegal Request [current] [ 504.099458][ C1] sd 0:0:1:0: [sg_rq_end_io] Add. Sense: Invalid command operation code [ 504.115262][ C0] sd 0:0:1:0: tag#6045 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 504.125109][ C0] sd 0:0:1:0: tag#6045 CDB: opcode=0xe5 (vendor) [ 504.131453][ C0] sd 0:0:1:0: tag#6045 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 504.140517][ C0] sd 0:0:1:0: tag#6045 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 504.149535][ C0] sd 0:0:1:0: tag#6045 CDB[20]: ba [ 504.162325][ C0] sd 0:0:1:0: tag#6075 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 504.172163][ C0] sd 0:0:1:0: tag#6075 CDB: opcode=0xe5 (vendor) [ 504.178499][ C0] sd 0:0:1:0: tag#6075 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 504.187528][ C0] sd 0:0:1:0: tag#6075 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 504.196530][ C0] sd 0:0:1:0: tag#6075 CDB[20]: ba [ 504.249592][T26370] loop2: detected capacity change from 0 to 16383 [ 504.310567][T26370] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 504.315915][T26370] loop2: p1 size 11290111 extends beyond EOD, truncated [ 504.324442][T26370] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 504.332624][T26370] loop2: p5 size 11290111 extends beyond EOD, truncated [ 504.340244][T26370] loop2: p6 size 1912633224 extends beyond EOD, truncated [ 504.482126][T26370] loop2: detected capacity change from 0 to 16383 09:54:01 executing program 2: syz_read_part_table(0x0, 0x2, &(0x7f0000000100)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0000ffffff85000000060000000000024000ffffff8200fffee100000088770072003007000f00000000000000008000da55aa", 0x40, 0x1c0}, {0x0, 0x0, 0xfffffffffffffffb}]) 09:54:01 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="5500002518007f083ffe15b282a380930a03000248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) 09:54:01 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x9, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000e80)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) io_uring_enter(r1, 0x0, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x50}}], 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {}, {}, 0x0, 0xfffffffc, 0xa}, [@algo_auth={0x58, 0x1, {{'md5\x00'}, 0x80, "f959fb7b2a535a87359f0b633f54f881"}}]}, 0x148}}, 0x0) 09:54:01 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) mkdirat(r1, &(0x7f00000000c0)='./file0\x00', 0x0) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r3 = syz_io_uring_setup(0x3ede, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000140)) io_uring_enter(r3, 0x2ff, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x5, 0x0, &(0x7f0000000040)=""/18, 0xffffffde}, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, &(0x7f0000000dc0)=[{&(0x7f0000000100)="f4a4848461fb0592d2f8db4c1f3c9e408788e03d28fe5e69dbceea46dd67888cdedd07a068040b956c3af7", 0x2b}, {0x0}, {0x0}], 0x3, &(0x7f0000000540)=ANY=[@ANYBLOB="1400000000000000", @ANYRES32], 0x50}}, {{0x0, 0x0, &(0x7f0000003180)=[{0x0}, {0x0}], 0x2, &(0x7f00000002c0)=ANY=[@ANYBLOB="c9252cdfb191d94ef15953a086ed40b24a018fb18d39f9a1256b33cf339f1d1bb52846ddaaaecd492eb1d0774b26968a44bf794e9d902a3c02af9543bc4096ac7a27", @ANYRES32, @ANYRES32=0x0], 0x50, 0x4041}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYRESDEC, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000003000000000000000010000000100", @ANYRES32, @ANYRES64, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESDEC=r4], 0xd0, 0x20000000}}], 0x3, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x138, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {0x0, 0x900000000000000}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x48, 0x1, {{'md5\x00'}}}]}, 0x138}}, 0x0) 09:54:01 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0xf0ffffff00000000}}}, 0xf0}}, 0x0) 09:54:01 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x6, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd00}) [ 504.527218][T26370] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 504.532597][T26370] loop2: p1 size 11290111 extends beyond EOD, truncated [ 504.540481][T26370] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 504.548256][T26370] loop2: p5 size 11290111 extends beyond EOD, truncated [ 504.555485][T26370] loop2: p6 size 1912633224 extends beyond EOD, truncated 09:54:01 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x9, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000e80)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) io_uring_enter(r1, 0x0, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x50}}], 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {}, {}, 0x0, 0xfffffffe, 0xa}, [@algo_auth={0x58, 0x1, {{'md5\x00'}, 0x80, "f959fb7b2a535a87359f0b633f54f881"}}]}, 0x148}}, 0x0) 09:54:01 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="5500004818007f083ffe15b282a380930a03000248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) 09:54:01 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0xfeffffff00000000}}}, 0xf0}}, 0x0) [ 504.635050][ C1] sd 0:0:1:0: tag#6071 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 504.644904][ C1] sd 0:0:1:0: tag#6071 CDB: opcode=0xe5 (vendor) [ 504.651251][ C1] sd 0:0:1:0: tag#6071 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 504.660269][ C1] sd 0:0:1:0: tag#6071 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 504.669418][ C1] sd 0:0:1:0: tag#6071 CDB[20]: ba [ 504.676645][ C1] sd 0:0:1:0: [sg_rq_end_io] Sense Key : Illegal Request [current] 09:54:02 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x6, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe00}) 09:54:02 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) mkdirat(r1, &(0x7f00000000c0)='./file0\x00', 0x0) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r3 = syz_io_uring_setup(0x3ede, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000140)) io_uring_enter(r3, 0x2ff, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x5, 0x0, &(0x7f0000000040)=""/18, 0xffffffde}, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, &(0x7f0000000dc0)=[{&(0x7f0000000100)="f4a4848461fb0592d2f8db4c1f3c9e408788e03d28fe5e69dbceea46dd67888cdedd07a068040b956c3af7", 0x2b}, {0x0}, {0x0}], 0x3, &(0x7f0000000540)=ANY=[@ANYBLOB="1400000000000000", @ANYRES32], 0x50}}, {{0x0, 0x0, &(0x7f0000003180)=[{0x0}, {0x0}], 0x2, &(0x7f00000002c0)=ANY=[@ANYBLOB="c9252cdfb191d94ef15953a086ed40b24a018fb18d39f9a1256b33cf339f1d1bb52846ddaaaecd492eb1d0774b26968a44bf794e9d902a3c02af9543bc4096ac7a27", @ANYRES32, @ANYRES32=0x0], 0x50, 0x4041}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYRESDEC, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000003000000000000000010000000100", @ANYRES32, @ANYRES64, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESDEC=r4], 0xd0, 0x20000000}}], 0x3, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x138, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {0x0, 0xa00000000000000}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x48, 0x1, {{'md5\x00'}}}]}, 0x138}}, 0x0) [ 504.684670][ C1] sd 0:0:1:0: [sg_rq_end_io] Add. Sense: Invalid command operation code [ 504.685907][ C0] sd 0:0:1:0: tag#6074 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 504.702802][ C0] sd 0:0:1:0: tag#6074 CDB: opcode=0xe5 (vendor) [ 504.709116][ C0] sd 0:0:1:0: tag#6074 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 504.718162][ C0] sd 0:0:1:0: tag#6074 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 504.727181][ C0] sd 0:0:1:0: tag#6074 CDB[20]: ba 09:54:02 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x9, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000e80)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) io_uring_enter(r1, 0x0, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x50}}], 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {}, {}, 0x0, 0x0, 0x2}, [@algo_auth={0x58, 0x1, {{'md5\x00'}, 0x80, "f959fb7b2a535a87359f0b633f54f881"}}]}, 0x148}}, 0x0) [ 504.916503][ C1] sd 0:0:1:0: [sg_rq_end_io] Sense Key : Illegal Request [current] [ 504.924540][ C1] sd 0:0:1:0: [sg_rq_end_io] Add. Sense: Invalid command operation code [ 504.945762][ C0] sd 0:0:1:0: tag#6031 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 504.955591][ C0] sd 0:0:1:0: tag#6031 CDB: opcode=0xe5 (vendor) [ 504.961921][ C0] sd 0:0:1:0: tag#6031 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 504.970940][ C0] sd 0:0:1:0: tag#6031 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 504.979939][ C0] sd 0:0:1:0: tag#6031 CDB[20]: ba [ 505.053411][T26400] loop2: detected capacity change from 0 to 16383 [ 505.105673][T26400] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 505.110982][T26400] loop2: p1 size 11290111 extends beyond EOD, truncated [ 505.118734][T26400] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 505.126659][T26400] loop2: p5 size 11290111 extends beyond EOD, truncated [ 505.134008][T26400] loop2: p6 size 1912633224 extends beyond EOD, truncated [ 505.245777][T26400] loop2: detected capacity change from 0 to 16383 [ 505.299951][ T5592] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 505.305197][ T5592] loop2: p1 size 11290111 extends beyond EOD, truncated [ 505.312876][ T5592] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 505.320738][ T5592] loop2: p5 size 11290111 extends beyond EOD, truncated [ 505.327984][ T5592] loop2: p6 size 1912633224 extends beyond EOD, truncated [ 505.337918][T26400] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 505.343225][T26400] loop2: p1 size 11290111 extends beyond EOD, truncated 09:54:02 executing program 2: syz_read_part_table(0x0, 0x2, &(0x7f0000000100)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0000ffffff85000000060000000000024000ffffff8200feffe100000088770072003007000f00000000000000008000da55aa", 0x40, 0x1c0}, {0x0, 0x0, 0xfffffffffffffffb}]) 09:54:02 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="5500004c18007f083ffe15b282a380930a03000248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) 09:54:02 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0xffffff7f00000000}}}, 0xf0}}, 0x0) 09:54:02 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x6, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1800}) 09:54:02 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) mkdirat(r1, &(0x7f00000000c0)='./file0\x00', 0x0) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r3 = syz_io_uring_setup(0x3ede, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000140)) io_uring_enter(r3, 0x2ff, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x5, 0x0, &(0x7f0000000040)=""/18, 0xffffffde}, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, &(0x7f0000000dc0)=[{&(0x7f0000000100)="f4a4848461fb0592d2f8db4c1f3c9e408788e03d28fe5e69dbceea46dd67888cdedd07a068040b956c3af7", 0x2b}, {0x0}, {0x0}], 0x3, &(0x7f0000000540)=ANY=[@ANYBLOB="1400000000000000", @ANYRES32], 0x50}}, {{0x0, 0x0, &(0x7f0000003180)=[{0x0}, {0x0}], 0x2, &(0x7f00000002c0)=ANY=[@ANYBLOB="c9252cdfb191d94ef15953a086ed40b24a018fb18d39f9a1256b33cf339f1d1bb52846ddaaaecd492eb1d0774b26968a44bf794e9d902a3c02af9543bc4096ac7a27", @ANYRES32, @ANYRES32=0x0], 0x50, 0x4041}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYRESDEC, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000003000000000000000010000000100", @ANYRES32, @ANYRES64, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESDEC=r4], 0xd0, 0x20000000}}], 0x3, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x138, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {0x0, 0xb00000000000000}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x48, 0x1, {{'md5\x00'}}}]}, 0x138}}, 0x0) 09:54:02 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x9, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000e80)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) io_uring_enter(r1, 0x0, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x50}}], 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {}, {}, 0x0, 0x0, 0x2d}, [@algo_auth={0x58, 0x1, {{'md5\x00'}, 0x80, "f959fb7b2a535a87359f0b633f54f881"}}]}, 0x148}}, 0x0) [ 505.350823][T26400] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 505.358752][T26400] loop2: p5 size 11290111 extends beyond EOD, truncated [ 505.366064][T26400] loop2: p6 size 1912633224 extends beyond EOD, truncated 09:54:02 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="5500006018007f083ffe15b282a380930a03000248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) 09:54:02 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x6, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1d2b}) 09:54:02 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff00000000}}}, 0xf0}}, 0x0) [ 505.437533][ C1] sd 0:0:1:0: [sg_rq_end_io] Sense Key : Illegal Request [current] [ 505.445548][ C1] sd 0:0:1:0: [sg_rq_end_io] Add. Sense: Invalid command operation code [ 505.470913][ C0] sd 0:0:1:0: tag#6047 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 505.480747][ C0] sd 0:0:1:0: tag#6047 CDB: opcode=0xe5 (vendor) 09:54:02 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x9, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000e80)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) io_uring_enter(r1, 0x0, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x50}}], 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x58, 0x1, {{'md5\x00'}, 0x80, "f959fb7b2a535a87359f0b633f54f881"}}]}, 0x148}}, 0x0) [ 505.487105][ C0] sd 0:0:1:0: tag#6047 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 505.496149][ C0] sd 0:0:1:0: tag#6047 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 505.505199][ C0] sd 0:0:1:0: tag#6047 CDB[20]: ba [ 505.520665][ C1] sd 0:0:1:0: tag#6072 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 505.530533][ C1] sd 0:0:1:0: tag#6072 CDB: opcode=0xe5 (vendor) 09:54:02 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) mkdirat(r1, &(0x7f00000000c0)='./file0\x00', 0x0) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r3 = syz_io_uring_setup(0x3ede, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000140)) io_uring_enter(r3, 0x2ff, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x5, 0x0, &(0x7f0000000040)=""/18, 0xffffffde}, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, &(0x7f0000000dc0)=[{&(0x7f0000000100)="f4a4848461fb0592d2f8db4c1f3c9e408788e03d28fe5e69dbceea46dd67888cdedd07a068040b956c3af7", 0x2b}, {0x0}, {0x0}], 0x3, &(0x7f0000000540)=ANY=[@ANYBLOB="1400000000000000", @ANYRES32], 0x50}}, {{0x0, 0x0, &(0x7f0000003180)=[{0x0}, {0x0}], 0x2, &(0x7f00000002c0)=ANY=[@ANYBLOB="c9252cdfb191d94ef15953a086ed40b24a018fb18d39f9a1256b33cf339f1d1bb52846ddaaaecd492eb1d0774b26968a44bf794e9d902a3c02af9543bc4096ac7a27", @ANYRES32, @ANYRES32=0x0], 0x50, 0x4041}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYRESDEC, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000003000000000000000010000000100", @ANYRES32, @ANYRES64, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESDEC=r4], 0xd0, 0x20000000}}], 0x3, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x138, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {0x0, 0x1000000000000000}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x48, 0x1, {{'md5\x00'}}}]}, 0x138}}, 0x0) [ 505.536872][ C1] sd 0:0:1:0: tag#6072 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 505.545877][ C1] sd 0:0:1:0: tag#6072 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 505.554895][ C1] sd 0:0:1:0: tag#6072 CDB[20]: ba 09:54:03 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="5500006818007f083ffe15b282a380930a03000248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) [ 505.779876][ C1] sd 0:0:1:0: [sg_rq_end_io] Sense Key : Illegal Request [current] [ 505.787908][ C1] sd 0:0:1:0: [sg_rq_end_io] Add. Sense: Invalid command operation code [ 505.830344][ C1] sd 0:0:1:0: tag#6068 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 505.840161][ C1] sd 0:0:1:0: tag#6068 CDB: opcode=0xe5 (vendor) [ 505.846504][ C1] sd 0:0:1:0: tag#6068 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 505.855562][ C1] sd 0:0:1:0: tag#6068 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 505.864575][ C1] sd 0:0:1:0: tag#6068 CDB[20]: ba [ 505.942916][ T5592] udevd[5592]: inotify_add_watch(7, /dev/loop2p1, 10) failed: No such file or directory [ 505.948175][ T5428] udevd[5428]: inotify_add_watch(7, /dev/loop2p2, 10) failed: No such file or directory [ 505.954290][T13989] udevd[13989]: inotify_add_watch(7, /dev/loop2p3, 10) failed: No such file or directory [ 505.964163][T16174] udevd[16174]: inotify_add_watch(7, /dev/loop2p4, 10) failed: No such file or directory [ 505.973989][ T5551] udevd[5551]: inotify_add_watch(7, /dev/loop2p6, 10) failed: No such file or directory [ 505.983395][ T5552] udevd[5552]: inotify_add_watch(7, /dev/loop2p5, 10) failed: No such file or directory [ 506.002553][T26431] loop2: detected capacity change from 0 to 16383 [ 506.052223][T26431] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 506.057598][T26431] loop2: p1 size 11290111 extends beyond EOD, truncated [ 506.065338][T26431] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 506.073359][T26431] loop2: p5 size 11290111 extends beyond EOD, truncated [ 506.080753][T26431] loop2: p6 size 1912633224 extends beyond EOD, truncated [ 506.162476][T26431] loop2: detected capacity change from 0 to 16383 09:54:03 executing program 2: syz_read_part_table(0x0, 0x2, &(0x7f0000000100)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0000ffffff85000000060000000000024000ffffff82000002e100000088770072003007000f00000000000000008000da55aa", 0x40, 0x1c0}, {0x0, 0x0, 0xfffffffffffffffb}]) 09:54:03 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}}}, 0xf0}}, 0x0) 09:54:03 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x6, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2b1d}) 09:54:03 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x9, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000e80)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) io_uring_enter(r1, 0x0, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x50}}], 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {}, {}, 0x0, 0x0, 0xa, 0x2}, [@algo_auth={0x58, 0x1, {{'md5\x00'}, 0x80, "f959fb7b2a535a87359f0b633f54f881"}}]}, 0x148}}, 0x0) 09:54:03 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) mkdirat(r1, &(0x7f00000000c0)='./file0\x00', 0x0) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r3 = syz_io_uring_setup(0x3ede, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000140)) io_uring_enter(r3, 0x2ff, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x5, 0x0, &(0x7f0000000040)=""/18, 0xffffffde}, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, &(0x7f0000000dc0)=[{&(0x7f0000000100)="f4a4848461fb0592d2f8db4c1f3c9e408788e03d28fe5e69dbceea46dd67888cdedd07a068040b956c3af7", 0x2b}, {0x0}, {0x0}], 0x3, &(0x7f0000000540)=ANY=[@ANYBLOB="1400000000000000", @ANYRES32], 0x50}}, {{0x0, 0x0, &(0x7f0000003180)=[{0x0}, {0x0}], 0x2, &(0x7f00000002c0)=ANY=[@ANYBLOB="c9252cdfb191d94ef15953a086ed40b24a018fb18d39f9a1256b33cf339f1d1bb52846ddaaaecd492eb1d0774b26968a44bf794e9d902a3c02af9543bc4096ac7a27", @ANYRES32, @ANYRES32=0x0], 0x50, 0x4041}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYRESDEC, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000003000000000000000010000000100", @ANYRES32, @ANYRES64, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESDEC=r4], 0xd0, 0x20000000}}], 0x3, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x138, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {0x0, 0x1100000000000000}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x48, 0x1, {{'md5\x00'}}}]}, 0x138}}, 0x0) 09:54:03 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="5500006c18007f083ffe15b282a380930a03000248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) [ 506.207020][T26431] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 506.212316][T26431] loop2: p1 size 11290111 extends beyond EOD, truncated [ 506.220166][T26431] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 506.227939][T26431] loop2: p5 size 11290111 extends beyond EOD, truncated [ 506.235184][T26431] loop2: p6 size 1912633224 extends beyond EOD, truncated [ 506.285474][ C0] sd 0:0:1:0: tag#6057 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 506.293668][ T383] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 506.295312][ C0] sd 0:0:1:0: tag#6057 CDB: opcode=0xe5 (vendor) [ 506.295351][ C0] sd 0:0:1:0: tag#6057 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 506.295369][ C0] sd 0:0:1:0: tag#6057 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 506.300628][ T383] loop2: p1 size 11290111 extends beyond EOD, [ 506.306897][ C0] sd 0:0:1:0: tag#6057 CDB[20]: ba [ 506.315920][ T383] truncated [ 506.317409][ T383] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 506.348277][ T383] loop2: p5 size 11290111 extends beyond EOD, truncated [ 506.350623][T26440] __nla_validate_parse: 7 callbacks suppressed [ 506.350635][T26440] netlink: 224 bytes leftover after parsing attributes in process `syz-executor.4'. [ 506.356844][ T383] loop2: p6 size 1912633224 extends beyond EOD, truncated 09:54:03 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x9, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000e80)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) io_uring_enter(r1, 0x0, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x50}}], 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {}, {}, 0x0, 0x0, 0xa, 0x3}, [@algo_auth={0x58, 0x1, {{'md5\x00'}, 0x80, "f959fb7b2a535a87359f0b633f54f881"}}]}, 0x148}}, 0x0) 09:54:03 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="5500007418007f083ffe15b282a380930a03000248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) 09:54:03 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}}}, 0xf0}}, 0x0) 09:54:03 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) mkdirat(r1, &(0x7f00000000c0)='./file0\x00', 0x0) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r3 = syz_io_uring_setup(0x3ede, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000140)) io_uring_enter(r3, 0x2ff, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x5, 0x0, &(0x7f0000000040)=""/18, 0xffffffde}, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, &(0x7f0000000dc0)=[{&(0x7f0000000100)="f4a4848461fb0592d2f8db4c1f3c9e408788e03d28fe5e69dbceea46dd67888cdedd07a068040b956c3af7", 0x2b}, {0x0}, {0x0}], 0x3, &(0x7f0000000540)=ANY=[@ANYBLOB="1400000000000000", @ANYRES32], 0x50}}, {{0x0, 0x0, &(0x7f0000003180)=[{0x0}, {0x0}], 0x2, &(0x7f00000002c0)=ANY=[@ANYBLOB="c9252cdfb191d94ef15953a086ed40b24a018fb18d39f9a1256b33cf339f1d1bb52846ddaaaecd492eb1d0774b26968a44bf794e9d902a3c02af9543bc4096ac7a27", @ANYRES32, @ANYRES32=0x0], 0x50, 0x4041}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYRESDEC, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000003000000000000000010000000100", @ANYRES32, @ANYRES64, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESDEC=r4], 0xd0, 0x20000000}}], 0x3, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x138, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {0x0, 0x1400000000000000}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x48, 0x1, {{'md5\x00'}}}]}, 0x138}}, 0x0) 09:54:03 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x6, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000}) [ 506.379289][ C1] sd 0:0:1:0: [sg_rq_end_io] Sense Key : Illegal Request [current] [ 506.387338][ C1] sd 0:0:1:0: [sg_rq_end_io] Add. Sense: Invalid command operation code 09:54:03 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x9, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000e80)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) io_uring_enter(r1, 0x0, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x50}}], 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {}, {}, 0x0, 0x0, 0xa, 0x4}, [@algo_auth={0x58, 0x1, {{'md5\x00'}, 0x80, "f959fb7b2a535a87359f0b633f54f881"}}]}, 0x148}}, 0x0) [ 506.580967][T26456] netlink: 224 bytes leftover after parsing attributes in process `syz-executor.4'. [ 506.595818][ C1] sd 0:0:1:0: [sg_rq_end_io] Sense Key : Illegal Request [current] [ 506.603886][ C1] sd 0:0:1:0: [sg_rq_end_io] Add. Sense: Invalid command operation code [ 506.651378][T26461] loop2: detected capacity change from 0 to 16383 [ 506.681099][ T5428] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 506.686376][ T5428] loop2: p1 size 11290111 extends beyond EOD, truncated [ 506.694257][ T5428] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 506.702220][ T5428] loop2: p5 size 11290111 extends beyond EOD, truncated [ 506.709519][ T5428] loop2: p6 size 1912633224 extends beyond EOD, truncated [ 506.721801][T26461] loop_reread_partitions: partition scan of loop2 () failed (rc=-16) 09:54:04 executing program 2: syz_read_part_table(0x0, 0x2, &(0x7f0000000100)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0000ffffff85000000060000000000024000ffffff82000003e100000088770072003007000f00000000000000008000da55aa", 0x40, 0x1c0}, {0x0, 0x0, 0xfffffffffffffffb}]) 09:54:04 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="5500007a18007f083ffe15b282a380930a03000248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) 09:54:04 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}}}, 0xf0}}, 0x0) 09:54:04 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) mkdirat(r1, &(0x7f00000000c0)='./file0\x00', 0x0) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r3 = syz_io_uring_setup(0x3ede, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000140)) io_uring_enter(r3, 0x2ff, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x5, 0x0, &(0x7f0000000040)=""/18, 0xffffffde}, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, &(0x7f0000000dc0)=[{&(0x7f0000000100)="f4a4848461fb0592d2f8db4c1f3c9e408788e03d28fe5e69dbceea46dd67888cdedd07a068040b956c3af7", 0x2b}, {0x0}, {0x0}], 0x3, &(0x7f0000000540)=ANY=[@ANYBLOB="1400000000000000", @ANYRES32], 0x50}}, {{0x0, 0x0, &(0x7f0000003180)=[{0x0}, {0x0}], 0x2, &(0x7f00000002c0)=ANY=[@ANYBLOB="c9252cdfb191d94ef15953a086ed40b24a018fb18d39f9a1256b33cf339f1d1bb52846ddaaaecd492eb1d0774b26968a44bf794e9d902a3c02af9543bc4096ac7a27", @ANYRES32, @ANYRES32=0x0], 0x50, 0x4041}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYRESDEC, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000003000000000000000010000000100", @ANYRES32, @ANYRES64, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESDEC=r4], 0xd0, 0x20000000}}], 0x3, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x138, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {0x0, 0x2000000000000000}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x48, 0x1, {{'md5\x00'}}}]}, 0x138}}, 0x0) 09:54:04 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x6, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000}) 09:54:04 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x9, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000e80)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) io_uring_enter(r1, 0x0, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x50}}], 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {}, {}, 0x0, 0x0, 0xa, 0x5}, [@algo_auth={0x58, 0x1, {{'md5\x00'}, 0x80, "f959fb7b2a535a87359f0b633f54f881"}}]}, 0x148}}, 0x0) [ 506.831953][ T5428] udevd[5428]: inotify_add_watch(7, /dev/loop2p2, 10) failed: No such file or directory [ 506.832450][ T5592] udevd[5592]: inotify_add_watch(7, /dev/loop2p1, 10) failed: No such file or directory [ 506.844480][T13989] udevd[13989]: inotify_add_watch(7, /dev/loop2p3, 10) failed: No such file or directory [ 506.852521][T16174] udevd[16174]: inotify_add_watch(7, /dev/loop2p4, 10) failed: No such file or directory 09:54:04 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="550000fc18007f083ffe15b282a380930a03000248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) 09:54:04 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}}}, 0xf0}}, 0x0) 09:54:04 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x6, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000}) 09:54:04 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) mkdirat(r1, &(0x7f00000000c0)='./file0\x00', 0x0) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r3 = syz_io_uring_setup(0x3ede, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000140)) io_uring_enter(r3, 0x2ff, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x5, 0x0, &(0x7f0000000040)=""/18, 0xffffffde}, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, &(0x7f0000000dc0)=[{&(0x7f0000000100)="f4a4848461fb0592d2f8db4c1f3c9e408788e03d28fe5e69dbceea46dd67888cdedd07a068040b956c3af7", 0x2b}, {0x0}, {0x0}], 0x3, &(0x7f0000000540)=ANY=[@ANYBLOB="1400000000000000", @ANYRES32], 0x50}}, {{0x0, 0x0, &(0x7f0000003180)=[{0x0}, {0x0}], 0x2, &(0x7f00000002c0)=ANY=[@ANYBLOB="c9252cdfb191d94ef15953a086ed40b24a018fb18d39f9a1256b33cf339f1d1bb52846ddaaaecd492eb1d0774b26968a44bf794e9d902a3c02af9543bc4096ac7a27", @ANYRES32, @ANYRES32=0x0], 0x50, 0x4041}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYRESDEC, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000003000000000000000010000000100", @ANYRES32, @ANYRES64, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESDEC=r4], 0xd0, 0x20000000}}], 0x3, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x138, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {0x0, 0x3ec58e0221000000}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x48, 0x1, {{'md5\x00'}}}]}, 0x138}}, 0x0) [ 506.890387][T26472] netlink: 224 bytes leftover after parsing attributes in process `syz-executor.4'. [ 506.903683][ C1] sd 0:0:1:0: [sg_rq_end_io] Sense Key : Illegal Request [current] [ 506.911835][ C1] sd 0:0:1:0: [sg_rq_end_io] Add. Sense: Invalid command operation code 09:54:04 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x9, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000e80)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) io_uring_enter(r1, 0x0, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x50}}], 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {}, {}, 0x0, 0x0, 0xa, 0x6}, [@algo_auth={0x58, 0x1, {{'md5\x00'}, 0x80, "f959fb7b2a535a87359f0b633f54f881"}}]}, 0x148}}, 0x0) 09:54:04 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="5500000029007f083ffe15b282a380930a03000248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) [ 507.050171][T26484] netlink: 224 bytes leftover after parsing attributes in process `syz-executor.4'. [ 507.055394][ C1] sd 0:0:1:0: [sg_rq_end_io] Sense Key : Illegal Request [current] [ 507.067570][ C1] sd 0:0:1:0: [sg_rq_end_io] Add. Sense: Invalid command operation code [ 507.101516][T26489] netlink: 72 bytes leftover after parsing attributes in process `syz-executor.1'. [ 507.139362][T26491] loop2: detected capacity change from 0 to 16383 [ 507.183197][T26496] netlink: 49 bytes leftover after parsing attributes in process `syz-executor.5'. [ 507.185924][ T5592] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 507.197784][ T5592] loop2: p1 size 11290111 extends beyond EOD, truncated [ 507.205706][ T5592] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 507.213747][ T5592] loop2: p5 size 11290111 extends beyond EOD, truncated [ 507.221191][ T5592] loop2: p6 size 1912633224 extends beyond EOD, truncated [ 507.231658][T26491] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 507.236909][T26491] loop2: p1 size 11290111 extends beyond EOD, truncated [ 507.244663][T26491] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 507.252465][T26491] loop2: p5 size 11290111 extends beyond EOD, truncated [ 507.259774][T26491] loop2: p6 size 1912633224 extends beyond EOD, truncated [ 507.366720][T26491] loop2: detected capacity change from 0 to 16383 09:54:04 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x6, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6000000}) 09:54:04 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}}}, 0xf0}}, 0x0) 09:54:04 executing program 2: syz_read_part_table(0x0, 0x2, &(0x7f0000000100)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0000ffffff85000000060000000000024000ffffff82000004e100000088770072003007000f00000000000000008000da55aa", 0x40, 0x1c0}, {0x0, 0x0, 0xfffffffffffffffb}]) 09:54:04 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) mkdirat(r1, &(0x7f00000000c0)='./file0\x00', 0x0) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r3 = syz_io_uring_setup(0x3ede, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000140)) io_uring_enter(r3, 0x2ff, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x5, 0x0, &(0x7f0000000040)=""/18, 0xffffffde}, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, &(0x7f0000000dc0)=[{&(0x7f0000000100)="f4a4848461fb0592d2f8db4c1f3c9e408788e03d28fe5e69dbceea46dd67888cdedd07a068040b956c3af7", 0x2b}, {0x0}, {0x0}], 0x3, &(0x7f0000000540)=ANY=[@ANYBLOB="1400000000000000", @ANYRES32], 0x50}}, {{0x0, 0x0, &(0x7f0000003180)=[{0x0}, {0x0}], 0x2, &(0x7f00000002c0)=ANY=[@ANYBLOB="c9252cdfb191d94ef15953a086ed40b24a018fb18d39f9a1256b33cf339f1d1bb52846ddaaaecd492eb1d0774b26968a44bf794e9d902a3c02af9543bc4096ac7a27", @ANYRES32, @ANYRES32=0x0], 0x50, 0x4041}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYRESDEC, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000003000000000000000010000000100", @ANYRES32, @ANYRES64, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESDEC=r4], 0xd0, 0x20000000}}], 0x3, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x138, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {0x0, 0x3f00000000000000}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x48, 0x1, {{'md5\x00'}}}]}, 0x138}}, 0x0) 09:54:04 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x9, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000e80)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) io_uring_enter(r1, 0x0, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x50}}], 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {}, {}, 0x0, 0x0, 0xa, 0x7}, [@algo_auth={0x58, 0x1, {{'md5\x00'}, 0x80, "f959fb7b2a535a87359f0b633f54f881"}}]}, 0x148}}, 0x0) 09:54:04 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="5500000040007f083ffe15b282a380930a03000248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) [ 507.422911][T26491] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 507.428293][T26491] loop2: p1 size 11290111 extends beyond EOD, truncated [ 507.435894][T26491] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 507.443982][T26491] loop2: p5 size 11290111 extends beyond EOD, truncated [ 507.451350][T26491] loop2: p6 size 1912633224 extends beyond EOD, truncated 09:54:04 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="5500000077007f083ffe15b282a380930a03000248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) 09:54:04 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}}}, 0xf0}}, 0x0) 09:54:04 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) mkdirat(r1, &(0x7f00000000c0)='./file0\x00', 0x0) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r3 = syz_io_uring_setup(0x3ede, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000140)) io_uring_enter(r3, 0x2ff, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x5, 0x0, &(0x7f0000000040)=""/18, 0xffffffde}, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, &(0x7f0000000dc0)=[{&(0x7f0000000100)="f4a4848461fb0592d2f8db4c1f3c9e408788e03d28fe5e69dbceea46dd67888cdedd07a068040b956c3af7", 0x2b}, {0x0}, {0x0}], 0x3, &(0x7f0000000540)=ANY=[@ANYBLOB="1400000000000000", @ANYRES32], 0x50}}, {{0x0, 0x0, &(0x7f0000003180)=[{0x0}, {0x0}], 0x2, &(0x7f00000002c0)=ANY=[@ANYBLOB="c9252cdfb191d94ef15953a086ed40b24a018fb18d39f9a1256b33cf339f1d1bb52846ddaaaecd492eb1d0774b26968a44bf794e9d902a3c02af9543bc4096ac7a27", @ANYRES32, @ANYRES32=0x0], 0x50, 0x4041}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYRESDEC, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000003000000000000000010000000100", @ANYRES32, @ANYRES64, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESDEC=r4], 0xd0, 0x20000000}}], 0x3, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x138, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {0x0, 0x4000000000000000}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x48, 0x1, {{'md5\x00'}}}]}, 0x138}}, 0x0) [ 507.514476][T26502] netlink: 224 bytes leftover after parsing attributes in process `syz-executor.4'. [ 507.517354][T26503] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=64 sclass=netlink_route_socket pid=26503 comm=syz-executor.5 [ 507.536781][ C1] sd 0:0:1:0: [sg_rq_end_io] Sense Key : Illegal Request [current] [ 507.544788][ C1] sd 0:0:1:0: [sg_rq_end_io] Add. Sense: Invalid command operation code 09:54:04 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x9, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000e80)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) io_uring_enter(r1, 0x0, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x50}}], 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {}, {}, 0x0, 0x0, 0xa, 0x8}, [@algo_auth={0x58, 0x1, {{'md5\x00'}, 0x80, "f959fb7b2a535a87359f0b633f54f881"}}]}, 0x148}}, 0x0) 09:54:04 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x6, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7000000}) 09:54:04 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}}}, 0xf0}}, 0x0) 09:54:04 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="5500000010007f083ffe15b282a380930a03000248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) 09:54:05 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x6, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9000000}) [ 507.731313][T26514] netlink: 224 bytes leftover after parsing attributes in process `syz-executor.4'. [ 507.749592][T26516] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=119 sclass=netlink_route_socket pid=26516 comm=syz-executor.5 [ 507.764016][ C1] sd 0:0:1:0: [sg_rq_end_io] Sense Key : Illegal Request [current] [ 507.772138][ C1] sd 0:0:1:0: [sg_rq_end_io] Add. Sense: Invalid command operation code [ 507.813994][T26523] loop2: detected capacity change from 0 to 16383 [ 507.856041][ T5592] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 507.861369][ T5592] loop2: p1 size 11290111 extends beyond EOD, truncated [ 507.869276][ T5592] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 507.877208][ T5592] loop2: p5 size 11290111 extends beyond EOD, truncated [ 507.884501][ T5592] loop2: p6 size 1912633224 extends beyond EOD, truncated [ 507.894655][T26523] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 507.899964][T26523] loop2: p1 size 11290111 extends beyond EOD, truncated [ 507.908023][T26523] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 507.915852][T26523] loop2: p5 size 11290111 extends beyond EOD, truncated [ 507.923305][T26523] loop2: p6 size 1912633224 extends beyond EOD, truncated [ 507.963628][T26527] netlink: 224 bytes leftover after parsing attributes in process `syz-executor.4'. [ 507.981102][ C1] sd 0:0:1:0: [sg_rq_end_io] Sense Key : Illegal Request [current] [ 507.989117][ C1] sd 0:0:1:0: [sg_rq_end_io] Add. Sense: Invalid command operation code [ 508.068009][T26523] loop2: detected capacity change from 0 to 16383 09:54:05 executing program 2: syz_read_part_table(0x0, 0x2, &(0x7f0000000100)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0000ffffff85000000060000000000024000ffffff82000005e100000088770072003007000f00000000000000008000da55aa", 0x40, 0x1c0}, {0x0, 0x0, 0xfffffffffffffffb}]) 09:54:05 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="5500000011007f083ffe15b282a380930a03000248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) 09:54:05 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x9, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000e80)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) io_uring_enter(r1, 0x0, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x50}}], 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {}, {}, 0x0, 0x0, 0xa, 0x9}, [@algo_auth={0x58, 0x1, {{'md5\x00'}, 0x80, "f959fb7b2a535a87359f0b633f54f881"}}]}, 0x148}}, 0x0) 09:54:05 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) mkdirat(r1, &(0x7f00000000c0)='./file0\x00', 0x0) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r3 = syz_io_uring_setup(0x3ede, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000140)) io_uring_enter(r3, 0x2ff, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x5, 0x0, &(0x7f0000000040)=""/18, 0xffffffde}, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, &(0x7f0000000dc0)=[{&(0x7f0000000100)="f4a4848461fb0592d2f8db4c1f3c9e408788e03d28fe5e69dbceea46dd67888cdedd07a068040b956c3af7", 0x2b}, {0x0}, {0x0}], 0x3, &(0x7f0000000540)=ANY=[@ANYBLOB="1400000000000000", @ANYRES32], 0x50}}, {{0x0, 0x0, &(0x7f0000003180)=[{0x0}, {0x0}], 0x2, &(0x7f00000002c0)=ANY=[@ANYBLOB="c9252cdfb191d94ef15953a086ed40b24a018fb18d39f9a1256b33cf339f1d1bb52846ddaaaecd492eb1d0774b26968a44bf794e9d902a3c02af9543bc4096ac7a27", @ANYRES32, @ANYRES32=0x0], 0x50, 0x4041}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYRESDEC, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000003000000000000000010000000100", @ANYRES32, @ANYRES64, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESDEC=r4], 0xd0, 0x20000000}}], 0x3, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x138, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {0x0, 0x8000000000000000}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x48, 0x1, {{'md5\x00'}}}]}, 0x138}}, 0x0) 09:54:05 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}}}, 0xf0}}, 0x0) 09:54:05 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x6, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd000000}) [ 508.113764][T26523] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 508.119071][T26523] loop2: p1 size 11290111 extends beyond EOD, truncated [ 508.126788][T26523] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 508.134510][T26523] loop2: p5 size 11290111 extends beyond EOD, truncated [ 508.141900][T26523] loop2: p6 size 1912633224 extends beyond EOD, truncated 09:54:05 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="5500000012007f083ffe15b282a380930a03000248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) 09:54:05 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x9, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000e80)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) io_uring_enter(r1, 0x0, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x50}}], 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {}, {}, 0x0, 0x0, 0xa, 0xa}, [@algo_auth={0x58, 0x1, {{'md5\x00'}, 0x80, "f959fb7b2a535a87359f0b633f54f881"}}]}, 0x148}}, 0x0) 09:54:05 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xf0}}, 0x0) 09:54:05 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x6, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe000000}) 09:54:05 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) mkdirat(r1, &(0x7f00000000c0)='./file0\x00', 0x0) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r3 = syz_io_uring_setup(0x3ede, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000140)) io_uring_enter(r3, 0x2ff, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x5, 0x0, &(0x7f0000000040)=""/18, 0xffffffde}, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, &(0x7f0000000dc0)=[{&(0x7f0000000100)="f4a4848461fb0592d2f8db4c1f3c9e408788e03d28fe5e69dbceea46dd67888cdedd07a068040b956c3af7", 0x2b}, {0x0}, {0x0}], 0x3, &(0x7f0000000540)=ANY=[@ANYBLOB="1400000000000000", @ANYRES32], 0x50}}, {{0x0, 0x0, &(0x7f0000003180)=[{0x0}, {0x0}], 0x2, &(0x7f00000002c0)=ANY=[@ANYBLOB="c9252cdfb191d94ef15953a086ed40b24a018fb18d39f9a1256b33cf339f1d1bb52846ddaaaecd492eb1d0774b26968a44bf794e9d902a3c02af9543bc4096ac7a27", @ANYRES32, @ANYRES32=0x0], 0x50, 0x4041}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYRESDEC, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000003000000000000000010000000100", @ANYRES32, @ANYRES64, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESDEC=r4], 0xd0, 0x20000000}}], 0x3, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x138, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {0x0, 0x9effffff00000000}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x48, 0x1, {{'md5\x00'}}}]}, 0x138}}, 0x0) [ 508.204475][T26539] netlink: 224 bytes leftover after parsing attributes in process `syz-executor.4'. [ 508.218965][ C1] sd 0:0:1:0: [sg_rq_end_io] Sense Key : Illegal Request [current] [ 508.226982][ C1] sd 0:0:1:0: [sg_rq_end_io] Add. Sense: Invalid command operation code 09:54:05 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb}}}, 0xf0}}, 0x0) [ 508.390710][ C1] sd 0:0:1:0: [sg_rq_end_io] Sense Key : Illegal Request [current] [ 508.398744][ C1] sd 0:0:1:0: [sg_rq_end_io] Add. Sense: Invalid command operation code [ 508.500089][T26560] loop2: detected capacity change from 0 to 16383 [ 508.556618][T26560] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 508.561900][T26560] loop2: p1 size 11290111 extends beyond EOD, truncated [ 508.569572][T26560] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 508.577508][T26560] loop2: p5 size 11290111 extends beyond EOD, truncated [ 508.584782][T26560] loop2: p6 size 1912633224 extends beyond EOD, truncated [ 508.688301][T26560] loop2: detected capacity change from 0 to 16383 [ 508.731766][T26560] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 508.737007][T26560] loop2: p1 size 11290111 extends beyond EOD, truncated [ 508.744844][T26560] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 508.752778][T26560] loop2: p5 size 11290111 extends beyond EOD, truncated [ 508.760002][T26560] loop2: p6 size 1912633224 extends beyond EOD, truncated 09:54:06 executing program 2: syz_read_part_table(0x0, 0x2, &(0x7f0000000100)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0000ffffff85000000060000000000024000ffffff82000006e100000088770072003007000f00000000000000008000da55aa", 0x40, 0x1c0}, {0x0, 0x0, 0xfffffffffffffffb}]) 09:54:06 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="5500000013007f083ffe15b282a380930a03000248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) 09:54:06 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x9, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000e80)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) io_uring_enter(r1, 0x0, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x50}}], 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {}, {}, 0x0, 0x0, 0xa, 0xb}, [@algo_auth={0x58, 0x1, {{'md5\x00'}, 0x80, "f959fb7b2a535a87359f0b633f54f881"}}]}, 0x148}}, 0x0) 09:54:06 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc}}}, 0xf0}}, 0x0) 09:54:06 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) mkdirat(r1, &(0x7f00000000c0)='./file0\x00', 0x0) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r3 = syz_io_uring_setup(0x3ede, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000140)) io_uring_enter(r3, 0x2ff, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x5, 0x0, &(0x7f0000000040)=""/18, 0xffffffde}, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, &(0x7f0000000dc0)=[{&(0x7f0000000100)="f4a4848461fb0592d2f8db4c1f3c9e408788e03d28fe5e69dbceea46dd67888cdedd07a068040b956c3af7", 0x2b}, {0x0}, {0x0}], 0x3, &(0x7f0000000540)=ANY=[@ANYBLOB="1400000000000000", @ANYRES32], 0x50}}, {{0x0, 0x0, &(0x7f0000003180)=[{0x0}, {0x0}], 0x2, &(0x7f00000002c0)=ANY=[@ANYBLOB="c9252cdfb191d94ef15953a086ed40b24a018fb18d39f9a1256b33cf339f1d1bb52846ddaaaecd492eb1d0774b26968a44bf794e9d902a3c02af9543bc4096ac7a27", @ANYRES32, @ANYRES32=0x0], 0x50, 0x4041}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYRESDEC, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000003000000000000000010000000100", @ANYRES32, @ANYRES64, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESDEC=r4], 0xd0, 0x20000000}}], 0x3, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x138, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {0x0, 0xb002000000000000}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x48, 0x1, {{'md5\x00'}}}]}, 0x138}}, 0x0) 09:54:06 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x6, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffff}) 09:54:06 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd}}}, 0xf0}}, 0x0) 09:54:06 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x9, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000e80)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) io_uring_enter(r1, 0x0, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x50}}], 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {}, {}, 0x0, 0x0, 0xa, 0x10}, [@algo_auth={0x58, 0x1, {{'md5\x00'}, 0x80, "f959fb7b2a535a87359f0b633f54f881"}}]}, 0x148}}, 0x0) 09:54:06 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="5500000014007f083ffe15b282a380930a03000248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) 09:54:06 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) mkdirat(r1, &(0x7f00000000c0)='./file0\x00', 0x0) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r3 = syz_io_uring_setup(0x3ede, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000140)) io_uring_enter(r3, 0x2ff, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x5, 0x0, &(0x7f0000000040)=""/18, 0xffffffde}, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, &(0x7f0000000dc0)=[{&(0x7f0000000100)="f4a4848461fb0592d2f8db4c1f3c9e408788e03d28fe5e69dbceea46dd67888cdedd07a068040b956c3af7", 0x2b}, {0x0}, {0x0}], 0x3, &(0x7f0000000540)=ANY=[@ANYBLOB="1400000000000000", @ANYRES32], 0x50}}, {{0x0, 0x0, &(0x7f0000003180)=[{0x0}, {0x0}], 0x2, &(0x7f00000002c0)=ANY=[@ANYBLOB="c9252cdfb191d94ef15953a086ed40b24a018fb18d39f9a1256b33cf339f1d1bb52846ddaaaecd492eb1d0774b26968a44bf794e9d902a3c02af9543bc4096ac7a27", @ANYRES32, @ANYRES32=0x0], 0x50, 0x4041}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYRESDEC, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000003000000000000000010000000100", @ANYRES32, @ANYRES64, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESDEC=r4], 0xd0, 0x20000000}}], 0x3, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x138, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {0x0, 0xeaffffff00000000}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x48, 0x1, {{'md5\x00'}}}]}, 0x138}}, 0x0) 09:54:06 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x6, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000000}) [ 508.870664][ C1] sd 0:0:1:0: [sg_rq_end_io] Sense Key : Illegal Request [current] [ 508.878697][ C1] sd 0:0:1:0: [sg_rq_end_io] Add. Sense: Invalid command operation code 09:54:06 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe}}}, 0xf0}}, 0x0) [ 509.130574][ C1] scsi_io_completion_action: 14 callbacks suppressed [ 509.130610][ C1] sd 0:0:1:0: tag#6048 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 509.147152][ C1] sd 0:0:1:0: tag#6048 CDB: opcode=0xe5 (vendor) [ 509.153497][ C1] sd 0:0:1:0: tag#6048 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 509.162540][ C1] sd 0:0:1:0: tag#6048 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 509.171564][ C1] sd 0:0:1:0: tag#6048 CDB[20]: ba [ 509.180446][ C1] sd 0:0:1:0: [sg_rq_end_io] Sense Key : Illegal Request [current] [ 509.188502][ C1] sd 0:0:1:0: [sg_rq_end_io] Add. Sense: Invalid command operation code [ 509.205418][ C1] sd 0:0:1:0: tag#6056 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 509.215251][ C1] sd 0:0:1:0: tag#6056 CDB: opcode=0xe5 (vendor) [ 509.221593][ C1] sd 0:0:1:0: tag#6056 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 509.230617][ C1] sd 0:0:1:0: tag#6056 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 509.239647][ C1] sd 0:0:1:0: tag#6056 CDB[20]: ba [ 509.365873][T26589] loop2: detected capacity change from 0 to 16383 [ 509.415072][T26589] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 509.420321][T26589] loop2: p1 size 11290111 extends beyond EOD, truncated [ 509.428061][T26589] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 509.435955][T26589] loop2: p5 size 11290111 extends beyond EOD, truncated [ 509.443344][T26589] loop2: p6 size 1912633224 extends beyond EOD, truncated [ 509.594873][T26589] loop2: detected capacity change from 0 to 16383 09:54:06 executing program 2: syz_read_part_table(0x0, 0x2, &(0x7f0000000100)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0000ffffff85000000060000000000024000ffffff82000007e100000088770072003007000f00000000000000008000da55aa", 0x40, 0x1c0}, {0x0, 0x0, 0xfffffffffffffffb}]) 09:54:06 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="5500000015007f083ffe15b282a380930a03000248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) 09:54:06 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x9, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000e80)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) io_uring_enter(r1, 0x0, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x50}}], 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {}, {}, 0x0, 0x0, 0xa, 0x11}, [@algo_auth={0x58, 0x1, {{'md5\x00'}, 0x80, "f959fb7b2a535a87359f0b633f54f881"}}]}, 0x148}}, 0x0) 09:54:06 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x6, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18000000}) 09:54:06 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) mkdirat(r1, &(0x7f00000000c0)='./file0\x00', 0x0) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r3 = syz_io_uring_setup(0x3ede, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000140)) io_uring_enter(r3, 0x2ff, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x5, 0x0, &(0x7f0000000040)=""/18, 0xffffffde}, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, &(0x7f0000000dc0)=[{&(0x7f0000000100)="f4a4848461fb0592d2f8db4c1f3c9e408788e03d28fe5e69dbceea46dd67888cdedd07a068040b956c3af7", 0x2b}, {0x0}, {0x0}], 0x3, &(0x7f0000000540)=ANY=[@ANYBLOB="1400000000000000", @ANYRES32], 0x50}}, {{0x0, 0x0, &(0x7f0000003180)=[{0x0}, {0x0}], 0x2, &(0x7f00000002c0)=ANY=[@ANYBLOB="c9252cdfb191d94ef15953a086ed40b24a018fb18d39f9a1256b33cf339f1d1bb52846ddaaaecd492eb1d0774b26968a44bf794e9d902a3c02af9543bc4096ac7a27", @ANYRES32, @ANYRES32=0x0], 0x50, 0x4041}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYRESDEC, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000003000000000000000010000000100", @ANYRES32, @ANYRES64, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESDEC=r4], 0xd0, 0x20000000}}], 0x3, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x138, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {0x0, 0xefffffff00000000}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x48, 0x1, {{'md5\x00'}}}]}, 0x138}}, 0x0) 09:54:06 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10}}}, 0xf0}}, 0x0) [ 509.638681][T26589] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 509.643979][T26589] loop2: p1 size 11290111 extends beyond EOD, truncated [ 509.651616][T26589] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 509.659415][T26589] loop2: p5 size 11290111 extends beyond EOD, truncated [ 509.666617][T26589] loop2: p6 size 1912633224 extends beyond EOD, truncated 09:54:06 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x9, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000e80)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) io_uring_enter(r1, 0x0, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x50}}], 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {}, {}, 0x0, 0x0, 0xa, 0x14}, [@algo_auth={0x58, 0x1, {{'md5\x00'}, 0x80, "f959fb7b2a535a87359f0b633f54f881"}}]}, 0x148}}, 0x0) 09:54:06 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x11}}}, 0xf0}}, 0x0) 09:54:06 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="5500000016007f083ffe15b282a380930a03000248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) [ 509.724122][ C1] sd 0:0:1:0: tag#6075 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 509.733973][ C1] sd 0:0:1:0: tag#6075 CDB: opcode=0xe5 (vendor) [ 509.740335][ C1] sd 0:0:1:0: tag#6075 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 509.749371][ C1] sd 0:0:1:0: tag#6075 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 509.758417][ C1] sd 0:0:1:0: tag#6075 CDB[20]: ba [ 509.763701][ C1] sd 0:0:1:0: [sg_rq_end_io] Sense Key : Illegal Request [current] [ 509.771693][ C1] sd 0:0:1:0: [sg_rq_end_io] Add. Sense: Invalid command operation code [ 509.789020][ C1] sd 0:0:1:0: tag#6079 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 509.798876][ C1] sd 0:0:1:0: tag#6079 CDB: opcode=0xe5 (vendor) [ 509.805231][ C1] sd 0:0:1:0: tag#6079 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 509.814246][ C1] sd 0:0:1:0: tag#6079 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d 09:54:06 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x6, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1d2b0000}) 09:54:06 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) mkdirat(r1, &(0x7f00000000c0)='./file0\x00', 0x0) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r3 = syz_io_uring_setup(0x3ede, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000140)) io_uring_enter(r3, 0x2ff, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x5, 0x0, &(0x7f0000000040)=""/18, 0xffffffde}, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, &(0x7f0000000dc0)=[{&(0x7f0000000100)="f4a4848461fb0592d2f8db4c1f3c9e408788e03d28fe5e69dbceea46dd67888cdedd07a068040b956c3af7", 0x2b}, {0x0}, {0x0}], 0x3, &(0x7f0000000540)=ANY=[@ANYBLOB="1400000000000000", @ANYRES32], 0x50}}, {{0x0, 0x0, &(0x7f0000003180)=[{0x0}, {0x0}], 0x2, &(0x7f00000002c0)=ANY=[@ANYBLOB="c9252cdfb191d94ef15953a086ed40b24a018fb18d39f9a1256b33cf339f1d1bb52846ddaaaecd492eb1d0774b26968a44bf794e9d902a3c02af9543bc4096ac7a27", @ANYRES32, @ANYRES32=0x0], 0x50, 0x4041}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYRESDEC, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000003000000000000000010000000100", @ANYRES32, @ANYRES64, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESDEC=r4], 0xd0, 0x20000000}}], 0x3, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x138, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {0x0, 0xf0ffffff00000000}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x48, 0x1, {{'md5\x00'}}}]}, 0x138}}, 0x0) [ 509.823237][ C1] sd 0:0:1:0: tag#6079 CDB[20]: ba 09:54:07 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x12}}}, 0xf0}}, 0x0) [ 509.979634][ C1] sd 0:0:1:0: [sg_rq_end_io] Sense Key : Illegal Request [current] [ 509.980400][ C0] sd 0:0:1:0: tag#6022 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 509.987651][ C1] sd 0:0:1:0: [sg_rq_end_io] Add. Sense: Invalid command operation code [ 509.997433][ C0] sd 0:0:1:0: tag#6022 CDB: opcode=0xe5 (vendor) [ 510.006441][ C1] sd 0:0:1:0: [sg_rq_end_io] Sense Key : Illegal Request [current] [ 510.012062][ C0] sd 0:0:1:0: tag#6022 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 510.020043][ C1] sd 0:0:1:0: [sg_rq_end_io] Add. Sense: Invalid command operation code [ 510.029043][ C0] sd 0:0:1:0: tag#6022 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 510.046367][ C0] sd 0:0:1:0: tag#6022 CDB[20]: ba [ 510.142107][T26619] loop2: detected capacity change from 0 to 16383 [ 510.185266][T26619] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 510.190586][T26619] loop2: p1 size 11290111 extends beyond EOD, truncated [ 510.198979][T26619] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 510.206992][T26619] loop2: p5 size 11290111 extends beyond EOD, truncated [ 510.214301][T26619] loop2: p6 size 1912633224 extends beyond EOD, truncated [ 510.345095][T26619] loop2: detected capacity change from 0 to 16383 [ 510.391162][ T5592] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 510.396529][ T5592] loop2: p1 size 11290111 extends beyond EOD, truncated [ 510.404418][ T5592] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 510.412374][ T5592] loop2: p5 size 11290111 extends beyond EOD, truncated [ 510.419617][ T5592] loop2: p6 size 1912633224 extends beyond EOD, truncated [ 510.429363][T26619] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 510.434664][T26619] loop2: p1 size 11290111 extends beyond EOD, truncated 09:54:07 executing program 2: syz_read_part_table(0x0, 0x2, &(0x7f0000000100)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0000ffffff85000000060000000000024000ffffff82000008e100000088770072003007000f00000000000000008000da55aa", 0x40, 0x1c0}, {0x0, 0x0, 0xfffffffffffffffb}]) 09:54:07 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="5500000029007f083ffe15b282a380930a03000248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) 09:54:07 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x9, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000e80)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) io_uring_enter(r1, 0x0, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x50}}], 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x58, 0x1, {{'md5\x00'}, 0x80, "f959fb7b2a535a87359f0b633f54f881"}}]}, 0x148}}, 0x0) 09:54:07 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x6, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40000000}) 09:54:07 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) mkdirat(r1, &(0x7f00000000c0)='./file0\x00', 0x0) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r3 = syz_io_uring_setup(0x3ede, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000140)) io_uring_enter(r3, 0x2ff, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x5, 0x0, &(0x7f0000000040)=""/18, 0xffffffde}, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, &(0x7f0000000dc0)=[{&(0x7f0000000100)="f4a4848461fb0592d2f8db4c1f3c9e408788e03d28fe5e69dbceea46dd67888cdedd07a068040b956c3af7", 0x2b}, {0x0}, {0x0}], 0x3, &(0x7f0000000540)=ANY=[@ANYBLOB="1400000000000000", @ANYRES32], 0x50}}, {{0x0, 0x0, &(0x7f0000003180)=[{0x0}, {0x0}], 0x2, &(0x7f00000002c0)=ANY=[@ANYBLOB="c9252cdfb191d94ef15953a086ed40b24a018fb18d39f9a1256b33cf339f1d1bb52846ddaaaecd492eb1d0774b26968a44bf794e9d902a3c02af9543bc4096ac7a27", @ANYRES32, @ANYRES32=0x0], 0x50, 0x4041}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYRESDEC, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000003000000000000000010000000100", @ANYRES32, @ANYRES64, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESDEC=r4], 0xd0, 0x20000000}}], 0x3, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x138, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {0x0, 0xfcffffff00000000}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x48, 0x1, {{'md5\x00'}}}]}, 0x138}}, 0x0) 09:54:07 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x25}}}, 0xf0}}, 0x0) [ 510.442193][T26619] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 510.449983][T26619] loop2: p5 size 11290111 extends beyond EOD, truncated [ 510.457307][T26619] loop2: p6 size 1912633224 extends beyond EOD, truncated [ 510.540669][ C1] sd 0:0:1:0: [sg_rq_end_io] Sense Key : Illegal Request [current] [ 510.546475][ C0] sd 0:0:1:0: tag#6042 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 510.548712][ C1] sd 0:0:1:0: [sg_rq_end_io] Add. Sense: Invalid command operation code [ 510.558476][ C0] sd 0:0:1:0: tag#6042 CDB: opcode=0xe5 (vendor) [ 510.573097][ C0] sd 0:0:1:0: tag#6042 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c 09:54:07 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x6, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf5ffffff}) 09:54:07 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="5500000077007f083ffe15b282a380930a03000248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) 09:54:07 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x9, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000e80)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) io_uring_enter(r1, 0x0, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x50}}], 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {}, {}, 0x0, 0x0, 0xa, 0x0, 0x2}, [@algo_auth={0x58, 0x1, {{'md5\x00'}, 0x80, "f959fb7b2a535a87359f0b633f54f881"}}]}, 0x148}}, 0x0) 09:54:07 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x33}}}, 0xf0}}, 0x0) 09:54:07 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) mkdirat(r1, &(0x7f00000000c0)='./file0\x00', 0x0) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r3 = syz_io_uring_setup(0x3ede, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000140)) io_uring_enter(r3, 0x2ff, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x5, 0x0, &(0x7f0000000040)=""/18, 0xffffffde}, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, &(0x7f0000000dc0)=[{&(0x7f0000000100)="f4a4848461fb0592d2f8db4c1f3c9e408788e03d28fe5e69dbceea46dd67888cdedd07a068040b956c3af7", 0x2b}, {0x0}, {0x0}], 0x3, &(0x7f0000000540)=ANY=[@ANYBLOB="1400000000000000", @ANYRES32], 0x50}}, {{0x0, 0x0, &(0x7f0000003180)=[{0x0}, {0x0}], 0x2, &(0x7f00000002c0)=ANY=[@ANYBLOB="c9252cdfb191d94ef15953a086ed40b24a018fb18d39f9a1256b33cf339f1d1bb52846ddaaaecd492eb1d0774b26968a44bf794e9d902a3c02af9543bc4096ac7a27", @ANYRES32, @ANYRES32=0x0], 0x50, 0x4041}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYRESDEC, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000003000000000000000010000000100", @ANYRES32, @ANYRES64, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESDEC=r4], 0xd0, 0x20000000}}], 0x3, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x138, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {0x0, 0xfeffffff00000000}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x48, 0x1, {{'md5\x00'}}}]}, 0x138}}, 0x0) [ 510.582131][ C0] sd 0:0:1:0: tag#6042 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 510.591174][ C0] sd 0:0:1:0: tag#6042 CDB[20]: ba 09:54:07 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x6, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfbffffff}) [ 510.769216][ C1] sd 0:0:1:0: [sg_rq_end_io] Sense Key : Illegal Request [current] [ 510.777228][ C1] sd 0:0:1:0: [sg_rq_end_io] Add. Sense: Invalid command operation code [ 510.790794][T26640] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=119 sclass=netlink_route_socket pid=26640 comm=syz-executor.5 [ 510.815120][ C0] sd 0:0:1:0: tag#6078 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 510.824955][ C0] sd 0:0:1:0: tag#6078 CDB: opcode=0xe5 (vendor) [ 510.831304][ C0] sd 0:0:1:0: tag#6078 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 510.840333][ C0] sd 0:0:1:0: tag#6078 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 510.849364][ C0] sd 0:0:1:0: tag#6078 CDB[20]: ba [ 510.861638][ C0] sd 0:0:1:0: tag#6035 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 510.871455][ C0] sd 0:0:1:0: tag#6035 CDB: opcode=0xe5 (vendor) [ 510.877783][ C0] sd 0:0:1:0: tag#6035 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 510.886807][ C0] sd 0:0:1:0: tag#6035 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 510.895813][ C0] sd 0:0:1:0: tag#6035 CDB[20]: ba [ 510.957868][T26650] loop2: detected capacity change from 0 to 16383 [ 510.973466][ C1] sd 0:0:1:0: [sg_rq_end_io] Sense Key : Illegal Request [current] [ 510.981458][ C1] sd 0:0:1:0: [sg_rq_end_io] Add. Sense: Invalid command operation code [ 511.009475][ T5592] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 511.014787][ T5592] loop2: p1 size 11290111 extends beyond EOD, truncated [ 511.022539][ T5592] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 511.030401][ T5592] loop2: p5 size 11290111 extends beyond EOD, truncated [ 511.037688][ T5592] loop2: p6 size 1912633224 extends beyond EOD, truncated [ 511.048287][T26650] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 511.053569][T26650] loop2: p1 size 11290111 extends beyond EOD, truncated [ 511.061450][T26650] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 511.069203][T26650] loop2: p5 size 11290111 extends beyond EOD, truncated [ 511.076460][T26650] loop2: p6 size 1912633224 extends beyond EOD, truncated [ 511.170630][T26650] loop2: detected capacity change from 0 to 16383 09:54:08 executing program 2: syz_read_part_table(0x0, 0x2, &(0x7f0000000100)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0000ffffff85000000060000000000024000ffffff8200000ae100000088770072003007000f00000000000000008000da55aa", 0x40, 0x1c0}, {0x0, 0x0, 0xfffffffffffffffb}]) 09:54:08 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48}}}, 0xf0}}, 0x0) 09:54:08 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="5500000018027f083ffe15b282a380930a03000248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) 09:54:08 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x9, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000e80)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) io_uring_enter(r1, 0x0, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x50}}], 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {}, {}, 0x0, 0x0, 0xa, 0x0, 0x3}, [@algo_auth={0x58, 0x1, {{'md5\x00'}, 0x80, "f959fb7b2a535a87359f0b633f54f881"}}]}, 0x148}}, 0x0) 09:54:08 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x6, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdfdffff}) 09:54:08 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) mkdirat(r1, &(0x7f00000000c0)='./file0\x00', 0x0) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r3 = syz_io_uring_setup(0x3ede, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000140)) io_uring_enter(r3, 0x2ff, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x5, 0x0, &(0x7f0000000040)=""/18, 0xffffffde}, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, &(0x7f0000000dc0)=[{&(0x7f0000000100)="f4a4848461fb0592d2f8db4c1f3c9e408788e03d28fe5e69dbceea46dd67888cdedd07a068040b956c3af7", 0x2b}, {0x0}, {0x0}], 0x3, &(0x7f0000000540)=ANY=[@ANYBLOB="1400000000000000", @ANYRES32], 0x50}}, {{0x0, 0x0, &(0x7f0000003180)=[{0x0}, {0x0}], 0x2, &(0x7f00000002c0)=ANY=[@ANYBLOB="c9252cdfb191d94ef15953a086ed40b24a018fb18d39f9a1256b33cf339f1d1bb52846ddaaaecd492eb1d0774b26968a44bf794e9d902a3c02af9543bc4096ac7a27", @ANYRES32, @ANYRES32=0x0], 0x50, 0x4041}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYRESDEC, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000003000000000000000010000000100", @ANYRES32, @ANYRES64, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESDEC=r4], 0xd0, 0x20000000}}], 0x3, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x138, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {0x0, 0xffffff7f00000000}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x48, 0x1, {{'md5\x00'}}}]}, 0x138}}, 0x0) [ 511.246551][T26650] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 511.251794][T26650] loop2: p1 size 11290111 extends beyond EOD, truncated [ 511.259533][T26650] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 511.267218][T26650] loop2: p5 size 11290111 extends beyond EOD, truncated [ 511.274547][T26650] loop2: p6 size 1912633224 extends beyond EOD, truncated 09:54:08 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4c}}}, 0xf0}}, 0x0) 09:54:08 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="5500000018037f083ffe15b282a380930a03000248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) [ 511.337363][T26659] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=536 sclass=netlink_route_socket pid=26659 comm=syz-executor.5 [ 511.347215][ C1] sd 0:0:1:0: [sg_rq_end_io] Sense Key : Illegal Request [current] [ 511.358296][ C1] sd 0:0:1:0: [sg_rq_end_io] Add. Sense: Invalid command operation code [ 511.374270][ C0] sd 0:0:1:0: tag#6067 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s 09:54:08 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x6, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfeffffff}) 09:54:08 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x9, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000e80)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) io_uring_enter(r1, 0x0, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x50}}], 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {}, {}, 0x0, 0x0, 0xa, 0x0, 0x4}, [@algo_auth={0x58, 0x1, {{'md5\x00'}, 0x80, "f959fb7b2a535a87359f0b633f54f881"}}]}, 0x148}}, 0x0) 09:54:08 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) mkdirat(r1, &(0x7f00000000c0)='./file0\x00', 0x0) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r3 = syz_io_uring_setup(0x3ede, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000140)) io_uring_enter(r3, 0x2ff, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x5, 0x0, &(0x7f0000000040)=""/18, 0xffffffde}, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, &(0x7f0000000dc0)=[{&(0x7f0000000100)="f4a4848461fb0592d2f8db4c1f3c9e408788e03d28fe5e69dbceea46dd67888cdedd07a068040b956c3af7", 0x2b}, {0x0}, {0x0}], 0x3, &(0x7f0000000540)=ANY=[@ANYBLOB="1400000000000000", @ANYRES32], 0x50}}, {{0x0, 0x0, &(0x7f0000003180)=[{0x0}, {0x0}], 0x2, &(0x7f00000002c0)=ANY=[@ANYBLOB="c9252cdfb191d94ef15953a086ed40b24a018fb18d39f9a1256b33cf339f1d1bb52846ddaaaecd492eb1d0774b26968a44bf794e9d902a3c02af9543bc4096ac7a27", @ANYRES32, @ANYRES32=0x0], 0x50, 0x4041}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYRESDEC, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000003000000000000000010000000100", @ANYRES32, @ANYRES64, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESDEC=r4], 0xd0, 0x20000000}}], 0x3, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x138, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {0x0, 0xffffffff00000000}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x48, 0x1, {{'md5\x00'}}}]}, 0x138}}, 0x0) [ 511.384103][ C0] sd 0:0:1:0: tag#6067 CDB: opcode=0xe5 (vendor) [ 511.390436][ C0] sd 0:0:1:0: tag#6067 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 511.399475][ C0] sd 0:0:1:0: tag#6067 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 511.408529][ C0] sd 0:0:1:0: tag#6067 CDB[20]: ba 09:54:08 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x60}}}, 0xf0}}, 0x0) [ 511.563399][T26669] __nla_validate_parse: 15 callbacks suppressed [ 511.563476][T26669] netlink: 224 bytes leftover after parsing attributes in process `syz-executor.4'. [ 511.563585][T26670] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=792 sclass=netlink_route_socket pid=26670 comm=syz-executor.5 [ 511.619401][ C1] sd 0:0:1:0: [sg_rq_end_io] Sense Key : Illegal Request [current] [ 511.627393][ C1] sd 0:0:1:0: [sg_rq_end_io] Add. Sense: Invalid command operation code [ 511.660024][ C0] sd 0:0:1:0: tag#6035 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 511.669879][ C0] sd 0:0:1:0: tag#6035 CDB: opcode=0xe5 (vendor) [ 511.676202][ C0] sd 0:0:1:0: tag#6035 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 511.685209][ C0] sd 0:0:1:0: tag#6035 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 511.694229][ C0] sd 0:0:1:0: tag#6035 CDB[20]: ba [ 511.746282][T26680] netlink: 224 bytes leftover after parsing attributes in process `syz-executor.4'. [ 511.746651][T26681] loop2: detected capacity change from 0 to 16383 [ 511.823929][T26681] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 511.829212][T26681] loop2: p1 size 11290111 extends beyond EOD, truncated [ 511.836876][T26681] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 511.844769][T26681] loop2: p5 size 11290111 extends beyond EOD, truncated [ 511.852069][T26681] loop2: p6 size 1912633224 extends beyond EOD, truncated [ 511.943130][T26681] loop2: detected capacity change from 0 to 16383 [ 511.989985][T26681] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 511.995349][T26681] loop2: p1 size 11290111 extends beyond EOD, truncated [ 512.002995][T26681] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 512.010786][T26681] loop2: p5 size 11290111 extends beyond EOD, truncated [ 512.018082][T26681] loop2: p6 size 1912633224 extends beyond EOD, truncated 09:54:09 executing program 2: syz_read_part_table(0x0, 0x2, &(0x7f0000000100)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0000ffffff85000000060000000000024000ffffff8200000be100000088770072003007000f00000000000000008000da55aa", 0x40, 0x1c0}, {0x0, 0x0, 0xfffffffffffffffb}]) 09:54:09 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="5500000018047f083ffe15b282a380930a03000248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) 09:54:09 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x6, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffdfd}) 09:54:09 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x9, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000e80)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) io_uring_enter(r1, 0x0, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x50}}], 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {}, {}, 0x0, 0x0, 0xa, 0x0, 0x5}, [@algo_auth={0x58, 0x1, {{'md5\x00'}, 0x80, "f959fb7b2a535a87359f0b633f54f881"}}]}, 0x148}}, 0x0) 09:54:09 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) mkdirat(r1, &(0x7f00000000c0)='./file0\x00', 0x0) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r3 = syz_io_uring_setup(0x3ede, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000140)) io_uring_enter(r3, 0x2ff, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x5, 0x0, &(0x7f0000000040)=""/18, 0xffffffde}, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, &(0x7f0000000dc0)=[{&(0x7f0000000100)="f4a4848461fb0592d2f8db4c1f3c9e408788e03d28fe5e69dbceea46dd67888cdedd07a068040b956c3af7", 0x2b}, {0x0}, {0x0}], 0x3, &(0x7f0000000540)=ANY=[@ANYBLOB="1400000000000000", @ANYRES32], 0x50}}, {{0x0, 0x0, &(0x7f0000003180)=[{0x0}, {0x0}], 0x2, &(0x7f00000002c0)=ANY=[@ANYBLOB="c9252cdfb191d94ef15953a086ed40b24a018fb18d39f9a1256b33cf339f1d1bb52846ddaaaecd492eb1d0774b26968a44bf794e9d902a3c02af9543bc4096ac7a27", @ANYRES32, @ANYRES32=0x0], 0x50, 0x4041}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYRESDEC, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000003000000000000000010000000100", @ANYRES32, @ANYRES64, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESDEC=r4], 0xd0, 0x20000000}}], 0x3, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x138, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {0x0, 0xffffffffffffffff}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x48, 0x1, {{'md5\x00'}}}]}, 0x138}}, 0x0) 09:54:09 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68}}}, 0xf0}}, 0x0) [ 512.094509][ T383] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 512.099820][ T383] loop2: p1 size 11290111 extends beyond EOD, truncated [ 512.107575][ T383] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 512.115346][ T383] loop2: p5 size 11290111 extends beyond EOD, truncated [ 512.124372][ T383] loop2: p6 size 1912633224 extends beyond EOD, truncated 09:54:09 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6c}}}, 0xf0}}, 0x0) [ 512.147270][T26687] netlink: 224 bytes leftover after parsing attributes in process `syz-executor.4'. [ 512.171305][T26692] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=1048 sclass=netlink_route_socket pid=26692 comm=syz-executor.5 [ 512.180783][ C1] sd 0:0:1:0: [sg_rq_end_io] Sense Key : Illegal Request [current] 09:54:09 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) mkdirat(r1, &(0x7f00000000c0)='./file0\x00', 0x0) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r3 = syz_io_uring_setup(0x3ede, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000140)) io_uring_enter(r3, 0x2ff, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x5, 0x0, &(0x7f0000000040)=""/18, 0xffffffde}, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, &(0x7f0000000dc0)=[{&(0x7f0000000100)="f4a4848461fb0592d2f8db4c1f3c9e408788e03d28fe5e69dbceea46dd67888cdedd07a068040b956c3af7", 0x2b}, {0x0}, {0x0}], 0x3, &(0x7f0000000540)=ANY=[@ANYBLOB="1400000000000000", @ANYRES32], 0x50}}, {{0x0, 0x0, &(0x7f0000003180)=[{0x0}, {0x0}], 0x2, &(0x7f00000002c0)=ANY=[@ANYBLOB="c9252cdfb191d94ef15953a086ed40b24a018fb18d39f9a1256b33cf339f1d1bb52846ddaaaecd492eb1d0774b26968a44bf794e9d902a3c02af9543bc4096ac7a27", @ANYRES32, @ANYRES32=0x0], 0x50, 0x4041}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYRESDEC, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000003000000000000000010000000100", @ANYRES32, @ANYRES64, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESDEC=r4], 0xd0, 0x20000000}}], 0x3, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x138, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {0x0, 0x0, 0x2}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x48, 0x1, {{'md5\x00'}}}]}, 0x138}}, 0x0) 09:54:09 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x9, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000e80)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) io_uring_enter(r1, 0x0, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x50}}], 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {}, {}, 0x0, 0x0, 0xa, 0x0, 0x6}, [@algo_auth={0x58, 0x1, {{'md5\x00'}, 0x80, "f959fb7b2a535a87359f0b633f54f881"}}]}, 0x148}}, 0x0) 09:54:09 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x6, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffff0f}) 09:54:09 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="5500000018057f083ffe15b282a380930a03000248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) [ 512.192371][ C1] sd 0:0:1:0: [sg_rq_end_io] Add. Sense: Invalid command operation code 09:54:09 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x74}}}, 0xf0}}, 0x0) [ 512.290000][T26696] netlink: 224 bytes leftover after parsing attributes in process `syz-executor.4'. [ 512.352579][ C1] sd 0:0:1:0: [sg_rq_end_io] Sense Key : Illegal Request [current] [ 512.360623][ C1] sd 0:0:1:0: [sg_rq_end_io] Add. Sense: Invalid command operation code [ 512.386257][T26706] loop2: detected capacity change from 0 to 16383 [ 512.393521][T26708] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=1304 sclass=netlink_route_socket pid=26708 comm=syz-executor.5 [ 512.421374][ T5428] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 512.426696][ T5428] loop2: p1 size 11290111 extends beyond EOD, truncated [ 512.434454][ T5428] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 512.442988][ T5428] loop2: p5 size 11290111 extends beyond EOD, truncated [ 512.450485][ T5428] loop2: p6 size 1912633224 extends beyond EOD, truncated [ 512.462452][T26706] loop_reread_partitions: partition scan of loop2 () failed (rc=-16) [ 512.485888][T26710] netlink: 224 bytes leftover after parsing attributes in process `syz-executor.4'. 09:54:09 executing program 2: syz_read_part_table(0x0, 0x2, &(0x7f0000000100)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0000ffffff85000000060000000000024000ffffff82000018e100000088770072003007000f00000000000000008000da55aa", 0x40, 0x1c0}, {0x0, 0x0, 0xfffffffffffffffb}]) 09:54:09 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x6, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffff7f}) 09:54:09 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="5500000018067f083ffe15b282a380930a03000248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) 09:54:09 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x9, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000e80)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) io_uring_enter(r1, 0x0, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x50}}], 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {}, {}, 0x0, 0x0, 0xa, 0x0, 0x7}, [@algo_auth={0x58, 0x1, {{'md5\x00'}, 0x80, "f959fb7b2a535a87359f0b633f54f881"}}]}, 0x148}}, 0x0) 09:54:09 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) mkdirat(r1, &(0x7f00000000c0)='./file0\x00', 0x0) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r3 = syz_io_uring_setup(0x3ede, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000140)) io_uring_enter(r3, 0x2ff, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x5, 0x0, &(0x7f0000000040)=""/18, 0xffffffde}, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, &(0x7f0000000dc0)=[{&(0x7f0000000100)="f4a4848461fb0592d2f8db4c1f3c9e408788e03d28fe5e69dbceea46dd67888cdedd07a068040b956c3af7", 0x2b}, {0x0}, {0x0}], 0x3, &(0x7f0000000540)=ANY=[@ANYBLOB="1400000000000000", @ANYRES32], 0x50}}, {{0x0, 0x0, &(0x7f0000003180)=[{0x0}, {0x0}], 0x2, &(0x7f00000002c0)=ANY=[@ANYBLOB="c9252cdfb191d94ef15953a086ed40b24a018fb18d39f9a1256b33cf339f1d1bb52846ddaaaecd492eb1d0774b26968a44bf794e9d902a3c02af9543bc4096ac7a27", @ANYRES32, @ANYRES32=0x0], 0x50, 0x4041}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYRESDEC, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000003000000000000000010000000100", @ANYRES32, @ANYRES64, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESDEC=r4], 0xd0, 0x20000000}}], 0x3, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x138, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {0x0, 0x0, 0x3}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x48, 0x1, {{'md5\x00'}}}]}, 0x138}}, 0x0) 09:54:09 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a}}}, 0xf0}}, 0x0) [ 512.598489][ C1] sd 0:0:1:0: [sg_rq_end_io] Sense Key : Illegal Request [current] [ 512.606486][ C1] sd 0:0:1:0: [sg_rq_end_io] Add. Sense: Invalid command operation code [ 512.619951][T26717] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=1560 sclass=netlink_route_socket pid=26717 comm=syz-executor.5 [ 512.623856][ T5592] udevd[5592]: inotify_add_watch(7, /dev/loop2p1, 10) failed: No such file or directory [ 512.643000][T26720] netlink: 224 bytes leftover after parsing attributes in process `syz-executor.4'. [ 512.654464][ T5428] udevd[5428]: inotify_add_watch(7, /dev/loop2p2, 10) failed: No such file or directory [ 512.654788][T13989] udevd[13989]: inotify_add_watch(7, /dev/loop2p3, 10) failed: No such file or directory [ 512.675756][T16174] udevd[16174]: inotify_add_watch(7, /dev/loop2p5, 10) failed: No such file or directory [ 512.682667][ T5428] udevd[5428]: inotify_add_watch(7, /dev/loop2p4, 10) failed: No such file or directory 09:54:09 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x6, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffff5}) 09:54:09 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="5500000018077f083ffe15b282a380930a03000248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) 09:54:09 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x13e}}}, 0xf0}}, 0x0) 09:54:09 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x9, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000e80)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) io_uring_enter(r1, 0x0, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x50}}], 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {}, {}, 0x0, 0x0, 0xa, 0x0, 0x8}, [@algo_auth={0x58, 0x1, {{'md5\x00'}, 0x80, "f959fb7b2a535a87359f0b633f54f881"}}]}, 0x148}}, 0x0) 09:54:09 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) mkdirat(r1, &(0x7f00000000c0)='./file0\x00', 0x0) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r3 = syz_io_uring_setup(0x3ede, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000140)) io_uring_enter(r3, 0x2ff, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x5, 0x0, &(0x7f0000000040)=""/18, 0xffffffde}, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, &(0x7f0000000dc0)=[{&(0x7f0000000100)="f4a4848461fb0592d2f8db4c1f3c9e408788e03d28fe5e69dbceea46dd67888cdedd07a068040b956c3af7", 0x2b}, {0x0}, {0x0}], 0x3, &(0x7f0000000540)=ANY=[@ANYBLOB="1400000000000000", @ANYRES32], 0x50}}, {{0x0, 0x0, &(0x7f0000003180)=[{0x0}, {0x0}], 0x2, &(0x7f00000002c0)=ANY=[@ANYBLOB="c9252cdfb191d94ef15953a086ed40b24a018fb18d39f9a1256b33cf339f1d1bb52846ddaaaecd492eb1d0774b26968a44bf794e9d902a3c02af9543bc4096ac7a27", @ANYRES32, @ANYRES32=0x0], 0x50, 0x4041}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYRESDEC, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000003000000000000000010000000100", @ANYRES32, @ANYRES64, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESDEC=r4], 0xd0, 0x20000000}}], 0x3, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x138, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {0x0, 0x0, 0x4}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x48, 0x1, {{'md5\x00'}}}]}, 0x138}}, 0x0) [ 512.687617][ T5552] udevd[5552]: inotify_add_watch(7, /dev/loop2p6, 10) failed: No such file or directory 09:54:09 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x6, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffb}) [ 512.836318][ C1] sd 0:0:1:0: [sg_rq_end_io] Sense Key : Illegal Request [current] [ 512.844350][ C1] sd 0:0:1:0: [sg_rq_end_io] Add. Sense: Invalid command operation code [ 512.864849][T26729] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=1816 sclass=netlink_route_socket pid=26729 comm=syz-executor.5 [ 512.889284][T26731] netlink: 224 bytes leftover after parsing attributes in process `syz-executor.4'. [ 512.936609][T26737] loop2: detected capacity change from 0 to 16383 [ 512.967653][ T5592] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 512.972956][ T5592] loop2: p1 size 11290111 extends beyond EOD, truncated [ 512.980659][ T5592] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 512.988560][ T5592] loop2: p5 size 11290111 extends beyond EOD, truncated [ 512.995932][ T5592] loop2: p6 size 1912633224 extends beyond EOD, truncated [ 513.005949][T26737] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 513.011273][T26737] loop2: p1 size 11290111 extends beyond EOD, truncated [ 513.019210][T26737] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 513.027151][T26737] loop2: p5 size 11290111 extends beyond EOD, truncated [ 513.034495][T26737] loop2: p6 size 1912633224 extends beyond EOD, truncated [ 513.113279][ C1] sd 0:0:1:0: [sg_rq_end_io] Sense Key : Illegal Request [current] [ 513.121280][ C1] sd 0:0:1:0: [sg_rq_end_io] Add. Sense: Invalid command operation code [ 513.189916][T26737] loop2: detected capacity change from 0 to 16383 09:54:10 executing program 2: syz_read_part_table(0x0, 0x2, &(0x7f0000000100)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0000ffffff85000000060000000000024000ffffff82000026e100000088770072003007000f00000000000000008000da55aa", 0x40, 0x1c0}, {0x0, 0x0, 0xfffffffffffffffb}]) 09:54:10 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="5500000018087f083ffe15b282a380930a03000248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) 09:54:10 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x9, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000e80)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) io_uring_enter(r1, 0x0, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x50}}], 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {}, {}, 0x0, 0x0, 0xa, 0x0, 0x9}, [@algo_auth={0x58, 0x1, {{'md5\x00'}, 0x80, "f959fb7b2a535a87359f0b633f54f881"}}]}, 0x148}}, 0x0) 09:54:10 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x300}}}, 0xf0}}, 0x0) 09:54:10 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) mkdirat(r1, &(0x7f00000000c0)='./file0\x00', 0x0) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r3 = syz_io_uring_setup(0x3ede, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000140)) io_uring_enter(r3, 0x2ff, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x5, 0x0, &(0x7f0000000040)=""/18, 0xffffffde}, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, &(0x7f0000000dc0)=[{&(0x7f0000000100)="f4a4848461fb0592d2f8db4c1f3c9e408788e03d28fe5e69dbceea46dd67888cdedd07a068040b956c3af7", 0x2b}, {0x0}, {0x0}], 0x3, &(0x7f0000000540)=ANY=[@ANYBLOB="1400000000000000", @ANYRES32], 0x50}}, {{0x0, 0x0, &(0x7f0000003180)=[{0x0}, {0x0}], 0x2, &(0x7f00000002c0)=ANY=[@ANYBLOB="c9252cdfb191d94ef15953a086ed40b24a018fb18d39f9a1256b33cf339f1d1bb52846ddaaaecd492eb1d0774b26968a44bf794e9d902a3c02af9543bc4096ac7a27", @ANYRES32, @ANYRES32=0x0], 0x50, 0x4041}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYRESDEC, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000003000000000000000010000000100", @ANYRES32, @ANYRES64, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESDEC=r4], 0xd0, 0x20000000}}], 0x3, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x138, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {0x0, 0x0, 0x5}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x48, 0x1, {{'md5\x00'}}}]}, 0x138}}, 0x0) 09:54:10 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x6, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe}) [ 513.235774][T26737] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 513.241016][T26737] loop2: p1 size 11290111 extends beyond EOD, truncated [ 513.248850][T26737] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 513.256560][T26737] loop2: p5 size 11290111 extends beyond EOD, truncated [ 513.263876][T26737] loop2: p6 size 1912633224 extends beyond EOD, truncated 09:54:10 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="5500000018097f083ffe15b282a380930a03000248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) 09:54:10 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) mkdirat(r1, &(0x7f00000000c0)='./file0\x00', 0x0) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r3 = syz_io_uring_setup(0x3ede, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000140)) io_uring_enter(r3, 0x2ff, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x5, 0x0, &(0x7f0000000040)=""/18, 0xffffffde}, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, &(0x7f0000000dc0)=[{&(0x7f0000000100)="f4a4848461fb0592d2f8db4c1f3c9e408788e03d28fe5e69dbceea46dd67888cdedd07a068040b956c3af7", 0x2b}, {0x0}, {0x0}], 0x3, &(0x7f0000000540)=ANY=[@ANYBLOB="1400000000000000", @ANYRES32], 0x50}}, {{0x0, 0x0, &(0x7f0000003180)=[{0x0}, {0x0}], 0x2, &(0x7f00000002c0)=ANY=[@ANYBLOB="c9252cdfb191d94ef15953a086ed40b24a018fb18d39f9a1256b33cf339f1d1bb52846ddaaaecd492eb1d0774b26968a44bf794e9d902a3c02af9543bc4096ac7a27", @ANYRES32, @ANYRES32=0x0], 0x50, 0x4041}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYRESDEC, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000003000000000000000010000000100", @ANYRES32, @ANYRES64, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESDEC=r4], 0xd0, 0x20000000}}], 0x3, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x138, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {0x0, 0x0, 0x6}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x48, 0x1, {{'md5\x00'}}}]}, 0x138}}, 0x0) 09:54:10 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x6, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e", 0x0, 0x0, 0x0, 0x0, 0x0}) 09:54:10 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x9, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000e80)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) io_uring_enter(r1, 0x0, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x50}}], 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {}, {}, 0x0, 0x0, 0xa, 0x0, 0xa}, [@algo_auth={0x58, 0x1, {{'md5\x00'}, 0x80, "f959fb7b2a535a87359f0b633f54f881"}}]}, 0x148}}, 0x0) 09:54:10 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41e}}}, 0xf0}}, 0x0) [ 513.333286][T26748] netlink: 224 bytes leftover after parsing attributes in process `syz-executor.4'. [ 513.333310][T26746] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=2072 sclass=netlink_route_socket pid=26746 comm=syz-executor.5 [ 513.357384][ C1] sd 0:0:1:0: [sg_rq_end_io] Sense Key : Illegal Request [current] [ 513.365412][ C1] sd 0:0:1:0: [sg_rq_end_io] Add. Sense: Invalid command operation code 09:54:10 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="55000000180a7f083ffe15b282a380930a03000248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) [ 513.524730][T26758] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=2328 sclass=netlink_route_socket pid=26758 comm=syz-executor.5 [ 513.560655][ C1] sd 0:0:1:0: [sg_rq_end_io] Sense Key : Illegal Request [current] [ 513.568686][ C1] sd 0:0:1:0: [sg_rq_end_io] Add. Sense: Invalid command operation code [ 513.594901][T26764] netlink: 224 bytes leftover after parsing attributes in process `syz-executor.4'. [ 513.664757][T26767] loop2: detected capacity change from 0 to 16383 [ 513.730265][T26769] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=2584 sclass=netlink_route_socket pid=26769 comm=syz-executor.5 [ 513.743995][T26767] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 513.749339][T26767] loop2: p1 size 11290111 extends beyond EOD, truncated [ 513.757550][T26767] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 513.765412][T26767] loop2: p5 size 11290111 extends beyond EOD, truncated [ 513.772799][T26767] loop2: p6 size 1912633224 extends beyond EOD, truncated [ 513.853225][T26767] loop2: detected capacity change from 0 to 16383 [ 513.905746][ T5592] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 513.911007][ T5592] loop2: p1 size 11290111 extends beyond EOD, truncated [ 513.918720][ T5592] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 513.926522][ T5592] loop2: p5 size 11290111 extends beyond EOD, truncated [ 513.933699][ T5592] loop2: p6 size 1912633224 extends beyond EOD, truncated [ 513.943348][T26767] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 513.948608][T26767] loop2: p1 size 11290111 extends beyond EOD, truncated 09:54:11 executing program 2: syz_read_part_table(0x0, 0x2, &(0x7f0000000100)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0000ffffff85000000060000000000024000ffffff82000071e100000088770072003007000f00000000000000008000da55aa", 0x40, 0x1c0}, {0x0, 0x0, 0xfffffffffffffffb}]) 09:54:11 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) mkdirat(r1, &(0x7f00000000c0)='./file0\x00', 0x0) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r3 = syz_io_uring_setup(0x3ede, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000140)) io_uring_enter(r3, 0x2ff, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x5, 0x0, &(0x7f0000000040)=""/18, 0xffffffde}, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, &(0x7f0000000dc0)=[{&(0x7f0000000100)="f4a4848461fb0592d2f8db4c1f3c9e408788e03d28fe5e69dbceea46dd67888cdedd07a068040b956c3af7", 0x2b}, {0x0}, {0x0}], 0x3, &(0x7f0000000540)=ANY=[@ANYBLOB="1400000000000000", @ANYRES32], 0x50}}, {{0x0, 0x0, &(0x7f0000003180)=[{0x0}, {0x0}], 0x2, &(0x7f00000002c0)=ANY=[@ANYBLOB="c9252cdfb191d94ef15953a086ed40b24a018fb18d39f9a1256b33cf339f1d1bb52846ddaaaecd492eb1d0774b26968a44bf794e9d902a3c02af9543bc4096ac7a27", @ANYRES32, @ANYRES32=0x0], 0x50, 0x4041}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYRESDEC, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000003000000000000000010000000100", @ANYRES32, @ANYRES64, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESDEC=r4], 0xd0, 0x20000000}}], 0x3, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x138, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {0x0, 0x0, 0x7}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x48, 0x1, {{'md5\x00'}}}]}, 0x138}}, 0x0) 09:54:11 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x6, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) 09:54:11 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x9, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000e80)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) io_uring_enter(r1, 0x0, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x50}}], 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {}, {}, 0x0, 0x0, 0xa, 0x0, 0xb}, [@algo_auth={0x58, 0x1, {{'md5\x00'}, 0x80, "f959fb7b2a535a87359f0b633f54f881"}}]}, 0x148}}, 0x0) 09:54:11 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="55000000180b7f083ffe15b282a380930a03000248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) 09:54:11 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x500}}}, 0xf0}}, 0x0) [ 513.956398][T26767] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 513.964363][T26767] loop2: p5 size 11290111 extends beyond EOD, truncated [ 513.971557][T26767] loop2: p6 size 1912633224 extends beyond EOD, truncated 09:54:11 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x6, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}) 09:54:11 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x600}}}, 0xf0}}, 0x0) 09:54:11 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="55000000180c7f083ffe15b282a380930a03000248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) [ 514.040949][ C1] sd 0:0:1:0: [sg_rq_end_io] Sense Key : Illegal Request [current] [ 514.048978][ C1] sd 0:0:1:0: [sg_rq_end_io] Add. Sense: Invalid command operation code [ 514.061178][T26776] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=2840 sclass=netlink_route_socket pid=26776 comm=syz-executor.5 [ 514.061637][T26778] netlink: 224 bytes leftover after parsing attributes in process `syz-executor.4'. 09:54:11 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x9, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000e80)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) io_uring_enter(r1, 0x0, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x50}}], 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {}, {}, 0x0, 0x0, 0xa, 0x0, 0x10}, [@algo_auth={0x58, 0x1, {{'md5\x00'}, 0x80, "f959fb7b2a535a87359f0b633f54f881"}}]}, 0x148}}, 0x0) 09:54:11 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) mkdirat(r1, &(0x7f00000000c0)='./file0\x00', 0x0) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r3 = syz_io_uring_setup(0x3ede, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000140)) io_uring_enter(r3, 0x2ff, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x5, 0x0, &(0x7f0000000040)=""/18, 0xffffffde}, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, &(0x7f0000000dc0)=[{&(0x7f0000000100)="f4a4848461fb0592d2f8db4c1f3c9e408788e03d28fe5e69dbceea46dd67888cdedd07a068040b956c3af7", 0x2b}, {0x0}, {0x0}], 0x3, &(0x7f0000000540)=ANY=[@ANYBLOB="1400000000000000", @ANYRES32], 0x50}}, {{0x0, 0x0, &(0x7f0000003180)=[{0x0}, {0x0}], 0x2, &(0x7f00000002c0)=ANY=[@ANYBLOB="c9252cdfb191d94ef15953a086ed40b24a018fb18d39f9a1256b33cf339f1d1bb52846ddaaaecd492eb1d0774b26968a44bf794e9d902a3c02af9543bc4096ac7a27", @ANYRES32, @ANYRES32=0x0], 0x50, 0x4041}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYRESDEC, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000003000000000000000010000000100", @ANYRES32, @ANYRES64, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESDEC=r4], 0xd0, 0x20000000}}], 0x3, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x138, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {0x0, 0x0, 0x8}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x48, 0x1, {{'md5\x00'}}}]}, 0x138}}, 0x0) 09:54:11 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x700}}}, 0xf0}}, 0x0) [ 514.305224][ C1] sd 0:0:1:0: [sg_rq_end_io] Sense Key : Illegal Request [current] [ 514.313281][ C1] sd 0:0:1:0: [sg_rq_end_io] Add. Sense: Invalid command operation code [ 514.342073][T26791] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=3096 sclass=netlink_route_socket pid=26791 comm=syz-executor.5 [ 514.364323][ C1] scsi_io_completion_action: 10 callbacks suppressed [ 514.364351][ C1] sd 0:0:1:0: tag#6021 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 514.380871][ C1] sd 0:0:1:0: tag#6021 CDB: opcode=0xe5 (vendor) [ 514.387178][ C1] sd 0:0:1:0: tag#6021 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 514.396206][ C1] sd 0:0:1:0: tag#6021 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 514.405236][ C1] sd 0:0:1:0: tag#6021 CDB[20]: ba [ 514.475579][T26798] loop2: detected capacity change from 0 to 16383 [ 514.548830][T26798] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 514.554136][T26798] loop2: p1 size 11290111 extends beyond EOD, truncated [ 514.561848][T26798] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 514.569738][T26798] loop2: p5 size 11290111 extends beyond EOD, truncated [ 514.577068][T26798] loop2: p6 size 1912633224 extends beyond EOD, truncated [ 514.687744][T26798] loop2: detected capacity change from 0 to 16383 09:54:11 executing program 2: syz_read_part_table(0x0, 0x2, &(0x7f0000000100)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0000ffffff85000000060000000000024000ffffff8200007ee100000088770072003007000f00000000000000008000da55aa", 0x40, 0x1c0}, {0x0, 0x0, 0xfffffffffffffffb}]) 09:54:11 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x6, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}) 09:54:11 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x9, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000e80)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) io_uring_enter(r1, 0x0, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x50}}], 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {}, {}, 0x0, 0x0, 0xa, 0x0, 0x11}, [@algo_auth={0x58, 0x1, {{'md5\x00'}, 0x80, "f959fb7b2a535a87359f0b633f54f881"}}]}, 0x148}}, 0x0) 09:54:11 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="55000000180d7f083ffe15b282a380930a03000248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) 09:54:11 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) mkdirat(r1, &(0x7f00000000c0)='./file0\x00', 0x0) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r3 = syz_io_uring_setup(0x3ede, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000140)) io_uring_enter(r3, 0x2ff, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x5, 0x0, &(0x7f0000000040)=""/18, 0xffffffde}, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, &(0x7f0000000dc0)=[{&(0x7f0000000100)="f4a4848461fb0592d2f8db4c1f3c9e408788e03d28fe5e69dbceea46dd67888cdedd07a068040b956c3af7", 0x2b}, {0x0}, {0x0}], 0x3, &(0x7f0000000540)=ANY=[@ANYBLOB="1400000000000000", @ANYRES32], 0x50}}, {{0x0, 0x0, &(0x7f0000003180)=[{0x0}, {0x0}], 0x2, &(0x7f00000002c0)=ANY=[@ANYBLOB="c9252cdfb191d94ef15953a086ed40b24a018fb18d39f9a1256b33cf339f1d1bb52846ddaaaecd492eb1d0774b26968a44bf794e9d902a3c02af9543bc4096ac7a27", @ANYRES32, @ANYRES32=0x0], 0x50, 0x4041}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYRESDEC, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000003000000000000000010000000100", @ANYRES32, @ANYRES64, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESDEC=r4], 0xd0, 0x20000000}}], 0x3, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x138, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {0x0, 0x0, 0x9}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x48, 0x1, {{'md5\x00'}}}]}, 0x138}}, 0x0) 09:54:11 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x900}}}, 0xf0}}, 0x0) [ 514.750661][T26798] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 514.755915][T26798] loop2: p1 size 11290111 extends beyond EOD, truncated [ 514.763704][T26798] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 514.771656][T26798] loop2: p5 size 11290111 extends beyond EOD, truncated [ 514.778880][T26798] loop2: p6 size 1912633224 extends beyond EOD, truncated [ 514.851159][ C1] sd 0:0:1:0: [sg_rq_end_io] Sense Key : Illegal Request [current] [ 514.859173][ C1] sd 0:0:1:0: [sg_rq_end_io] Add. Sense: Invalid command operation code [ 514.881709][T26807] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=3352 sclass=netlink_route_socket pid=26807 comm=syz-executor.5 09:54:11 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa00}}}, 0xf0}}, 0x0) 09:54:11 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x6, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}) 09:54:11 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x9, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000e80)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) io_uring_enter(r1, 0x0, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x50}}], 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {}, {}, 0x0, 0x0, 0xa, 0x0, 0x14}, [@algo_auth={0x58, 0x1, {{'md5\x00'}, 0x80, "f959fb7b2a535a87359f0b633f54f881"}}]}, 0x148}}, 0x0) 09:54:11 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="55000000180e7f083ffe15b282a380930a03000248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) [ 514.897123][ C0] sd 0:0:1:0: tag#6046 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 514.906958][ C0] sd 0:0:1:0: tag#6046 CDB: opcode=0xe5 (vendor) [ 514.913319][ C0] sd 0:0:1:0: tag#6046 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 514.922355][ C0] sd 0:0:1:0: tag#6046 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 514.931385][ C0] sd 0:0:1:0: tag#6046 CDB[20]: ba 09:54:12 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) mkdirat(r1, &(0x7f00000000c0)='./file0\x00', 0x0) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r3 = syz_io_uring_setup(0x3ede, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000140)) io_uring_enter(r3, 0x2ff, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x5, 0x0, &(0x7f0000000040)=""/18, 0xffffffde}, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, &(0x7f0000000dc0)=[{&(0x7f0000000100)="f4a4848461fb0592d2f8db4c1f3c9e408788e03d28fe5e69dbceea46dd67888cdedd07a068040b956c3af7", 0x2b}, {0x0}, {0x0}], 0x3, &(0x7f0000000540)=ANY=[@ANYBLOB="1400000000000000", @ANYRES32], 0x50}}, {{0x0, 0x0, &(0x7f0000003180)=[{0x0}, {0x0}], 0x2, &(0x7f00000002c0)=ANY=[@ANYBLOB="c9252cdfb191d94ef15953a086ed40b24a018fb18d39f9a1256b33cf339f1d1bb52846ddaaaecd492eb1d0774b26968a44bf794e9d902a3c02af9543bc4096ac7a27", @ANYRES32, @ANYRES32=0x0], 0x50, 0x4041}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYRESDEC, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000003000000000000000010000000100", @ANYRES32, @ANYRES64, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESDEC=r4], 0xd0, 0x20000000}}], 0x3, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x138, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {0x0, 0x0, 0xa}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x48, 0x1, {{'md5\x00'}}}]}, 0x138}}, 0x0) [ 514.958722][ C1] sd 0:0:1:0: tag#6056 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 514.968577][ C1] sd 0:0:1:0: tag#6056 CDB: opcode=0xe5 (vendor) [ 514.974877][ C1] sd 0:0:1:0: tag#6056 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 514.983884][ C1] sd 0:0:1:0: tag#6056 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 514.992897][ C1] sd 0:0:1:0: tag#6056 CDB[20]: ba 09:54:12 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="55000000180f7f083ffe15b282a380930a03000248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) [ 515.148469][T26819] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=3608 sclass=netlink_route_socket pid=26819 comm=syz-executor.5 [ 515.162068][ C1] sd 0:0:1:0: [sg_rq_end_io] Sense Key : Illegal Request [current] [ 515.170082][ C1] sd 0:0:1:0: [sg_rq_end_io] Add. Sense: Invalid command operation code [ 515.207633][ C1] sd 0:0:1:0: tag#6059 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 515.217457][ C1] sd 0:0:1:0: tag#6059 CDB: opcode=0xe5 (vendor) [ 515.223765][ C1] sd 0:0:1:0: tag#6059 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 515.232793][ C1] sd 0:0:1:0: tag#6059 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 515.241815][ C1] sd 0:0:1:0: tag#6059 CDB[20]: ba [ 515.255135][ C1] sd 0:0:1:0: tag#6067 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 515.264968][ C1] sd 0:0:1:0: tag#6067 CDB: opcode=0xe5 (vendor) [ 515.271323][ C1] sd 0:0:1:0: tag#6067 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 515.280362][ C1] sd 0:0:1:0: tag#6067 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 515.289387][ C1] sd 0:0:1:0: tag#6067 CDB[20]: ba [ 515.378088][T26829] loop2: detected capacity change from 0 to 16383 [ 515.395219][T26830] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=3864 sclass=netlink_route_socket pid=26830 comm=syz-executor.5 [ 515.418266][T26829] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 515.423654][T26829] loop2: p1 size 11290111 extends beyond EOD, truncated [ 515.431580][T26829] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 515.439384][T26829] loop2: p5 size 11290111 extends beyond EOD, truncated [ 515.446592][T26829] loop2: p6 size 1912633224 extends beyond EOD, truncated [ 515.552229][T26829] loop2: detected capacity change from 0 to 16383 [ 515.617149][T26829] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 515.622459][T26829] loop2: p1 size 11290111 extends beyond EOD, truncated [ 515.630240][T26829] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 515.638178][T26829] loop2: p5 size 11290111 extends beyond EOD, truncated [ 515.645501][T26829] loop2: p6 size 1912633224 extends beyond EOD, truncated 09:54:12 executing program 2: syz_read_part_table(0x0, 0x2, &(0x7f0000000100)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0000ffffff85000000060000000000024000ffffff820000fee100000088770072003007000f00000000000000008000da55aa", 0x40, 0x1c0}, {0x0, 0x0, 0xfffffffffffffffb}]) 09:54:12 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb00}}}, 0xf0}}, 0x0) 09:54:12 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x6, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd}) 09:54:12 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="5500000018107f083ffe15b282a380930a03000248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) 09:54:12 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) mkdirat(r1, &(0x7f00000000c0)='./file0\x00', 0x0) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r3 = syz_io_uring_setup(0x3ede, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000140)) io_uring_enter(r3, 0x2ff, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x5, 0x0, &(0x7f0000000040)=""/18, 0xffffffde}, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, &(0x7f0000000dc0)=[{&(0x7f0000000100)="f4a4848461fb0592d2f8db4c1f3c9e408788e03d28fe5e69dbceea46dd67888cdedd07a068040b956c3af7", 0x2b}, {0x0}, {0x0}], 0x3, &(0x7f0000000540)=ANY=[@ANYBLOB="1400000000000000", @ANYRES32], 0x50}}, {{0x0, 0x0, &(0x7f0000003180)=[{0x0}, {0x0}], 0x2, &(0x7f00000002c0)=ANY=[@ANYBLOB="c9252cdfb191d94ef15953a086ed40b24a018fb18d39f9a1256b33cf339f1d1bb52846ddaaaecd492eb1d0774b26968a44bf794e9d902a3c02af9543bc4096ac7a27", @ANYRES32, @ANYRES32=0x0], 0x50, 0x4041}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYRESDEC, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000003000000000000000010000000100", @ANYRES32, @ANYRES64, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESDEC=r4], 0xd0, 0x20000000}}], 0x3, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x138, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {0x0, 0x0, 0xb}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x48, 0x1, {{'md5\x00'}}}]}, 0x138}}, 0x0) 09:54:12 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x9, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000e80)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) io_uring_enter(r1, 0x0, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x50}}], 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x58, 0x1, {{'md5\x00'}, 0x80, "f959fb7b2a535a87359f0b633f54f881"}}]}, 0x148}}, 0x0) [ 515.732333][ C1] sd 0:0:1:0: tag#6065 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 515.742165][ C1] sd 0:0:1:0: tag#6065 CDB: opcode=0xe5 (vendor) [ 515.748466][ C1] sd 0:0:1:0: tag#6065 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 515.757476][ C1] sd 0:0:1:0: tag#6065 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 515.766482][ C1] sd 0:0:1:0: tag#6065 CDB[20]: ba 09:54:12 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) mkdirat(r1, &(0x7f00000000c0)='./file0\x00', 0x0) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r3 = syz_io_uring_setup(0x3ede, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000140)) io_uring_enter(r3, 0x2ff, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x5, 0x0, &(0x7f0000000040)=""/18, 0xffffffde}, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, &(0x7f0000000dc0)=[{&(0x7f0000000100)="f4a4848461fb0592d2f8db4c1f3c9e408788e03d28fe5e69dbceea46dd67888cdedd07a068040b956c3af7", 0x2b}, {0x0}, {0x0}], 0x3, &(0x7f0000000540)=ANY=[@ANYBLOB="1400000000000000", @ANYRES32], 0x50}}, {{0x0, 0x0, &(0x7f0000003180)=[{0x0}, {0x0}], 0x2, &(0x7f00000002c0)=ANY=[@ANYBLOB="c9252cdfb191d94ef15953a086ed40b24a018fb18d39f9a1256b33cf339f1d1bb52846ddaaaecd492eb1d0774b26968a44bf794e9d902a3c02af9543bc4096ac7a27", @ANYRES32, @ANYRES32=0x0], 0x50, 0x4041}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYRESDEC, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000003000000000000000010000000100", @ANYRES32, @ANYRES64, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESDEC=r4], 0xd0, 0x20000000}}], 0x3, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x138, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {0x0, 0x0, 0x10}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x48, 0x1, {{'md5\x00'}}}]}, 0x138}}, 0x0) 09:54:12 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="5500000018117f083ffe15b282a380930a03000248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) 09:54:12 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc00}}}, 0xf0}}, 0x0) 09:54:12 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x9, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000e80)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) io_uring_enter(r1, 0x0, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x50}}], 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {}, {}, 0x0, 0x0, 0xa, 0x0, 0x0, 0x2}, [@algo_auth={0x58, 0x1, {{'md5\x00'}, 0x80, "f959fb7b2a535a87359f0b633f54f881"}}]}, 0x148}}, 0x0) 09:54:12 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x6, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe}) [ 515.783672][T26839] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=4120 sclass=netlink_route_socket pid=26839 comm=syz-executor.5 [ 515.801487][ C1] sd 0:0:1:0: [sg_rq_end_io] Sense Key : Illegal Request [current] [ 515.809542][ C1] sd 0:0:1:0: [sg_rq_end_io] Add. Sense: Invalid command operation code 09:54:12 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="5500000018127f083ffe15b282a380930a03000248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) [ 515.980394][ C0] sd 0:0:1:0: tag#6068 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 515.990247][ C0] sd 0:0:1:0: tag#6068 CDB: opcode=0xe5 (vendor) [ 515.996573][ C0] sd 0:0:1:0: tag#6068 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 516.005610][ C0] sd 0:0:1:0: tag#6068 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 516.014651][ C0] sd 0:0:1:0: tag#6068 CDB[20]: ba [ 516.026536][ C1] sd 0:0:1:0: [sg_rq_end_io] Sense Key : Illegal Request [current] [ 516.034562][ C1] sd 0:0:1:0: [sg_rq_end_io] Add. Sense: Invalid command operation code [ 516.054570][ C0] sd 0:0:1:0: tag#6041 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 516.064419][ C0] sd 0:0:1:0: tag#6041 CDB: opcode=0xe5 (vendor) [ 516.070755][ C0] sd 0:0:1:0: tag#6041 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 516.079769][ C0] sd 0:0:1:0: tag#6041 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 516.088789][ C0] sd 0:0:1:0: tag#6041 CDB[20]: ba [ 516.158539][ T5551] udevd[5551]: inotify_add_watch(7, /dev/loop2p6, 10) failed: No such file or directory [ 516.169330][T13989] udevd[13989]: inotify_add_watch(7, /dev/loop2p3, 10) failed: No such file or directory [ 516.171419][ T5428] udevd[5428]: inotify_add_watch(7, /dev/loop2p2, 10) failed: No such file or directory [ 516.180846][T16174] udevd[16174]: inotify_add_watch(7, /dev/loop2p4, 10) failed: No such file or directory [ 516.233946][T26860] loop2: detected capacity change from 0 to 16383 [ 516.296518][T26860] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 516.301795][T26860] loop2: p1 size 11290111 extends beyond EOD, truncated [ 516.309509][T26860] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 516.317158][T26860] loop2: p5 size 11290111 extends beyond EOD, truncated [ 516.324322][T26860] loop2: p6 size 1912633224 extends beyond EOD, truncated [ 516.404926][T26860] loop2: detected capacity change from 0 to 16383 [ 516.451208][ T5592] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 516.456462][ T5592] loop2: p1 size 11290111 extends beyond EOD, truncated [ 516.464092][ T5592] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 516.471738][ T5592] loop2: p5 size 11290111 extends beyond EOD, truncated [ 516.478954][ T5592] loop2: p6 size 1912633224 extends beyond EOD, truncated [ 516.488943][T26860] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 516.494228][T26860] loop2: p1 size 11290111 extends beyond EOD, truncated 09:54:13 executing program 2: syz_read_part_table(0x0, 0x2, &(0x7f0000000100)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0000ffffff85000000060000000000024000ffffff82000000e102000088770072003007000f00000000000000008000da55aa", 0x40, 0x1c0}, {0x0, 0x0, 0xfffffffffffffffb}]) 09:54:13 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x6, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10}) 09:54:13 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x9, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000e80)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) io_uring_enter(r1, 0x0, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x50}}], 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {}, {}, 0x0, 0x0, 0xa, 0x0, 0x0, 0x3}, [@algo_auth={0x58, 0x1, {{'md5\x00'}, 0x80, "f959fb7b2a535a87359f0b633f54f881"}}]}, 0x148}}, 0x0) 09:54:13 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) mkdirat(r1, &(0x7f00000000c0)='./file0\x00', 0x0) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r3 = syz_io_uring_setup(0x3ede, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000140)) io_uring_enter(r3, 0x2ff, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x5, 0x0, &(0x7f0000000040)=""/18, 0xffffffde}, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, &(0x7f0000000dc0)=[{&(0x7f0000000100)="f4a4848461fb0592d2f8db4c1f3c9e408788e03d28fe5e69dbceea46dd67888cdedd07a068040b956c3af7", 0x2b}, {0x0}, {0x0}], 0x3, &(0x7f0000000540)=ANY=[@ANYBLOB="1400000000000000", @ANYRES32], 0x50}}, {{0x0, 0x0, &(0x7f0000003180)=[{0x0}, {0x0}], 0x2, &(0x7f00000002c0)=ANY=[@ANYBLOB="c9252cdfb191d94ef15953a086ed40b24a018fb18d39f9a1256b33cf339f1d1bb52846ddaaaecd492eb1d0774b26968a44bf794e9d902a3c02af9543bc4096ac7a27", @ANYRES32, @ANYRES32=0x0], 0x50, 0x4041}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYRESDEC, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000003000000000000000010000000100", @ANYRES32, @ANYRES64, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESDEC=r4], 0xd0, 0x20000000}}], 0x3, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x138, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {0x0, 0x0, 0x11}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x48, 0x1, {{'md5\x00'}}}]}, 0x138}}, 0x0) 09:54:13 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd00}}}, 0xf0}}, 0x0) 09:54:13 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="5500000018257f083ffe15b282a380930a03000248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) [ 516.501796][T26860] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 516.509625][T26860] loop2: p5 size 11290111 extends beyond EOD, truncated [ 516.516830][T26860] loop2: p6 size 1912633224 extends beyond EOD, truncated 09:54:13 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="5500000018487f083ffe15b282a380930a03000248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) 09:54:13 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x6, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18}) 09:54:13 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe00}}}, 0xf0}}, 0x0) [ 516.576081][ C1] sd 0:0:1:0: [sg_rq_end_io] Sense Key : Illegal Request [current] [ 516.584093][ C1] sd 0:0:1:0: [sg_rq_end_io] Add. Sense: Invalid command operation code [ 516.584819][ C0] sd 0:0:1:0: tag#6022 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 516.602217][ C0] sd 0:0:1:0: tag#6022 CDB: opcode=0xe5 (vendor) [ 516.608574][ C0] sd 0:0:1:0: tag#6022 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c 09:54:13 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x9, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000e80)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) io_uring_enter(r1, 0x0, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x50}}], 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {}, {}, 0x0, 0x0, 0xa, 0x0, 0x0, 0x4}, [@algo_auth={0x58, 0x1, {{'md5\x00'}, 0x80, "f959fb7b2a535a87359f0b633f54f881"}}]}, 0x148}}, 0x0) 09:54:13 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) mkdirat(r1, &(0x7f00000000c0)='./file0\x00', 0x0) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r3 = syz_io_uring_setup(0x3ede, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000140)) io_uring_enter(r3, 0x2ff, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x5, 0x0, &(0x7f0000000040)=""/18, 0xffffffde}, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, &(0x7f0000000dc0)=[{&(0x7f0000000100)="f4a4848461fb0592d2f8db4c1f3c9e408788e03d28fe5e69dbceea46dd67888cdedd07a068040b956c3af7", 0x2b}, {0x0}, {0x0}], 0x3, &(0x7f0000000540)=ANY=[@ANYBLOB="1400000000000000", @ANYRES32], 0x50}}, {{0x0, 0x0, &(0x7f0000003180)=[{0x0}, {0x0}], 0x2, &(0x7f00000002c0)=ANY=[@ANYBLOB="c9252cdfb191d94ef15953a086ed40b24a018fb18d39f9a1256b33cf339f1d1bb52846ddaaaecd492eb1d0774b26968a44bf794e9d902a3c02af9543bc4096ac7a27", @ANYRES32, @ANYRES32=0x0], 0x50, 0x4041}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYRESDEC, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000003000000000000000010000000100", @ANYRES32, @ANYRES64, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESDEC=r4], 0xd0, 0x20000000}}], 0x3, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x138, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {0x0, 0x0, 0x14}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x48, 0x1, {{'md5\x00'}}}]}, 0x138}}, 0x0) [ 516.617628][ C0] sd 0:0:1:0: tag#6022 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 516.626667][ C0] sd 0:0:1:0: tag#6022 CDB[20]: ba 09:54:13 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="55000000184c7f083ffe15b282a380930a03000248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) [ 516.764944][ C1] sd 0:0:1:0: [sg_rq_end_io] Sense Key : Illegal Request [current] [ 516.772974][ C1] sd 0:0:1:0: [sg_rq_end_io] Add. Sense: Invalid command operation code [ 516.797361][T26882] __nla_validate_parse: 10 callbacks suppressed [ 516.797372][T26882] netlink: 224 bytes leftover after parsing attributes in process `syz-executor.4'. [ 516.835648][ C0] sd 0:0:1:0: tag#6052 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 516.845476][ C0] sd 0:0:1:0: tag#6052 CDB: opcode=0xe5 (vendor) [ 516.851801][ C0] sd 0:0:1:0: tag#6052 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 516.860820][ C0] sd 0:0:1:0: tag#6052 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 516.869868][ C0] sd 0:0:1:0: tag#6052 CDB[20]: ba [ 516.944891][T26891] loop2: detected capacity change from 0 to 16383 [ 516.976722][ T5592] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 516.982036][ T5592] loop2: p1 size 11290111 extends beyond EOD, truncated [ 516.989533][ T5592] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 516.997221][ T5592] loop2: p5 size 11290111 extends beyond EOD, truncated [ 517.004537][ T5592] loop2: p6 size 1912633224 extends beyond EOD, truncated [ 517.014320][T26891] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 517.019615][T26891] loop2: p1 size 11290111 extends beyond EOD, truncated [ 517.027056][T26891] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 517.034998][T26891] loop2: p5 size 11290111 extends beyond EOD, truncated [ 517.042228][T26891] loop2: p6 size 1912633224 extends beyond EOD, truncated [ 517.126170][T26891] loop2: detected capacity change from 0 to 16383 [ 517.172553][ T5592] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 517.177796][ T5592] loop2: p1 size 11290111 extends beyond EOD, truncated [ 517.185350][ T5592] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 517.193123][ T5592] loop2: p5 size 11290111 extends beyond EOD, truncated [ 517.200304][ T5592] loop2: p6 size 1912633224 extends beyond EOD, truncated [ 517.210186][T26891] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 517.215443][T26891] loop2: p1 size 11290111 extends beyond EOD, truncated 09:54:14 executing program 2: syz_read_part_table(0x0, 0x2, &(0x7f0000000100)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0000ffffff85000000060000000000024000ffffff82000000e103000088770072003007000f00000000000000008000da55aa", 0x40, 0x1c0}, {0x0, 0x0, 0xfffffffffffffffb}]) 09:54:14 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x6, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x600}) 09:54:14 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xec0}}}, 0xf0}}, 0x0) 09:54:14 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x9, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000e80)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) io_uring_enter(r1, 0x0, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x50}}], 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {}, {}, 0x0, 0x0, 0xa, 0x0, 0x0, 0x5}, [@algo_auth={0x58, 0x1, {{'md5\x00'}, 0x80, "f959fb7b2a535a87359f0b633f54f881"}}]}, 0x148}}, 0x0) 09:54:14 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) mkdirat(r1, &(0x7f00000000c0)='./file0\x00', 0x0) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r3 = syz_io_uring_setup(0x3ede, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000140)) io_uring_enter(r3, 0x2ff, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x5, 0x0, &(0x7f0000000040)=""/18, 0xffffffde}, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, &(0x7f0000000dc0)=[{&(0x7f0000000100)="f4a4848461fb0592d2f8db4c1f3c9e408788e03d28fe5e69dbceea46dd67888cdedd07a068040b956c3af7", 0x2b}, {0x0}, {0x0}], 0x3, &(0x7f0000000540)=ANY=[@ANYBLOB="1400000000000000", @ANYRES32], 0x50}}, {{0x0, 0x0, &(0x7f0000003180)=[{0x0}, {0x0}], 0x2, &(0x7f00000002c0)=ANY=[@ANYBLOB="c9252cdfb191d94ef15953a086ed40b24a018fb18d39f9a1256b33cf339f1d1bb52846ddaaaecd492eb1d0774b26968a44bf794e9d902a3c02af9543bc4096ac7a27", @ANYRES32, @ANYRES32=0x0], 0x50, 0x4041}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYRESDEC, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000003000000000000000010000000100", @ANYRES32, @ANYRES64, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESDEC=r4], 0xd0, 0x20000000}}], 0x3, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x138, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {0x0, 0x0, 0x2b0}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x48, 0x1, {{'md5\x00'}}}]}, 0x138}}, 0x0) 09:54:14 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="5500000018607f083ffe15b282a380930a03000248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) [ 517.222862][T26891] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 517.230724][T26891] loop2: p5 size 11290111 extends beyond EOD, truncated [ 517.238253][T26891] loop2: p6 size 1912633224 extends beyond EOD, truncated 09:54:14 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) mkdirat(r1, &(0x7f00000000c0)='./file0\x00', 0x0) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r3 = syz_io_uring_setup(0x3ede, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000140)) io_uring_enter(r3, 0x2ff, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x5, 0x0, &(0x7f0000000040)=""/18, 0xffffffde}, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, &(0x7f0000000dc0)=[{&(0x7f0000000100)="f4a4848461fb0592d2f8db4c1f3c9e408788e03d28fe5e69dbceea46dd67888cdedd07a068040b956c3af7", 0x2b}, {0x0}, {0x0}], 0x3, &(0x7f0000000540)=ANY=[@ANYBLOB="1400000000000000", @ANYRES32], 0x50}}, {{0x0, 0x0, &(0x7f0000003180)=[{0x0}, {0x0}], 0x2, &(0x7f00000002c0)=ANY=[@ANYBLOB="c9252cdfb191d94ef15953a086ed40b24a018fb18d39f9a1256b33cf339f1d1bb52846ddaaaecd492eb1d0774b26968a44bf794e9d902a3c02af9543bc4096ac7a27", @ANYRES32, @ANYRES32=0x0], 0x50, 0x4041}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYRESDEC, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000003000000000000000010000000100", @ANYRES32, @ANYRES64, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESDEC=r4], 0xd0, 0x20000000}}], 0x3, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x138, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {0x0, 0x0, 0x300}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x48, 0x1, {{'md5\x00'}}}]}, 0x138}}, 0x0) 09:54:14 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x9, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000e80)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) io_uring_enter(r1, 0x0, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x50}}], 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {}, {}, 0x0, 0x0, 0xa, 0x0, 0x0, 0x6}, [@algo_auth={0x58, 0x1, {{'md5\x00'}, 0x80, "f959fb7b2a535a87359f0b633f54f881"}}]}, 0x148}}, 0x0) 09:54:14 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1100}}}, 0xf0}}, 0x0) 09:54:14 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x6, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x700}) 09:54:14 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="5500000018687f083ffe15b282a380930a03000248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) [ 517.293391][T26897] netlink: 224 bytes leftover after parsing attributes in process `syz-executor.4'. [ 517.303526][ C1] sd 0:0:1:0: [sg_rq_end_io] Sense Key : Illegal Request [current] [ 517.311555][ C1] sd 0:0:1:0: [sg_rq_end_io] Add. Sense: Invalid command operation code 09:54:14 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x9, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000e80)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) io_uring_enter(r1, 0x0, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x50}}], 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {}, {}, 0x0, 0x0, 0xa, 0x0, 0x0, 0x7}, [@algo_auth={0x58, 0x1, {{'md5\x00'}, 0x80, "f959fb7b2a535a87359f0b633f54f881"}}]}, 0x148}}, 0x0) [ 517.523155][ C1] sd 0:0:1:0: [sg_rq_end_io] Sense Key : Illegal Request [current] [ 517.523160][T26914] netlink: 224 bytes leftover after parsing attributes in process `syz-executor.4'. [ 517.540540][ C1] sd 0:0:1:0: [sg_rq_end_io] Add. Sense: Invalid command operation code [ 517.617537][T26919] loop2: detected capacity change from 0 to 16383 [ 517.668334][T26919] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 517.673647][T26919] loop2: p1 size 11290111 extends beyond EOD, truncated [ 517.681364][T26919] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 517.689321][T26919] loop2: p5 size 11290111 extends beyond EOD, truncated [ 517.696676][T26919] loop2: p6 size 1912633224 extends beyond EOD, truncated [ 517.782347][T26919] loop2: detected capacity change from 0 to 16383 09:54:14 executing program 2: syz_read_part_table(0x0, 0x2, &(0x7f0000000100)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0000ffffff85000000060000000000024000ffffff82000000e104000088770072003007000f00000000000000008000da55aa", 0x40, 0x1c0}, {0x0, 0x0, 0xfffffffffffffffb}]) 09:54:14 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1200}}}, 0xf0}}, 0x0) 09:54:14 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) mkdirat(r1, &(0x7f00000000c0)='./file0\x00', 0x0) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r3 = syz_io_uring_setup(0x3ede, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000140)) io_uring_enter(r3, 0x2ff, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x5, 0x0, &(0x7f0000000040)=""/18, 0xffffffde}, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, &(0x7f0000000dc0)=[{&(0x7f0000000100)="f4a4848461fb0592d2f8db4c1f3c9e408788e03d28fe5e69dbceea46dd67888cdedd07a068040b956c3af7", 0x2b}, {0x0}, {0x0}], 0x3, &(0x7f0000000540)=ANY=[@ANYBLOB="1400000000000000", @ANYRES32], 0x50}}, {{0x0, 0x0, &(0x7f0000003180)=[{0x0}, {0x0}], 0x2, &(0x7f00000002c0)=ANY=[@ANYBLOB="c9252cdfb191d94ef15953a086ed40b24a018fb18d39f9a1256b33cf339f1d1bb52846ddaaaecd492eb1d0774b26968a44bf794e9d902a3c02af9543bc4096ac7a27", @ANYRES32, @ANYRES32=0x0], 0x50, 0x4041}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYRESDEC, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000003000000000000000010000000100", @ANYRES32, @ANYRES64, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESDEC=r4], 0xd0, 0x20000000}}], 0x3, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x138, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {0x0, 0x0, 0x500}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x48, 0x1, {{'md5\x00'}}}]}, 0x138}}, 0x0) 09:54:14 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x6, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x900}) 09:54:14 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x9, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000e80)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) io_uring_enter(r1, 0x0, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x50}}], 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {}, {}, 0x0, 0x0, 0xa, 0x0, 0x0, 0x8}, [@algo_auth={0x58, 0x1, {{'md5\x00'}, 0x80, "f959fb7b2a535a87359f0b633f54f881"}}]}, 0x148}}, 0x0) 09:54:14 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="55000000186c7f083ffe15b282a380930a03000248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) [ 517.832169][T26919] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 517.837542][T26919] loop2: p1 size 11290111 extends beyond EOD, truncated [ 517.845165][T26919] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 517.853003][T26919] loop2: p5 size 11290111 extends beyond EOD, truncated [ 517.860379][T26919] loop2: p6 size 1912633224 extends beyond EOD, truncated 09:54:14 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="5500000018747f083ffe15b282a380930a03000248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) 09:54:14 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x9, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000e80)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) io_uring_enter(r1, 0x0, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x50}}], 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {}, {}, 0x0, 0x0, 0xa, 0x0, 0x0, 0x9}, [@algo_auth={0x58, 0x1, {{'md5\x00'}, 0x80, "f959fb7b2a535a87359f0b633f54f881"}}]}, 0x148}}, 0x0) 09:54:14 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1e04}}}, 0xf0}}, 0x0) 09:54:14 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x6, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd00}) 09:54:14 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) mkdirat(r1, &(0x7f00000000c0)='./file0\x00', 0x0) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r3 = syz_io_uring_setup(0x3ede, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000140)) io_uring_enter(r3, 0x2ff, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x5, 0x0, &(0x7f0000000040)=""/18, 0xffffffde}, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, &(0x7f0000000dc0)=[{&(0x7f0000000100)="f4a4848461fb0592d2f8db4c1f3c9e408788e03d28fe5e69dbceea46dd67888cdedd07a068040b956c3af7", 0x2b}, {0x0}, {0x0}], 0x3, &(0x7f0000000540)=ANY=[@ANYBLOB="1400000000000000", @ANYRES32], 0x50}}, {{0x0, 0x0, &(0x7f0000003180)=[{0x0}, {0x0}], 0x2, &(0x7f00000002c0)=ANY=[@ANYBLOB="c9252cdfb191d94ef15953a086ed40b24a018fb18d39f9a1256b33cf339f1d1bb52846ddaaaecd492eb1d0774b26968a44bf794e9d902a3c02af9543bc4096ac7a27", @ANYRES32, @ANYRES32=0x0], 0x50, 0x4041}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYRESDEC, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000003000000000000000010000000100", @ANYRES32, @ANYRES64, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESDEC=r4], 0xd0, 0x20000000}}], 0x3, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x138, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {0x0, 0x0, 0x600}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x48, 0x1, {{'md5\x00'}}}]}, 0x138}}, 0x0) [ 517.918169][ C1] sd 0:0:1:0: [sg_rq_end_io] Sense Key : Illegal Request [current] [ 517.926189][ C1] sd 0:0:1:0: [sg_rq_end_io] Add. Sense: Invalid command operation code [ 517.932921][T26930] netlink: 224 bytes leftover after parsing attributes in process `syz-executor.4'. 09:54:15 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x9, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000e80)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) io_uring_enter(r1, 0x0, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x50}}], 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {}, {}, 0x0, 0x0, 0xa, 0x0, 0x0, 0xa}, [@algo_auth={0x58, 0x1, {{'md5\x00'}, 0x80, "f959fb7b2a535a87359f0b633f54f881"}}]}, 0x148}}, 0x0) 09:54:15 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="55000000187a7f083ffe15b282a380930a03000248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) [ 518.114240][T26940] selinux_netlink_send: 8 callbacks suppressed [ 518.114249][T26940] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=29720 sclass=netlink_route_socket pid=26940 comm=syz-executor.5 [ 518.133947][T26943] netlink: 224 bytes leftover after parsing attributes in process `syz-executor.4'. [ 518.143927][ C1] sd 0:0:1:0: [sg_rq_end_io] Sense Key : Illegal Request [current] [ 518.151948][ C1] sd 0:0:1:0: [sg_rq_end_io] Add. Sense: Invalid command operation code [ 518.212267][ T5552] udevd[5552]: inotify_add_watch(7, /dev/loop2p5, 10) failed: No such file or directory [ 518.212474][T16174] udevd[16174]: inotify_add_watch(7, /dev/loop2p4, 10) failed: No such file or directory [ 518.222897][ T5551] udevd[5551]: inotify_add_watch(7, /dev/loop2p6, 10) failed: No such file or directory [ 518.232859][ T5592] udevd[5592]: inotify_add_watch(7, /dev/loop2p1, 10) failed: No such file or directory [ 518.242762][T13989] udevd[13989]: inotify_add_watch(7, /dev/loop2p3, 10) failed: No such file or directory [ 518.254714][ T5428] udevd[5428]: inotify_add_watch(7, /dev/loop2p2, 10) failed: No such file or directory [ 518.261633][T26950] loop2: detected capacity change from 0 to 16383 [ 518.316464][ T5592] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 518.321806][ T5592] loop2: p1 size 11290111 extends beyond EOD, truncated [ 518.329796][ T5592] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 518.338467][ T5592] loop2: p5 size 11290111 extends beyond EOD, truncated [ 518.345735][ T5592] loop2: p6 size 1912633224 extends beyond EOD, truncated [ 518.356378][T26950] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 518.361680][T26950] loop2: p1 size 11290111 extends beyond EOD, truncated [ 518.369294][T26955] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=31256 sclass=netlink_route_socket pid=26955 comm=syz-executor.5 [ 518.381670][T26950] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 518.390998][T26950] loop2: p5 size 11290111 extends beyond EOD, truncated [ 518.398677][T26950] loop2: p6 size 1912633224 extends beyond EOD, truncated [ 518.477955][T26950] loop2: detected capacity change from 0 to 16383 [ 518.522596][ T5592] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 518.527896][ T5592] loop2: p1 size 11290111 extends beyond EOD, truncated [ 518.535717][ T5592] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 518.543573][ T5592] loop2: p5 size 11290111 extends beyond EOD, truncated [ 518.550720][ T5592] loop2: p6 size 1912633224 extends beyond EOD, truncated [ 518.560580][T26950] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 518.565824][T26950] loop2: p1 size 11290111 extends beyond EOD, truncated 09:54:15 executing program 2: syz_read_part_table(0x0, 0x2, &(0x7f0000000100)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0000ffffff85000000060000000000024000ffffff82000000e105000088770072003007000f00000000000000008000da55aa", 0x40, 0x1c0}, {0x0, 0x0, 0xfffffffffffffffb}]) 09:54:15 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x6, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe00}) 09:54:15 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000}}}, 0xf0}}, 0x0) 09:54:15 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x9, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000e80)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) io_uring_enter(r1, 0x0, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x50}}], 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {}, {}, 0x0, 0x0, 0xa, 0x0, 0x0, 0xb}, [@algo_auth={0x58, 0x1, {{'md5\x00'}, 0x80, "f959fb7b2a535a87359f0b633f54f881"}}]}, 0x148}}, 0x0) 09:54:15 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="5500000018fc7f083ffe15b282a380930a03000248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) 09:54:15 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) mkdirat(r1, &(0x7f00000000c0)='./file0\x00', 0x0) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r3 = syz_io_uring_setup(0x3ede, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000140)) io_uring_enter(r3, 0x2ff, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x5, 0x0, &(0x7f0000000040)=""/18, 0xffffffde}, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, &(0x7f0000000dc0)=[{&(0x7f0000000100)="f4a4848461fb0592d2f8db4c1f3c9e408788e03d28fe5e69dbceea46dd67888cdedd07a068040b956c3af7", 0x2b}, {0x0}, {0x0}], 0x3, &(0x7f0000000540)=ANY=[@ANYBLOB="1400000000000000", @ANYRES32], 0x50}}, {{0x0, 0x0, &(0x7f0000003180)=[{0x0}, {0x0}], 0x2, &(0x7f00000002c0)=ANY=[@ANYBLOB="c9252cdfb191d94ef15953a086ed40b24a018fb18d39f9a1256b33cf339f1d1bb52846ddaaaecd492eb1d0774b26968a44bf794e9d902a3c02af9543bc4096ac7a27", @ANYRES32, @ANYRES32=0x0], 0x50, 0x4041}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYRESDEC, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000003000000000000000010000000100", @ANYRES32, @ANYRES64, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESDEC=r4], 0xd0, 0x20000000}}], 0x3, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x138, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {0x0, 0x0, 0x700}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x48, 0x1, {{'md5\x00'}}}]}, 0x138}}, 0x0) [ 518.573230][T26950] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 518.581042][T26950] loop2: p5 size 11290111 extends beyond EOD, truncated [ 518.588413][T26950] loop2: p6 size 1912633224 extends beyond EOD, truncated 09:54:15 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="5500000018007f043ffe15b282a380930a03000248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) [ 518.644997][T26961] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=64536 sclass=netlink_route_socket pid=26961 comm=syz-executor.5 [ 518.645056][ C1] sd 0:0:1:0: [sg_rq_end_io] Sense Key : Illegal Request [current] [ 518.666107][ C1] sd 0:0:1:0: [sg_rq_end_io] Add. Sense: Invalid command operation code 09:54:15 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x9, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000e80)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) io_uring_enter(r1, 0x0, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x50}}], 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {}, {}, 0x0, 0x0, 0xa, 0x0, 0x0, 0x10}, [@algo_auth={0x58, 0x1, {{'md5\x00'}, 0x80, "f959fb7b2a535a87359f0b633f54f881"}}]}, 0x148}}, 0x0) 09:54:15 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x6, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1800}) 09:54:15 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2500}}}, 0xf0}}, 0x0) 09:54:15 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) mkdirat(r1, &(0x7f00000000c0)='./file0\x00', 0x0) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r3 = syz_io_uring_setup(0x3ede, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000140)) io_uring_enter(r3, 0x2ff, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x5, 0x0, &(0x7f0000000040)=""/18, 0xffffffde}, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, &(0x7f0000000dc0)=[{&(0x7f0000000100)="f4a4848461fb0592d2f8db4c1f3c9e408788e03d28fe5e69dbceea46dd67888cdedd07a068040b956c3af7", 0x2b}, {0x0}, {0x0}], 0x3, &(0x7f0000000540)=ANY=[@ANYBLOB="1400000000000000", @ANYRES32], 0x50}}, {{0x0, 0x0, &(0x7f0000003180)=[{0x0}, {0x0}], 0x2, &(0x7f00000002c0)=ANY=[@ANYBLOB="c9252cdfb191d94ef15953a086ed40b24a018fb18d39f9a1256b33cf339f1d1bb52846ddaaaecd492eb1d0774b26968a44bf794e9d902a3c02af9543bc4096ac7a27", @ANYRES32, @ANYRES32=0x0], 0x50, 0x4041}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYRESDEC, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000003000000000000000010000000100", @ANYRES32, @ANYRES64, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESDEC=r4], 0xd0, 0x20000000}}], 0x3, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x138, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {0x0, 0x0, 0x900}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x48, 0x1, {{'md5\x00'}}}]}, 0x138}}, 0x0) [ 518.688911][T26965] netlink: 224 bytes leftover after parsing attributes in process `syz-executor.4'. 09:54:15 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="5500000018007f353ffe15b282a380930a03000248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) [ 518.850896][ C1] sd 0:0:1:0: [sg_rq_end_io] Sense Key : Illegal Request [current] [ 518.858930][ C1] sd 0:0:1:0: [sg_rq_end_io] Add. Sense: Invalid command operation code [ 518.874853][T26978] netlink: 224 bytes leftover after parsing attributes in process `syz-executor.4'. [ 519.001038][T13989] udevd[13989]: inotify_add_watch(7, /dev/loop2p3, 10) failed: No such file or directory [ 519.005769][ T5428] udevd[5428]: inotify_add_watch(7, /dev/loop2p2, 10) failed: No such file or directory [ 519.011951][T16174] udevd[16174]: inotify_add_watch(7, /dev/loop2p4, 10) failed: No such file or directory [ 519.021594][ T5592] udevd[5592]: inotify_add_watch(7, /dev/loop2p1, 10) failed: No such file or directory [ 519.060835][T26986] loop2: detected capacity change from 0 to 16383 [ 519.099890][T26986] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 519.105231][T26986] loop2: p1 size 11290111 extends beyond EOD, truncated [ 519.112994][T26986] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 519.120728][T26986] loop2: p5 size 11290111 extends beyond EOD, truncated [ 519.127951][T26986] loop2: p6 size 1912633224 extends beyond EOD, truncated [ 519.230102][T26986] loop2: detected capacity change from 0 to 16383 [ 519.275003][T26986] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 519.280254][T26986] loop2: p1 size 11290111 extends beyond EOD, truncated [ 519.287966][T26986] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 519.295779][T26986] loop2: p5 size 11290111 extends beyond EOD, truncated [ 519.303006][T26986] loop2: p6 size 1912633224 extends beyond EOD, truncated 09:54:16 executing program 2: syz_read_part_table(0x0, 0x2, &(0x7f0000000100)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0000ffffff85000000060000000000024000ffffff82000000e106000088770072003007000f00000000000000008000da55aa", 0x40, 0x1c0}, {0x0, 0x0, 0xfffffffffffffffb}]) 09:54:16 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x9, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000e80)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) io_uring_enter(r1, 0x0, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x50}}], 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {}, {}, 0x0, 0x0, 0xa, 0x0, 0x0, 0x11}, [@algo_auth={0x58, 0x1, {{'md5\x00'}, 0x80, "f959fb7b2a535a87359f0b633f54f881"}}]}, 0x148}}, 0x0) 09:54:16 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x6, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1d2b}) 09:54:16 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3300}}}, 0xf0}}, 0x0) 09:54:16 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) mkdirat(r1, &(0x7f00000000c0)='./file0\x00', 0x0) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r3 = syz_io_uring_setup(0x3ede, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000140)) io_uring_enter(r3, 0x2ff, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x5, 0x0, &(0x7f0000000040)=""/18, 0xffffffde}, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, &(0x7f0000000dc0)=[{&(0x7f0000000100)="f4a4848461fb0592d2f8db4c1f3c9e408788e03d28fe5e69dbceea46dd67888cdedd07a068040b956c3af7", 0x2b}, {0x0}, {0x0}], 0x3, &(0x7f0000000540)=ANY=[@ANYBLOB="1400000000000000", @ANYRES32], 0x50}}, {{0x0, 0x0, &(0x7f0000003180)=[{0x0}, {0x0}], 0x2, &(0x7f00000002c0)=ANY=[@ANYBLOB="c9252cdfb191d94ef15953a086ed40b24a018fb18d39f9a1256b33cf339f1d1bb52846ddaaaecd492eb1d0774b26968a44bf794e9d902a3c02af9543bc4096ac7a27", @ANYRES32, @ANYRES32=0x0], 0x50, 0x4041}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYRESDEC, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000003000000000000000010000000100", @ANYRES32, @ANYRES64, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESDEC=r4], 0xd0, 0x20000000}}], 0x3, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x138, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {0x0, 0x0, 0xa00}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x48, 0x1, {{'md5\x00'}}}]}, 0x138}}, 0x0) 09:54:16 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="5500000018007f3b3ffe15b282a380930a03000248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) [ 519.369446][ T383] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 519.374761][ T383] loop2: p1 size 11290111 extends beyond EOD, truncated [ 519.392592][ T383] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 519.400569][ T383] loop2: p5 size 11290111 extends beyond EOD, truncated [ 519.407850][ T383] loop2: p6 size 1912633224 extends beyond EOD, truncated 09:54:16 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x9, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000e80)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) io_uring_enter(r1, 0x0, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x50}}], 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {}, {}, 0x0, 0x0, 0xa, 0x0, 0x0, 0x14}, [@algo_auth={0x58, 0x1, {{'md5\x00'}, 0x80, "f959fb7b2a535a87359f0b633f54f881"}}]}, 0x148}}, 0x0) 09:54:16 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="5500000018007f083ffc15b282a380930a03000248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) 09:54:16 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3e01}}}, 0xf0}}, 0x0) 09:54:16 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) mkdirat(r1, &(0x7f00000000c0)='./file0\x00', 0x0) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r3 = syz_io_uring_setup(0x3ede, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000140)) io_uring_enter(r3, 0x2ff, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x5, 0x0, &(0x7f0000000040)=""/18, 0xffffffde}, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, &(0x7f0000000dc0)=[{&(0x7f0000000100)="f4a4848461fb0592d2f8db4c1f3c9e408788e03d28fe5e69dbceea46dd67888cdedd07a068040b956c3af7", 0x2b}, {0x0}, {0x0}], 0x3, &(0x7f0000000540)=ANY=[@ANYBLOB="1400000000000000", @ANYRES32], 0x50}}, {{0x0, 0x0, &(0x7f0000003180)=[{0x0}, {0x0}], 0x2, &(0x7f00000002c0)=ANY=[@ANYBLOB="c9252cdfb191d94ef15953a086ed40b24a018fb18d39f9a1256b33cf339f1d1bb52846ddaaaecd492eb1d0774b26968a44bf794e9d902a3c02af9543bc4096ac7a27", @ANYRES32, @ANYRES32=0x0], 0x50, 0x4041}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYRESDEC, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000003000000000000000010000000100", @ANYRES32, @ANYRES64, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESDEC=r4], 0xd0, 0x20000000}}], 0x3, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x138, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {0x0, 0x0, 0xb00}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x48, 0x1, {{'md5\x00'}}}]}, 0x138}}, 0x0) 09:54:16 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x6, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2b1d}) [ 519.444019][T26995] netlink: 224 bytes leftover after parsing attributes in process `syz-executor.4'. [ 519.454266][ C1] sd 0:0:1:0: [sg_rq_end_io] Sense Key : Illegal Request [current] [ 519.462309][ C1] sd 0:0:1:0: [sg_rq_end_io] Add. Sense: Invalid command operation code 09:54:16 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x9, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000e80)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) io_uring_enter(r1, 0x0, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x50}}], 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x3, 0x1, {{'md5\x00'}, 0x80, "f959fb7b2a535a87359f0b633f54f881"}}]}, 0x148}}, 0x0) [ 519.648599][T27006] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 519.659556][T27007] netlink: 224 bytes leftover after parsing attributes in process `syz-executor.4'. [ 519.668335][ C1] scsi_io_completion_action: 13 callbacks suppressed [ 519.668360][ C1] sd 0:0:1:0: tag#6046 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 519.685406][ C1] sd 0:0:1:0: tag#6046 CDB: opcode=0xe5 (vendor) [ 519.691732][ C1] sd 0:0:1:0: tag#6046 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 519.700767][ C1] sd 0:0:1:0: tag#6046 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 519.709831][ C1] sd 0:0:1:0: tag#6046 CDB[20]: ba [ 519.716830][ C1] sd 0:0:1:0: [sg_rq_end_io] Sense Key : Illegal Request [current] [ 519.724840][ C1] sd 0:0:1:0: [sg_rq_end_io] Add. Sense: Invalid command operation code [ 519.726882][ C0] sd 0:0:1:0: tag#6049 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 519.742972][ C0] sd 0:0:1:0: tag#6049 CDB: opcode=0xe5 (vendor) [ 519.749299][ C0] sd 0:0:1:0: tag#6049 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 519.758318][ C0] sd 0:0:1:0: tag#6049 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 519.767336][ C0] sd 0:0:1:0: tag#6049 CDB[20]: ba [ 519.843500][T27013] loop2: detected capacity change from 0 to 16383 [ 519.880755][T27015] netlink: 88 bytes leftover after parsing attributes in process `syz-executor.0'. [ 519.903747][ T5592] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 519.909048][ T5592] loop2: p1 size 11290111 extends beyond EOD, truncated [ 519.916758][ T5592] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 519.924919][ T5592] loop2: p5 size 11290111 extends beyond EOD, truncated [ 519.932331][ T5592] loop2: p6 size 1912633224 extends beyond EOD, truncated [ 519.942475][T27013] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 519.947811][T27013] loop2: p1 size 11290111 extends beyond EOD, truncated [ 519.955443][T27013] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 519.963128][T27013] loop2: p5 size 11290111 extends beyond EOD, truncated [ 519.970524][T27013] loop2: p6 size 1912633224 extends beyond EOD, truncated [ 520.060342][T27013] loop2: detected capacity change from 0 to 16383 [ 520.099472][ T5592] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 520.104722][ T5592] loop2: p1 size 11290111 extends beyond EOD, truncated [ 520.112296][ T5592] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 520.120035][ T5592] loop2: p5 size 11290111 extends beyond EOD, truncated [ 520.127268][ T5592] loop2: p6 size 1912633224 extends beyond EOD, truncated [ 520.137350][T27013] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 520.142605][T27013] loop2: p1 size 11290111 extends beyond EOD, truncated [ 520.150144][T27013] loop2: p3 size 1912633224 extends beyond EOD, truncated 09:54:17 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4800}}}, 0xf0}}, 0x0) 09:54:17 executing program 2: syz_read_part_table(0x0, 0x2, &(0x7f0000000100)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0000ffffff85000000060000000000024000ffffff82000000e107000088770072003007000f00000000000000008000da55aa", 0x40, 0x1c0}, {0x0, 0x0, 0xfffffffffffffffb}]) 09:54:17 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="5500000018007f083ffe05b282a380930a03000248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) 09:54:17 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x6, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000}) 09:54:17 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) mkdirat(r1, &(0x7f00000000c0)='./file0\x00', 0x0) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r3 = syz_io_uring_setup(0x3ede, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000140)) io_uring_enter(r3, 0x2ff, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x5, 0x0, &(0x7f0000000040)=""/18, 0xffffffde}, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, &(0x7f0000000dc0)=[{&(0x7f0000000100)="f4a4848461fb0592d2f8db4c1f3c9e408788e03d28fe5e69dbceea46dd67888cdedd07a068040b956c3af7", 0x2b}, {0x0}, {0x0}], 0x3, &(0x7f0000000540)=ANY=[@ANYBLOB="1400000000000000", @ANYRES32], 0x50}}, {{0x0, 0x0, &(0x7f0000003180)=[{0x0}, {0x0}], 0x2, &(0x7f00000002c0)=ANY=[@ANYBLOB="c9252cdfb191d94ef15953a086ed40b24a018fb18d39f9a1256b33cf339f1d1bb52846ddaaaecd492eb1d0774b26968a44bf794e9d902a3c02af9543bc4096ac7a27", @ANYRES32, @ANYRES32=0x0], 0x50, 0x4041}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYRESDEC, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000003000000000000000010000000100", @ANYRES32, @ANYRES64, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESDEC=r4], 0xd0, 0x20000000}}], 0x3, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x138, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {0x0, 0x0, 0x1100}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x48, 0x1, {{'md5\x00'}}}]}, 0x138}}, 0x0) 09:54:17 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x9, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000e80)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) io_uring_enter(r1, 0x0, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x50}}], 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x4, 0x1, {{'md5\x00'}, 0x80, "f959fb7b2a535a87359f0b633f54f881"}}]}, 0x148}}, 0x0) [ 520.158008][T27013] loop2: p5 size 11290111 extends beyond EOD, truncated [ 520.165312][T27013] loop2: p6 size 1912633224 extends beyond EOD, truncated 09:54:17 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="5500000018007f083ffe18b282a380930a03000248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) 09:54:17 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4c00}}}, 0xf0}}, 0x0) [ 520.221210][T27025] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 520.232561][ C1] sd 0:0:1:0: [sg_rq_end_io] Sense Key : Illegal Request [current] [ 520.240694][ C1] sd 0:0:1:0: [sg_rq_end_io] Add. Sense: Invalid command operation code 09:54:17 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x9, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000e80)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) io_uring_enter(r1, 0x0, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x50}}], 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x1d0, 0x1, {{'md5\x00'}, 0x80, "f959fb7b2a535a87359f0b633f54f881"}}]}, 0x148}}, 0x0) 09:54:17 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x6, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000}) 09:54:17 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) mkdirat(r1, &(0x7f00000000c0)='./file0\x00', 0x0) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r3 = syz_io_uring_setup(0x3ede, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000140)) io_uring_enter(r3, 0x2ff, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x5, 0x0, &(0x7f0000000040)=""/18, 0xffffffde}, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, &(0x7f0000000dc0)=[{&(0x7f0000000100)="f4a4848461fb0592d2f8db4c1f3c9e408788e03d28fe5e69dbceea46dd67888cdedd07a068040b956c3af7", 0x2b}, {0x0}, {0x0}], 0x3, &(0x7f0000000540)=ANY=[@ANYBLOB="1400000000000000", @ANYRES32], 0x50}}, {{0x0, 0x0, &(0x7f0000003180)=[{0x0}, {0x0}], 0x2, &(0x7f00000002c0)=ANY=[@ANYBLOB="c9252cdfb191d94ef15953a086ed40b24a018fb18d39f9a1256b33cf339f1d1bb52846ddaaaecd492eb1d0774b26968a44bf794e9d902a3c02af9543bc4096ac7a27", @ANYRES32, @ANYRES32=0x0], 0x50, 0x4041}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYRESDEC, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000003000000000000000010000000100", @ANYRES32, @ANYRES64, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESDEC=r4], 0xd0, 0x20000000}}], 0x3, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x138, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {0x0, 0x0, 0x1400}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x48, 0x1, {{'md5\x00'}}}]}, 0x138}}, 0x0) [ 520.266158][ C1] sd 0:0:1:0: tag#6027 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 520.275998][ C1] sd 0:0:1:0: tag#6027 CDB: opcode=0xe5 (vendor) [ 520.282321][ C1] sd 0:0:1:0: tag#6027 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 520.291358][ C1] sd 0:0:1:0: tag#6027 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 520.300407][ C1] sd 0:0:1:0: tag#6027 CDB[20]: ba 09:54:17 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="5500000018007f083ffe15b282a380932503000248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) 09:54:17 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6000}}}, 0xf0}}, 0x0) [ 520.412636][T27037] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 520.422937][ C1] sd 0:0:1:0: [sg_rq_end_io] Sense Key : Illegal Request [current] [ 520.430949][ C1] sd 0:0:1:0: [sg_rq_end_io] Add. Sense: Invalid command operation code [ 520.452164][ C0] sd 0:0:1:0: tag#6037 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 520.462010][ C0] sd 0:0:1:0: tag#6037 CDB: opcode=0xe5 (vendor) [ 520.468345][ C0] sd 0:0:1:0: tag#6037 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 520.477378][ C0] sd 0:0:1:0: tag#6037 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 520.486404][ C0] sd 0:0:1:0: tag#6037 CDB[20]: ba [ 520.500482][ C0] sd 0:0:1:0: tag#6017 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 520.510313][ C0] sd 0:0:1:0: tag#6017 CDB: opcode=0xe5 (vendor) [ 520.516653][ C0] sd 0:0:1:0: tag#6017 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 520.525695][ C0] sd 0:0:1:0: tag#6017 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 520.534714][ C0] sd 0:0:1:0: tag#6017 CDB[20]: ba [ 520.566156][T27043] loop2: detected capacity change from 0 to 16383 [ 520.604768][ T5592] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 520.610091][ T5592] loop2: p1 size 11290111 extends beyond EOD, truncated [ 520.617689][ T5592] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 520.625575][ T5592] loop2: p5 size 11290111 extends beyond EOD, truncated [ 520.633003][ T5592] loop2: p6 size 1912633224 extends beyond EOD, truncated [ 520.643594][T27043] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 520.648876][T27043] loop2: p1 size 11290111 extends beyond EOD, truncated [ 520.656862][T27043] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 520.665039][T27043] loop2: p5 size 11290111 extends beyond EOD, truncated [ 520.672401][T27043] loop2: p6 size 1912633224 extends beyond EOD, truncated 09:54:17 executing program 2: syz_read_part_table(0x0, 0x2, &(0x7f0000000100)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0000ffffff85000000060000000000024000ffffff82000000e108000088770072003007000f00000000000000008000da55aa", 0x40, 0x1c0}, {0x0, 0x0, 0xfffffffffffffffb}]) 09:54:17 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x6, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000}) 09:54:17 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x9, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000e80)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) io_uring_enter(r1, 0x0, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x50}}], 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x58, 0x8, {{'md5\x00'}, 0x80, "f959fb7b2a535a87359f0b633f54f881"}}]}, 0x148}}, 0x0) 09:54:17 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) mkdirat(r1, &(0x7f00000000c0)='./file0\x00', 0x0) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r3 = syz_io_uring_setup(0x3ede, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000140)) io_uring_enter(r3, 0x2ff, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x5, 0x0, &(0x7f0000000040)=""/18, 0xffffffde}, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, &(0x7f0000000dc0)=[{&(0x7f0000000100)="f4a4848461fb0592d2f8db4c1f3c9e408788e03d28fe5e69dbceea46dd67888cdedd07a068040b956c3af7", 0x2b}, {0x0}, {0x0}], 0x3, &(0x7f0000000540)=ANY=[@ANYBLOB="1400000000000000", @ANYRES32], 0x50}}, {{0x0, 0x0, &(0x7f0000003180)=[{0x0}, {0x0}], 0x2, &(0x7f00000002c0)=ANY=[@ANYBLOB="c9252cdfb191d94ef15953a086ed40b24a018fb18d39f9a1256b33cf339f1d1bb52846ddaaaecd492eb1d0774b26968a44bf794e9d902a3c02af9543bc4096ac7a27", @ANYRES32, @ANYRES32=0x0], 0x50, 0x4041}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYRESDEC, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000003000000000000000010000000100", @ANYRES32, @ANYRES64, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESDEC=r4], 0xd0, 0x20000000}}], 0x3, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x138, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {0x0, 0x0, 0x2000}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x48, 0x1, {{'md5\x00'}}}]}, 0x138}}, 0x0) 09:54:17 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="5500000018007f083ffe15b282a380930a02000248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) 09:54:17 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6800}}}, 0xf0}}, 0x0) [ 520.770174][T27055] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 520.777474][T27055] IPv6: NLM_F_CREATE should be set when creating new route [ 520.780779][ C0] sd 0:0:1:0: tag#6057 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 520.784725][T27055] IPv6: NLM_F_CREATE should be set when creating new route [ 520.794519][ C0] sd 0:0:1:0: tag#6057 CDB: opcode=0xe5 (vendor) [ 520.807999][ C0] sd 0:0:1:0: tag#6057 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c 09:54:17 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x9, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000e80)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) io_uring_enter(r1, 0x0, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x50}}], 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x58, 0x300, {{'md5\x00'}, 0x80, "f959fb7b2a535a87359f0b633f54f881"}}]}, 0x148}}, 0x0) 09:54:17 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="5500000018007f083ffe15b282a380930a04000248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) 09:54:17 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6c00}}}, 0xf0}}, 0x0) 09:54:17 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x6, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6000000}) 09:54:17 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) mkdirat(r1, &(0x7f00000000c0)='./file0\x00', 0x0) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r3 = syz_io_uring_setup(0x3ede, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000140)) io_uring_enter(r3, 0x2ff, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x5, 0x0, &(0x7f0000000040)=""/18, 0xffffffde}, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, &(0x7f0000000dc0)=[{&(0x7f0000000100)="f4a4848461fb0592d2f8db4c1f3c9e408788e03d28fe5e69dbceea46dd67888cdedd07a068040b956c3af7", 0x2b}, {0x0}, {0x0}], 0x3, &(0x7f0000000540)=ANY=[@ANYBLOB="1400000000000000", @ANYRES32], 0x50}}, {{0x0, 0x0, &(0x7f0000003180)=[{0x0}, {0x0}], 0x2, &(0x7f00000002c0)=ANY=[@ANYBLOB="c9252cdfb191d94ef15953a086ed40b24a018fb18d39f9a1256b33cf339f1d1bb52846ddaaaecd492eb1d0774b26968a44bf794e9d902a3c02af9543bc4096ac7a27", @ANYRES32, @ANYRES32=0x0], 0x50, 0x4041}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYRESDEC, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000003000000000000000010000000100", @ANYRES32, @ANYRES64, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESDEC=r4], 0xd0, 0x20000000}}], 0x3, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x138, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {0x0, 0x0, 0x3f00}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x48, 0x1, {{'md5\x00'}}}]}, 0x138}}, 0x0) [ 520.817035][ C0] sd 0:0:1:0: tag#6057 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 520.826066][ C0] sd 0:0:1:0: tag#6057 CDB[20]: ba [ 520.832215][ C1] sd 0:0:1:0: [sg_rq_end_io] Sense Key : Illegal Request [current] [ 520.840226][ C1] sd 0:0:1:0: [sg_rq_end_io] Add. Sense: Invalid command operation code 09:54:17 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x9, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000e80)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) io_uring_enter(r1, 0x0, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x50}}], 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x58, 0x1, {{'md5\x00'}, 0x13000000, "f959fb7b2a535a87359f0b633f54f881"}}]}, 0x148}}, 0x0) [ 520.944559][T27067] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 520.951791][T27067] IPv6: NLM_F_CREATE should be set when creating new route [ 520.959017][T27067] IPv6: NLM_F_CREATE should be set when creating new route [ 520.966832][T27070] loop2: detected capacity change from 0 to 16383 [ 521.002746][ C1] sd 0:0:1:0: [sg_rq_end_io] Sense Key : Illegal Request [current] [ 521.010738][ C1] sd 0:0:1:0: [sg_rq_end_io] Add. Sense: Invalid command operation code [ 521.025922][ C0] sd 0:0:1:0: tag#6016 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 521.030108][ T5592] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 521.035786][ C0] sd 0:0:1:0: tag#6016 CDB: opcode=0xe5 (vendor) [ 521.035804][ C0] sd 0:0:1:0: tag#6016 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 521.035844][ C0] sd 0:0:1:0: tag#6016 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 521.041125][ T5592] loop2: p1 size 11290111 extends beyond EOD, [ 521.047315][ C0] sd 0:0:1:0: tag#6016 CDB[20]: ba [ 521.056344][ T5592] truncated [ 521.078568][ C0] sd 0:0:1:0: tag#6020 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 521.081264][ T5592] loop2: p3 size 1912633224 extends beyond EOD, [ 521.089461][ C0] sd 0:0:1:0: tag#6020 CDB: opcode=0xe5 (vendor) [ 521.089484][ C0] sd 0:0:1:0: tag#6020 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 521.089514][ C0] sd 0:0:1:0: tag#6020 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 521.095794][ T5592] truncated [ 521.096784][ T5592] loop2: p5 size 11290111 extends beyond EOD, [ 521.102149][ C0] sd 0:0:1:0: tag#6020 CDB[20]: ba [ 521.111144][ T5592] truncated [ 521.138980][ T5592] loop2: p6 size 1912633224 extends beyond EOD, truncated [ 521.150020][T27070] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 521.155313][T27070] loop2: p1 size 11290111 extends beyond EOD, truncated [ 521.162930][T27070] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 521.170854][T27070] loop2: p5 size 11290111 extends beyond EOD, truncated [ 521.178977][T27070] loop2: p6 size 1912633224 extends beyond EOD, truncated [ 521.311185][T27070] loop2: detected capacity change from 0 to 16383 [ 521.377457][ T5592] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 521.382717][ T5592] loop2: p1 size 11290111 extends beyond EOD, truncated [ 521.390441][ T5592] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 521.398292][ T5592] loop2: p5 size 11290111 extends beyond EOD, truncated [ 521.405447][ T5592] loop2: p6 size 1912633224 extends beyond EOD, truncated [ 521.415177][T27070] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 521.420417][T27070] loop2: p1 size 11290111 extends beyond EOD, truncated 09:54:18 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="5500000018007f083ffe15b282a380930a05000248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) 09:54:18 executing program 2: syz_read_part_table(0x0, 0x2, &(0x7f0000000100)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0000ffffff85000000060000000000024000ffffff82000000e10a000088770072003007000f00000000000000008000da55aa", 0x40, 0x1c0}, {0x0, 0x0, 0xfffffffffffffffb}]) 09:54:18 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7400}}}, 0xf0}}, 0x0) 09:54:18 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x6, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7000000}) 09:54:18 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x9, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000e80)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) io_uring_enter(r1, 0x0, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x50}}], 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x58, 0x1, {{'md5\x00'}, 0x80, "f959fb7b2a535a87359f05633f54f881"}}]}, 0x148}}, 0x0) 09:54:18 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) mkdirat(r1, &(0x7f00000000c0)='./file0\x00', 0x0) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r3 = syz_io_uring_setup(0x3ede, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000140)) io_uring_enter(r3, 0x2ff, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x5, 0x0, &(0x7f0000000040)=""/18, 0xffffffde}, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, &(0x7f0000000dc0)=[{&(0x7f0000000100)="f4a4848461fb0592d2f8db4c1f3c9e408788e03d28fe5e69dbceea46dd67888cdedd07a068040b956c3af7", 0x2b}, {0x0}, {0x0}], 0x3, &(0x7f0000000540)=ANY=[@ANYBLOB="1400000000000000", @ANYRES32], 0x50}}, {{0x0, 0x0, &(0x7f0000003180)=[{0x0}, {0x0}], 0x2, &(0x7f00000002c0)=ANY=[@ANYBLOB="c9252cdfb191d94ef15953a086ed40b24a018fb18d39f9a1256b33cf339f1d1bb52846ddaaaecd492eb1d0774b26968a44bf794e9d902a3c02af9543bc4096ac7a27", @ANYRES32, @ANYRES32=0x0], 0x50, 0x4041}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYRESDEC, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000003000000000000000010000000100", @ANYRES32, @ANYRES64, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESDEC=r4], 0xd0, 0x20000000}}], 0x3, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x138, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {0x0, 0x0, 0x4000}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x48, 0x1, {{'md5\x00'}}}]}, 0x138}}, 0x0) [ 521.428035][T27070] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 521.435784][T27070] loop2: p5 size 11290111 extends beyond EOD, truncated [ 521.443145][T27070] loop2: p6 size 1912633224 extends beyond EOD, truncated [ 521.511392][ C1] sd 0:0:1:0: [sg_rq_end_io] Sense Key : Illegal Request [current] [ 521.519554][ C1] sd 0:0:1:0: [sg_rq_end_io] Add. Sense: Invalid command operation code [ 521.526217][ C0] sd 0:0:1:0: tag#6061 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 521.537771][ C0] sd 0:0:1:0: tag#6061 CDB: opcode=0xe5 (vendor) [ 521.544123][ C0] sd 0:0:1:0: tag#6061 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 521.545151][T27087] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE 09:54:18 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a00}}}, 0xf0}}, 0x0) 09:54:18 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x9, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000e80)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) io_uring_enter(r1, 0x0, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x50}}], 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x58, 0x1, {{'md5\x00'}, 0x80, "f959fb7b2a535a87359f22633f54f881"}}]}, 0x148}}, 0x0) 09:54:18 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x6, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9000000}) 09:54:18 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="5500000018007f083ffe15b282a380930a06000248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) 09:54:18 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) mkdirat(r1, &(0x7f00000000c0)='./file0\x00', 0x0) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r3 = syz_io_uring_setup(0x3ede, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000140)) io_uring_enter(r3, 0x2ff, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x5, 0x0, &(0x7f0000000040)=""/18, 0xffffffde}, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, &(0x7f0000000dc0)=[{&(0x7f0000000100)="f4a4848461fb0592d2f8db4c1f3c9e408788e03d28fe5e69dbceea46dd67888cdedd07a068040b956c3af7", 0x2b}, {0x0}, {0x0}], 0x3, &(0x7f0000000540)=ANY=[@ANYBLOB="1400000000000000", @ANYRES32], 0x50}}, {{0x0, 0x0, &(0x7f0000003180)=[{0x0}, {0x0}], 0x2, &(0x7f00000002c0)=ANY=[@ANYBLOB="c9252cdfb191d94ef15953a086ed40b24a018fb18d39f9a1256b33cf339f1d1bb52846ddaaaecd492eb1d0774b26968a44bf794e9d902a3c02af9543bc4096ac7a27", @ANYRES32, @ANYRES32=0x0], 0x50, 0x4041}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYRESDEC, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000003000000000000000010000000100", @ANYRES32, @ANYRES64, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESDEC=r4], 0xd0, 0x20000000}}], 0x3, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x138, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {0x0, 0x0, 0xb002}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x48, 0x1, {{'md5\x00'}}}]}, 0x138}}, 0x0) [ 521.553161][ C0] sd 0:0:1:0: tag#6061 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 521.553182][ C0] sd 0:0:1:0: tag#6061 CDB[20]: ba [ 521.560341][T27087] IPv6: NLM_F_CREATE should be set when creating new route [ 521.581613][T27087] IPv6: NLM_F_CREATE should be set when creating new route 09:54:18 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc00e}}}, 0xf0}}, 0x0) 09:54:18 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x9, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000e80)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) io_uring_enter(r1, 0x0, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x50}}], 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x58, 0x1, {{'md5\x00'}, 0x80, "f959fb7b2a535a87359f0b633f44f881"}}]}, 0x148}}, 0x0) 09:54:18 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x6, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd000000}) [ 521.722224][ C1] sd 0:0:1:0: [sg_rq_end_io] Sense Key : Illegal Request [current] [ 521.730255][ C1] sd 0:0:1:0: [sg_rq_end_io] Add. Sense: Invalid command operation code [ 521.764661][T27103] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 521.765146][ C1] sd 0:0:1:0: tag#6041 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 521.771876][T27103] IPv6: NLM_F_CREATE should be set when creating new route [ 521.781682][ C1] sd 0:0:1:0: tag#6041 CDB: opcode=0xe5 (vendor) [ 521.788840][T27103] IPv6: NLM_F_CREATE should be set when creating new route [ 521.795152][ C1] sd 0:0:1:0: tag#6041 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 521.811381][ C1] sd 0:0:1:0: tag#6041 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 521.820460][ C1] sd 0:0:1:0: tag#6041 CDB[20]: ba [ 521.902142][T27109] loop2: detected capacity change from 0 to 16383 [ 521.944066][ C1] sd 0:0:1:0: [sg_rq_end_io] Sense Key : Illegal Request [current] [ 521.944212][ T5592] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 521.952081][ C1] sd 0:0:1:0: [sg_rq_end_io] Add. Sense: Invalid command operation code [ 521.965753][ T5592] loop2: p1 size 11290111 extends beyond EOD, truncated [ 521.973897][ T5592] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 521.981758][ T5592] loop2: p5 size 11290111 extends beyond EOD, truncated [ 521.989037][ T5592] loop2: p6 size 1912633224 extends beyond EOD, truncated [ 521.999183][T27109] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 522.004474][T27109] loop2: p1 size 11290111 extends beyond EOD, truncated [ 522.012253][T27109] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 522.020130][T27109] loop2: p5 size 11290111 extends beyond EOD, truncated [ 522.027432][T27109] loop2: p6 size 1912633224 extends beyond EOD, truncated [ 522.167317][T27109] loop2: detected capacity change from 0 to 16383 [ 522.212849][T27109] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 522.218159][T27109] loop2: p1 size 11290111 extends beyond EOD, truncated [ 522.225879][T27109] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 522.233761][T27109] loop2: p5 size 11290111 extends beyond EOD, truncated [ 522.241017][T27109] loop2: p6 size 1912633224 extends beyond EOD, truncated 09:54:19 executing program 2: syz_read_part_table(0x0, 0x2, &(0x7f0000000100)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0000ffffff85000000060000000000024000ffffff82000000e10b000088770072003007000f00000000000000008000da55aa", 0x40, 0x1c0}, {0x0, 0x0, 0xfffffffffffffffb}]) 09:54:19 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="5500000018007f083ffe15b282a380930a07000248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) 09:54:19 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) mkdirat(r1, &(0x7f00000000c0)='./file0\x00', 0x0) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r3 = syz_io_uring_setup(0x3ede, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000140)) io_uring_enter(r3, 0x2ff, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x5, 0x0, &(0x7f0000000040)=""/18, 0xffffffde}, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, &(0x7f0000000dc0)=[{&(0x7f0000000100)="f4a4848461fb0592d2f8db4c1f3c9e408788e03d28fe5e69dbceea46dd67888cdedd07a068040b956c3af7", 0x2b}, {0x0}, {0x0}], 0x3, &(0x7f0000000540)=ANY=[@ANYBLOB="1400000000000000", @ANYRES32], 0x50}}, {{0x0, 0x0, &(0x7f0000003180)=[{0x0}, {0x0}], 0x2, &(0x7f00000002c0)=ANY=[@ANYBLOB="c9252cdfb191d94ef15953a086ed40b24a018fb18d39f9a1256b33cf339f1d1bb52846ddaaaecd492eb1d0774b26968a44bf794e9d902a3c02af9543bc4096ac7a27", @ANYRES32, @ANYRES32=0x0], 0x50, 0x4041}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYRESDEC, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000003000000000000000010000000100", @ANYRES32, @ANYRES64, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESDEC=r4], 0xd0, 0x20000000}}], 0x3, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x138, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {0x0, 0x0, 0x1000000}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x48, 0x1, {{'md5\x00'}}}]}, 0x138}}, 0x0) 09:54:19 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x34000}}}, 0xf0}}, 0x0) 09:54:19 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x9, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000e80)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) io_uring_enter(r1, 0x0, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x50}}], 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x58, 0x1, {{'md5\x00'}, 0x80, "f959fb7b2a535a87359f0b633f54f881"}}]}, 0xf}}, 0x0) 09:54:19 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x6, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe000000}) 09:54:19 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400300}}}, 0xf0}}, 0x0) [ 522.358470][T27120] __nla_validate_parse: 10 callbacks suppressed [ 522.358484][T27120] netlink: 224 bytes leftover after parsing attributes in process `syz-executor.4'. [ 522.379944][T27124] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 522.380072][ C1] sd 0:0:1:0: [sg_rq_end_io] Sense Key : Illegal Request [current] [ 522.387157][T27124] IPv6: NLM_F_CREATE should be set when creating new route 09:54:19 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x9, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000e80)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) io_uring_enter(r1, 0x0, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x50}}], 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x58, 0x1, {{'md5\x00'}, 0x80, "f959fb7b2a535a87359f0b633f54f881"}}]}, 0x10}}, 0x0) 09:54:19 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="5500000018007f083ffe15b282a380930a08000248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) 09:54:19 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x6, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffff}) 09:54:19 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) mkdirat(r1, &(0x7f00000000c0)='./file0\x00', 0x0) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r3 = syz_io_uring_setup(0x3ede, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000140)) io_uring_enter(r3, 0x2ff, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x5, 0x0, &(0x7f0000000040)=""/18, 0xffffffde}, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, &(0x7f0000000dc0)=[{&(0x7f0000000100)="f4a4848461fb0592d2f8db4c1f3c9e408788e03d28fe5e69dbceea46dd67888cdedd07a068040b956c3af7", 0x2b}, {0x0}, {0x0}], 0x3, &(0x7f0000000540)=ANY=[@ANYBLOB="1400000000000000", @ANYRES32], 0x50}}, {{0x0, 0x0, &(0x7f0000003180)=[{0x0}, {0x0}], 0x2, &(0x7f00000002c0)=ANY=[@ANYBLOB="c9252cdfb191d94ef15953a086ed40b24a018fb18d39f9a1256b33cf339f1d1bb52846ddaaaecd492eb1d0774b26968a44bf794e9d902a3c02af9543bc4096ac7a27", @ANYRES32, @ANYRES32=0x0], 0x50, 0x4041}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYRESDEC, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000003000000000000000010000000100", @ANYRES32, @ANYRES64, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESDEC=r4], 0xd0, 0x20000000}}], 0x3, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x138, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {0x0, 0x0, 0x2000000}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x48, 0x1, {{'md5\x00'}}}]}, 0x138}}, 0x0) [ 522.387167][T27124] IPv6: NLM_F_CREATE should be set when creating new route [ 522.409507][ C1] sd 0:0:1:0: [sg_rq_end_io] Add. Sense: Invalid command operation code [ 522.429987][T27127] netlink: 72 bytes leftover after parsing attributes in process `syz-executor.1'. 09:54:19 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000}}}, 0xf0}}, 0x0) [ 522.551968][T27133] netlink: 224 bytes leftover after parsing attributes in process `syz-executor.4'. [ 522.552250][T27134] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 522.568579][T27134] IPv6: NLM_F_CREATE should be set when creating new route [ 522.575777][T27134] IPv6: NLM_F_CREATE should be set when creating new route [ 522.588336][ C1] sd 0:0:1:0: [sg_rq_end_io] Sense Key : Illegal Request [current] [ 522.596380][ C1] sd 0:0:1:0: [sg_rq_end_io] Add. Sense: Invalid command operation code [ 522.679017][ T5428] ================================================================== [ 522.687087][ T5428] BUG: KCSAN: data-race in __dentry_kill / d_set_d_op [ 522.693824][ T5428] [ 522.696123][ T5428] write to 0xffff8881388f3cc0 of 4 bytes by task 5552 on cpu 1: [ 522.703727][ T5428] d_set_d_op+0x17f/0x220 [ 522.708031][ T5428] simple_lookup+0x78/0x90 [ 522.712422][ T5428] __lookup_slow+0x182/0x250 [ 522.716988][ T5428] walk_component+0x2b6/0x360 [ 522.721643][ T5428] path_lookupat+0x12d/0x3d0 [ 522.726206][ T5428] filename_lookup+0x130/0x310 [ 522.730942][ T5428] user_path_at_empty+0x3e/0x110 [ 522.735853][ T5428] vfs_statx+0xa9/0x2a0 [ 522.739982][ T5428] __se_sys_newfstatat+0x63/0x260 [ 522.744982][ T5428] __x64_sys_newfstatat+0x51/0x60 [ 522.750020][ T5428] do_syscall_64+0x44/0xa0 [ 522.754413][ T5428] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 522.760320][ T5428] [ 522.762618][ T5428] read to 0xffff8881388f3cc0 of 4 bytes by task 5428 on cpu 0: [ 522.770127][ T5428] __dentry_kill+0x1ef/0x450 [ 522.774689][ T5428] dput+0x218/0x430 [ 522.778470][ T5428] step_into+0x468/0xee0 [ 522.782692][ T5428] path_openat+0x1059/0x1eb0 [ 522.787291][ T5428] do_filp_open+0x105/0x220 [ 522.791774][ T5428] do_sys_openat2+0xb5/0x2b0 [ 522.796342][ T5428] __x64_sys_openat+0xef/0x110 [ 522.801081][ T5428] do_syscall_64+0x44/0xa0 [ 522.805474][ T5428] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 522.811343][ T5428] [ 522.813677][ T5428] value changed: 0x10000000 -> 0x00000008 [ 522.819363][ T5428] [ 522.821658][ T5428] Reported by Kernel Concurrency Sanitizer on: [ 522.827778][ T5428] CPU: 0 PID: 5428 Comm: udevd Tainted: G W 5.15.0-syzkaller #0 [ 522.836685][ T5428] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 522.846715][ T5428] ================================================================== [ 522.894287][T27143] loop2: detected capacity change from 0 to 16383 [ 522.910862][T27144] netlink: 224 bytes leftover after parsing attributes in process `syz-executor.4'. [ 522.954272][T27143] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 522.959559][T27143] loop2: p1 size 11290111 extends beyond EOD, truncated [ 522.967361][T27143] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 522.975591][T27143] loop2: p5 size 11290111 extends beyond EOD, truncated [ 522.982882][T27143] loop2: p6 size 1912633224 extends beyond EOD, truncated [ 523.054535][T27143] loop2: detected capacity change from 0 to 16383 09:54:19 executing program 2: syz_read_part_table(0x0, 0x2, &(0x7f0000000100)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0000ffffff85000000060000000000024000ffffff82000000e118000088770072003007000f00000000000000008000da55aa", 0x40, 0x1c0}, {0x0, 0x0, 0xfffffffffffffffb}]) 09:54:19 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="5500000018007f083ffe15b282a380930a09000248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) 09:54:19 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x9, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000e80)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) io_uring_enter(r1, 0x0, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x50}}], 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x58, 0x1, {{'md5\x00'}, 0x80, "f959fb7b2a535a87359f0b633f54f881"}}]}, 0xf0}}, 0x0) 09:54:19 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x6, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000000}) 09:54:19 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) mkdirat(r1, &(0x7f00000000c0)='./file0\x00', 0x0) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r3 = syz_io_uring_setup(0x3ede, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000140)) io_uring_enter(r3, 0x2ff, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x5, 0x0, &(0x7f0000000040)=""/18, 0xffffffde}, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, &(0x7f0000000dc0)=[{&(0x7f0000000100)="f4a4848461fb0592d2f8db4c1f3c9e408788e03d28fe5e69dbceea46dd67888cdedd07a068040b956c3af7", 0x2b}, {0x0}, {0x0}], 0x3, &(0x7f0000000540)=ANY=[@ANYBLOB="1400000000000000", @ANYRES32], 0x50}}, {{0x0, 0x0, &(0x7f0000003180)=[{0x0}, {0x0}], 0x2, &(0x7f00000002c0)=ANY=[@ANYBLOB="c9252cdfb191d94ef15953a086ed40b24a018fb18d39f9a1256b33cf339f1d1bb52846ddaaaecd492eb1d0774b26968a44bf794e9d902a3c02af9543bc4096ac7a27", @ANYRES32, @ANYRES32=0x0], 0x50, 0x4041}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYRESDEC, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000003000000000000000010000000100", @ANYRES32, @ANYRES64, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESDEC=r4], 0xd0, 0x20000000}}], 0x3, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x138, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {0x0, 0x0, 0x3000000}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x48, 0x1, {{'md5\x00'}}}]}, 0x138}}, 0x0) 09:54:19 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000}}}, 0xf0}}, 0x0) [ 523.119118][T27143] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 523.124444][T27143] loop2: p1 size 11290111 extends beyond EOD, truncated [ 523.132160][T27143] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 523.140041][T27143] loop2: p5 size 11290111 extends beyond EOD, truncated [ 523.147348][T27143] loop2: p6 size 1912633224 extends beyond EOD, truncated 09:54:19 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="5500000018007f083ffe15b282a380930a0a000248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) 09:54:20 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x9, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000e80)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) io_uring_enter(r1, 0x0, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x50}}], 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x58, 0x1, {{'md5\x00'}, 0x80, "f959fb7b2a535a87359f0b633f54f881"}}]}, 0x2c0}}, 0x0) [ 523.202459][T27150] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 523.209714][T27150] IPv6: NLM_F_CREATE should be set when creating new route [ 523.216935][T27150] IPv6: NLM_F_CREATE should be set when creating new route [ 523.231002][ C1] sd 0:0:1:0: [sg_rq_end_io] Sense Key : Illegal Request [current] [ 523.239115][ C1] sd 0:0:1:0: [sg_rq_end_io] Add. Sense: Invalid command operation code 09:54:20 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x6, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18000000}) 09:54:20 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000000}}}, 0xf0}}, 0x0) 09:54:20 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) mkdirat(r1, &(0x7f00000000c0)='./file0\x00', 0x0) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r3 = syz_io_uring_setup(0x3ede, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000140)) io_uring_enter(r3, 0x2ff, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x5, 0x0, &(0x7f0000000040)=""/18, 0xffffffde}, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, &(0x7f0000000dc0)=[{&(0x7f0000000100)="f4a4848461fb0592d2f8db4c1f3c9e408788e03d28fe5e69dbceea46dd67888cdedd07a068040b956c3af7", 0x2b}, {0x0}, {0x0}], 0x3, &(0x7f0000000540)=ANY=[@ANYBLOB="1400000000000000", @ANYRES32], 0x50}}, {{0x0, 0x0, &(0x7f0000003180)=[{0x0}, {0x0}], 0x2, &(0x7f00000002c0)=ANY=[@ANYBLOB="c9252cdfb191d94ef15953a086ed40b24a018fb18d39f9a1256b33cf339f1d1bb52846ddaaaecd492eb1d0774b26968a44bf794e9d902a3c02af9543bc4096ac7a27", @ANYRES32, @ANYRES32=0x0], 0x50, 0x4041}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYRESDEC, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000003000000000000000010000000100", @ANYRES32, @ANYRES64, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESDEC=r4], 0xd0, 0x20000000}}], 0x3, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x138, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {0x0, 0x0, 0x4000000}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x48, 0x1, {{'md5\x00'}}}]}, 0x138}}, 0x0) [ 523.261674][T27157] netlink: 224 bytes leftover after parsing attributes in process `syz-executor.4'. 09:54:20 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x9, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000e80)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) io_uring_enter(r1, 0x0, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x50}}], 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x58, 0x1, {{'md5\x00'}, 0x80, "f959fb7b2a535a87359f0b633f54f881"}}]}, 0xec0}}, 0x0) [ 523.445248][T27164] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 523.452557][T27164] IPv6: NLM_F_CREATE should be set when creating new route [ 523.460259][T27164] IPv6: NLM_F_CREATE should be set when creating new route [ 523.471939][ C1] sd 0:0:1:0: [sg_rq_end_io] Sense Key : Illegal Request [current] [ 523.479939][ C1] sd 0:0:1:0: [sg_rq_end_io] Add. Sense: Invalid command operation code [ 523.500269][T27167] netlink: 224 bytes leftover after parsing attributes in process `syz-executor.4'. [ 523.616774][T27173] loop2: detected capacity change from 0 to 16383 [ 523.655154][T27173] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 523.660504][T27173] loop2: p1 size 11290111 extends beyond EOD, truncated [ 523.668342][T27173] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 523.676189][T27173] loop2: p5 size 11290111 extends beyond EOD, truncated [ 523.683483][T27173] loop2: p6 size 1912633224 extends beyond EOD, truncated [ 523.777148][T27173] loop2: detected capacity change from 0 to 16383 [ 523.831810][T27173] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 523.837079][T27173] loop2: p1 size 11290111 extends beyond EOD, truncated [ 523.844780][T27173] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 523.852687][T27173] loop2: p5 size 11290111 extends beyond EOD, truncated [ 523.860017][T27173] loop2: p6 size 1912633224 extends beyond EOD, truncated 09:54:20 executing program 2: syz_read_part_table(0x0, 0x2, &(0x7f0000000100)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0000ffffff85000000060000000000024000ffffff82000000e126000088770072003007000f00000000000000008000da55aa", 0x40, 0x1c0}, {0x0, 0x0, 0xfffffffffffffffb}]) 09:54:20 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="5500000018007f083ffe15b282a380930a0b000248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) 09:54:20 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000}}}, 0xf0}}, 0x0) 09:54:20 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x6, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1d2b0000}) 09:54:20 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) mkdirat(r1, &(0x7f00000000c0)='./file0\x00', 0x0) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r3 = syz_io_uring_setup(0x3ede, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000140)) io_uring_enter(r3, 0x2ff, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x5, 0x0, &(0x7f0000000040)=""/18, 0xffffffde}, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, &(0x7f0000000dc0)=[{&(0x7f0000000100)="f4a4848461fb0592d2f8db4c1f3c9e408788e03d28fe5e69dbceea46dd67888cdedd07a068040b956c3af7", 0x2b}, {0x0}, {0x0}], 0x3, &(0x7f0000000540)=ANY=[@ANYBLOB="1400000000000000", @ANYRES32], 0x50}}, {{0x0, 0x0, &(0x7f0000003180)=[{0x0}, {0x0}], 0x2, &(0x7f00000002c0)=ANY=[@ANYBLOB="c9252cdfb191d94ef15953a086ed40b24a018fb18d39f9a1256b33cf339f1d1bb52846ddaaaecd492eb1d0774b26968a44bf794e9d902a3c02af9543bc4096ac7a27", @ANYRES32, @ANYRES32=0x0], 0x50, 0x4041}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYRESDEC, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000003000000000000000010000000100", @ANYRES32, @ANYRES64, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESDEC=r4], 0xd0, 0x20000000}}], 0x3, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x138, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {0x0, 0x0, 0x5000000}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x48, 0x1, {{'md5\x00'}}}]}, 0x138}}, 0x0) 09:54:20 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x9, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000e80)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) io_uring_enter(r1, 0x0, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x50}}], 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x58, 0x1, {{'md5\x00'}, 0x80, "f959fb7b2a535a87359f0b633f54f881"}}]}, 0x33fe0}}, 0x0) [ 523.904907][ T383] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 523.910164][ T383] loop2: p1 size 11290111 extends beyond EOD, truncated [ 523.918296][ T383] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 523.926167][ T383] loop2: p5 size 11290111 extends beyond EOD, truncated [ 523.934864][ T383] loop2: p6 size 1912633224 extends beyond EOD, truncated 09:54:20 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x9, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000e80)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) io_uring_enter(r1, 0x0, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x50}}], 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x58, 0x1, {{'md5\x00'}, 0x80, "f959fb7b2a535a87359f0b633f54f881"}}]}, 0x20000308}}, 0x0) [ 523.985714][ C1] sd 0:0:1:0: [sg_rq_end_io] Sense Key : Illegal Request [current] [ 523.993714][ C1] sd 0:0:1:0: [sg_rq_end_io] Add. Sense: Invalid command operation code [ 524.021371][T27186] netlink: 224 bytes leftover after parsing attributes in process `syz-executor.4'. 09:54:20 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5000000}}}, 0xf0}}, 0x0) 09:54:20 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) mkdirat(r1, &(0x7f00000000c0)='./file0\x00', 0x0) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r3 = syz_io_uring_setup(0x3ede, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000140)) io_uring_enter(r3, 0x2ff, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x5, 0x0, &(0x7f0000000040)=""/18, 0xffffffde}, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, &(0x7f0000000dc0)=[{&(0x7f0000000100)="f4a4848461fb0592d2f8db4c1f3c9e408788e03d28fe5e69dbceea46dd67888cdedd07a068040b956c3af7", 0x2b}, {0x0}, {0x0}], 0x3, &(0x7f0000000540)=ANY=[@ANYBLOB="1400000000000000", @ANYRES32], 0x50}}, {{0x0, 0x0, &(0x7f0000003180)=[{0x0}, {0x0}], 0x2, &(0x7f00000002c0)=ANY=[@ANYBLOB="c9252cdfb191d94ef15953a086ed40b24a018fb18d39f9a1256b33cf339f1d1bb52846ddaaaecd492eb1d0774b26968a44bf794e9d902a3c02af9543bc4096ac7a27", @ANYRES32, @ANYRES32=0x0], 0x50, 0x4041}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYRESDEC, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000003000000000000000010000000100", @ANYRES32, @ANYRES64, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESDEC=r4], 0xd0, 0x20000000}}], 0x3, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x138, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {0x0, 0x0, 0x6000000}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x48, 0x1, {{'md5\x00'}}}]}, 0x138}}, 0x0) 09:54:20 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x6, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40000000}) 09:54:20 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="5500000018007f083ffe15b282a380930a0c000248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) [ 524.026432][T27187] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 524.038079][T27187] IPv6: NLM_F_CREATE should be set when creating new route [ 524.045259][T27187] IPv6: NLM_F_CREATE should be set when creating new route [ 524.190734][T27194] netlink: 224 bytes leftover after parsing attributes in process `syz-executor.4'. [ 524.205048][T27198] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 524.209408][ C1] sd 0:0:1:0: [sg_rq_end_io] Sense Key : Illegal Request [current] [ 524.212281][T27198] IPv6: NLM_F_CREATE should be set when creating new route [ 524.220254][ C1] sd 0:0:1:0: [sg_rq_end_io] Add. Sense: Invalid command operation code 09:54:20 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x9, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000e80)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) io_uring_enter(r1, 0x0, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x50}}], 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x58, 0x1, {{'md5\x00'}, 0x80, "f959fb7b2a535a87359f0b633f54f881"}}]}, 0x7ffff000}}, 0x0) [ 524.227449][T27198] IPv6: NLM_F_CREATE should be set when creating new route [ 524.307839][ T5551] udevd[5551]: inotify_add_watch(7, /dev/loop2p6, 10) failed: No such file or directory [ 524.308406][ T5592] udevd[5592]: inotify_add_watch(7, /dev/loop2p1, 10) failed: No such file or directory [ 524.318529][T16174] udevd[16174]: inotify_add_watch(7, /dev/loop2p4, 10) failed: No such file or directory [ 524.327562][T13989] udevd[13989]: inotify_add_watch(7, /dev/loop2p3, 10) failed: No such file or directory [ 524.338376][ T5552] udevd[5552]: inotify_add_watch(7, /dev/loop2p5, 10) failed: No such file or directory [ 524.357087][ T5428] udevd[5428]: inotify_add_watch(7, /dev/loop2p2, 10) failed: No such file or directory [ 524.397192][T27204] loop2: detected capacity change from 0 to 16383 [ 524.428016][ T5592] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 524.433280][ T5592] loop2: p1 size 11290111 extends beyond EOD, truncated [ 524.441186][ T5592] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 524.449172][ T5592] loop2: p5 size 11290111 extends beyond EOD, truncated [ 524.456479][ T5592] loop2: p6 size 1912633224 extends beyond EOD, truncated [ 524.466388][T27204] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 524.471658][T27204] loop2: p1 size 11290111 extends beyond EOD, truncated [ 524.479100][T27204] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 524.486918][T27204] loop2: p5 size 11290111 extends beyond EOD, truncated [ 524.494331][T27204] loop2: p6 size 1912633224 extends beyond EOD, truncated [ 524.588435][T27204] loop2: detected capacity change from 0 to 16383 09:54:21 executing program 2: syz_read_part_table(0x0, 0x2, &(0x7f0000000100)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0000ffffff85000000060000000000024000ffffff82000000e171000088770072003007000f00000000000000008000da55aa", 0x40, 0x1c0}, {0x0, 0x0, 0xfffffffffffffffb}]) 09:54:21 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x6, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf5ffffff}) 09:54:21 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="5500000018007f083ffe15b282a380930a0d000248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) 09:54:21 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6000000}}}, 0xf0}}, 0x0) 09:54:21 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) mkdirat(r1, &(0x7f00000000c0)='./file0\x00', 0x0) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r3 = syz_io_uring_setup(0x3ede, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000140)) io_uring_enter(r3, 0x2ff, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x5, 0x0, &(0x7f0000000040)=""/18, 0xffffffde}, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, &(0x7f0000000dc0)=[{&(0x7f0000000100)="f4a4848461fb0592d2f8db4c1f3c9e408788e03d28fe5e69dbceea46dd67888cdedd07a068040b956c3af7", 0x2b}, {0x0}, {0x0}], 0x3, &(0x7f0000000540)=ANY=[@ANYBLOB="1400000000000000", @ANYRES32], 0x50}}, {{0x0, 0x0, &(0x7f0000003180)=[{0x0}, {0x0}], 0x2, &(0x7f00000002c0)=ANY=[@ANYBLOB="c9252cdfb191d94ef15953a086ed40b24a018fb18d39f9a1256b33cf339f1d1bb52846ddaaaecd492eb1d0774b26968a44bf794e9d902a3c02af9543bc4096ac7a27", @ANYRES32, @ANYRES32=0x0], 0x50, 0x4041}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYRESDEC, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000003000000000000000010000000100", @ANYRES32, @ANYRES64, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESDEC=r4], 0xd0, 0x20000000}}], 0x3, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x138, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {0x0, 0x0, 0x7000000}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x48, 0x1, {{'md5\x00'}}}]}, 0x138}}, 0x0) 09:54:21 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x9, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000e80)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) io_uring_enter(r1, 0x0, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x50}}], 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x58, 0x1, {{'md5\x00'}, 0x80, "f959fb7b2a535a87359f0b633f54f881"}}]}, 0xfffffdef}}, 0x0) [ 524.675441][T27204] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 524.680737][T27204] loop2: p1 size 11290111 extends beyond EOD, truncated [ 524.688594][T27204] loop2: p3 size 1912633224 extends beyond EOD, truncated [ 524.696686][T27204] loop2: p5 size 11290111 extends beyond EOD, truncated [ 524.703949][T27204] loop2: p6 size 1912633224 extends beyond EOD, truncated 09:54:21 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7000000}}}, 0xf0}}, 0x0) [ 524.775346][T27214] netlink: 224 bytes leftover after parsing attributes in process `syz-executor.4'. [ 524.788728][T27215] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 524.796012][T27215] IPv6: NLM_F_CREATE should be set when creating new route [ 524.803241][T27215] IPv6: NLM_F_CREATE should be set when creating new route [ 524.814918][ C1] sd 0:0:1:0: [sg_rq_end_io] Sense Key : Illegal Request [current] 09:54:21 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) mkdirat(r1, &(0x7f00000000c0)='./file0\x00', 0x0) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r3 = syz_io_uring_setup(0x3ede, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000140)) io_uring_enter(r3, 0x2ff, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x5, 0x0, &(0x7f0000000040)=""/18, 0xffffffde}, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, &(0x7f0000000dc0)=[{&(0x7f0000000100)="f4a4848461fb0592d2f8db4c1f3c9e408788e03d28fe5e69dbceea46dd67888cdedd07a068040b956c3af7", 0x2b}, {0x0}, {0x0}], 0x3, &(0x7f0000000540)=ANY=[@ANYBLOB="1400000000000000", @ANYRES32], 0x50}}, {{0x0, 0x0, &(0x7f0000003180)=[{0x0}, {0x0}], 0x2, &(0x7f00000002c0)=ANY=[@ANYBLOB="c9252cdfb191d94ef15953a086ed40b24a018fb18d39f9a1256b33cf339f1d1bb52846ddaaaecd492eb1d0774b26968a44bf794e9d902a3c02af9543bc4096ac7a27", @ANYRES32, @ANYRES32=0x0], 0x50, 0x4041}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYRESDEC, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000003000000000000000010000000100", @ANYRES32, @ANYRES64, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESDEC=r4], 0xd0, 0x20000000}}], 0x3, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x138, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {0x0, 0x0, 0x8000000}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x48, 0x1, {{'md5\x00'}}}]}, 0x138}}, 0x0) 09:54:21 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="5500000018007f083ffe15b282a380930a0e000248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) 09:54:21 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x9, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000e80)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) io_uring_enter(r1, 0x0, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x50}}], 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x58, 0x1, {{'md5\x00'}, 0x80, "f959fb7b2a535a87359f0b633f54f881"}}]}, 0x148}, 0x8}, 0x0) 09:54:21 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x6, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfbffffff}) [ 524.822929][ C1] sd 0:0:1:0: [sg_rq_end_io] Add. Sense: Invalid command operation code 09:54:21 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000}}}, 0xf0}}, 0x0) [ 524.988419][T27225] netlink: 224 bytes leftover after parsing attributes in process `syz-executor.4'. [ 525.004537][T27227] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 525.011760][T27227] IPv6: NLM_F_CREATE should be set when creating new route [ 525.018955][T27227] IPv6: NLM_F_CREATE should be set when creating new route [ 525.026236][ C0] scsi_io_completion_action: 9 callbacks suppressed [ 525.026259][ C0] sd 0:0:1:0: tag#6074 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 525.042636][ C0] sd 0:0:1:0: tag#6074 CDB: opcode=0xe5 (vendor) [ 525.048986][ C0] sd 0:0:1:0: tag#6074 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 525.058027][ C0] sd 0:0:1:0: tag#6074 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 525.067067][ C0] sd 0:0:1:0: tag#6074 CDB[20]: ba [ 525.068094][ C1] sd 0:0:1:0: [sg_rq_end_io] Sense Key : Illegal Request [current] [ 525.080179][ C1] sd 0:0:1:0: [sg_rq_end_io] Add. Sense: Invalid command operation code [ 525.163024][T27235] loop2: detected capacity change from 0 to 16383 [ 525.190691][T27235] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 525.196002][T27235] loop2: p1 size 11290111 extends beyond EOD, truncated [ 525.204372][T27235] loop2: p3 start 29153 is beyond EOD, truncated [ 525.211321][T27235] loop2: p5 size 11290111 extends beyond EOD, truncated [ 525.218719][T27235] loop2: p6 start 29153 is beyond EOD, truncated [ 525.299692][T27235] loop2: detected capacity change from 0 to 16383 09:54:22 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="5500000018007f083ffe15b282a380930a10000248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) 09:54:22 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x9, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000e80)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) io_uring_enter(r1, 0x0, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x50}}], 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x58, 0x1, {{'md5\x00'}, 0x80, "f959fb7b2a535a87359f0b633f54f881"}}]}, 0x148}, 0x300}, 0x0) 09:54:22 executing program 2: syz_read_part_table(0x0, 0x2, &(0x7f0000000100)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0000ffffff85000000060000000000024000ffffff82000000e17e000088770072003007000f00000000000000008000da55aa", 0x40, 0x1c0}, {0x0, 0x0, 0xfffffffffffffffb}]) 09:54:22 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x6, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdfdffff}) 09:54:22 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9000000}}}, 0xf0}}, 0x0) 09:54:22 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) mkdirat(r1, &(0x7f00000000c0)='./file0\x00', 0x0) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r3 = syz_io_uring_setup(0x3ede, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000140)) io_uring_enter(r3, 0x2ff, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x5, 0x0, &(0x7f0000000040)=""/18, 0xffffffde}, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, &(0x7f0000000dc0)=[{&(0x7f0000000100)="f4a4848461fb0592d2f8db4c1f3c9e408788e03d28fe5e69dbceea46dd67888cdedd07a068040b956c3af7", 0x2b}, {0x0}, {0x0}], 0x3, &(0x7f0000000540)=ANY=[@ANYBLOB="1400000000000000", @ANYRES32], 0x50}}, {{0x0, 0x0, &(0x7f0000003180)=[{0x0}, {0x0}], 0x2, &(0x7f00000002c0)=ANY=[@ANYBLOB="c9252cdfb191d94ef15953a086ed40b24a018fb18d39f9a1256b33cf339f1d1bb52846ddaaaecd492eb1d0774b26968a44bf794e9d902a3c02af9543bc4096ac7a27", @ANYRES32, @ANYRES32=0x0], 0x50, 0x4041}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYRESDEC, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000003000000000000000010000000100", @ANYRES32, @ANYRES64, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESDEC=r4], 0xd0, 0x20000000}}], 0x3, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x138, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {0x0, 0x0, 0x9000000}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x48, 0x1, {{'md5\x00'}}}]}, 0x138}}, 0x0) [ 525.345885][T27235] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 525.351165][T27235] loop2: p1 size 11290111 extends beyond EOD, truncated [ 525.358726][T27235] loop2: p3 start 29153 is beyond EOD, truncated [ 525.365430][T27235] loop2: p5 size 11290111 extends beyond EOD, truncated [ 525.372716][T27235] loop2: p6 start 29153 is beyond EOD, truncated [ 525.448778][T27242] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 525.455488][ C1] sd 0:0:1:0: tag#6044 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 525.455997][T27242] IPv6: NLM_F_CREATE should be set when creating new route [ 525.465789][ C1] sd 0:0:1:0: tag#6044 CDB: opcode=0xe5 (vendor) [ 525.472977][T27242] IPv6: NLM_F_CREATE should be set when creating new route [ 525.479286][ C1] sd 0:0:1:0: tag#6044 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c 09:54:22 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="5500000018007f083ffe15b282a380930a11000248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) 09:54:22 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa000000}}}, 0xf0}}, 0x0) 09:54:22 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x9, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000e80)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) io_uring_enter(r1, 0x0, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x50}}], 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x58, 0x1, {{'md5\x00'}, 0x80, "f959fb7b2a535a87359f0b633f54f881"}}]}, 0x148}, 0x1, 0x2}, 0x0) 09:54:22 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) mkdirat(r1, &(0x7f00000000c0)='./file0\x00', 0x0) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r3 = syz_io_uring_setup(0x3ede, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000140)) io_uring_enter(r3, 0x2ff, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x5, 0x0, &(0x7f0000000040)=""/18, 0xffffffde}, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, &(0x7f0000000dc0)=[{&(0x7f0000000100)="f4a4848461fb0592d2f8db4c1f3c9e408788e03d28fe5e69dbceea46dd67888cdedd07a068040b956c3af7", 0x2b}, {0x0}, {0x0}], 0x3, &(0x7f0000000540)=ANY=[@ANYBLOB="1400000000000000", @ANYRES32], 0x50}}, {{0x0, 0x0, &(0x7f0000003180)=[{0x0}, {0x0}], 0x2, &(0x7f00000002c0)=ANY=[@ANYBLOB="c9252cdfb191d94ef15953a086ed40b24a018fb18d39f9a1256b33cf339f1d1bb52846ddaaaecd492eb1d0774b26968a44bf794e9d902a3c02af9543bc4096ac7a27", @ANYRES32, @ANYRES32=0x0], 0x50, 0x4041}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYRESDEC, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000003000000000000000010000000100", @ANYRES32, @ANYRES64, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESDEC=r4], 0xd0, 0x20000000}}], 0x3, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x138, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {0x0, 0x0, 0xa000000}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x48, 0x1, {{'md5\x00'}}}]}, 0x138}}, 0x0) [ 525.495476][ C1] sd 0:0:1:0: tag#6044 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 525.504515][ C1] sd 0:0:1:0: tag#6044 CDB[20]: ba [ 525.536683][ C1] sd 0:0:1:0: [sg_rq_end_io] Sense Key : Illegal Request [current] 09:54:22 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x6, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfeffffff}) [ 525.544683][ C1] sd 0:0:1:0: [sg_rq_end_io] Add. Sense: Invalid command operation code 09:54:22 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb000000}}}, 0xf0}}, 0x0) [ 525.671220][T27256] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 525.672707][ C1] sd 0:0:1:0: tag#6039 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 525.678548][T27256] IPv6: NLM_F_CREATE should be set when creating new route [ 525.688363][ C1] sd 0:0:1:0: tag#6039 CDB: opcode=0xe5 (vendor) [ 525.695541][T27256] IPv6: NLM_F_CREATE should be set when creating new route [ 525.709052][ C1] sd 0:0:1:0: tag#6039 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c 09:54:22 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="5500000018007f083ffe15b282a380930a12000248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) 09:54:22 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) mkdirat(r1, &(0x7f00000000c0)='./file0\x00', 0x0) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r3 = syz_io_uring_setup(0x3ede, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000140)) io_uring_enter(r3, 0x2ff, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x5, 0x0, &(0x7f0000000040)=""/18, 0xffffffde}, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, &(0x7f0000000dc0)=[{&(0x7f0000000100)="f4a4848461fb0592d2f8db4c1f3c9e408788e03d28fe5e69dbceea46dd67888cdedd07a068040b956c3af7", 0x2b}, {0x0}, {0x0}], 0x3, &(0x7f0000000540)=ANY=[@ANYBLOB="1400000000000000", @ANYRES32], 0x50}}, {{0x0, 0x0, &(0x7f0000003180)=[{0x0}, {0x0}], 0x2, &(0x7f00000002c0)=ANY=[@ANYBLOB="c9252cdfb191d94ef15953a086ed40b24a018fb18d39f9a1256b33cf339f1d1bb52846ddaaaecd492eb1d0774b26968a44bf794e9d902a3c02af9543bc4096ac7a27", @ANYRES32, @ANYRES32=0x0], 0x50, 0x4041}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYRESDEC, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000003000000000000000010000000100", @ANYRES32, @ANYRES64, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESDEC=r4], 0xd0, 0x20000000}}], 0x3, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x138, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {0x0, 0x0, 0xb000000}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x48, 0x1, {{'md5\x00'}}}]}, 0x138}}, 0x0) [ 525.718089][ C1] sd 0:0:1:0: tag#6039 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 525.727126][ C1] sd 0:0:1:0: tag#6039 CDB[20]: ba [ 525.752306][ C1] sd 0:0:1:0: [sg_rq_end_io] Sense Key : Illegal Request [current] [ 525.760341][ C1] sd 0:0:1:0: [sg_rq_end_io] Add. Sense: Invalid command operation code [ 525.813932][T16174] udevd[16174]: inotify_add_watch(7, /dev/loop2p5, 10) failed: No such file or directory [ 525.816916][ T5428] udevd[5428]: inotify_add_watch(7, /dev/loop2p2, 10) failed: No such file or directory [ 525.824946][ T5592] udevd[5592]: inotify_add_watch(7, /dev/loop2p1, 10) failed: No such file or directory [ 525.834853][T13989] udevd[13989]: inotify_add_watch(7, /dev/loop2p4, 10) failed: No such file or directory [ 525.881883][T27266] loop2: detected capacity change from 0 to 16383 [ 525.916217][T27269] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 525.923445][T27269] IPv6: NLM_F_CREATE should be set when creating new route [ 525.930626][T27269] IPv6: NLM_F_CREATE should be set when creating new route [ 525.931259][ C1] sd 0:0:1:0: tag#6041 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 525.947691][ C1] sd 0:0:1:0: tag#6041 CDB: opcode=0xe5 (vendor) [ 525.954048][ C1] sd 0:0:1:0: tag#6041 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 525.963537][ C1] sd 0:0:1:0: tag#6041 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 525.972566][ C1] sd 0:0:1:0: tag#6041 CDB[20]: ba [ 525.981866][T27266] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 525.987232][T27266] loop2: p1 size 11290111 extends beyond EOD, truncated [ 525.988735][ C1] sd 0:0:1:0: tag#6045 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 525.997559][T27266] loop2: p3 start 32481 is beyond EOD, [ 526.004101][ C1] sd 0:0:1:0: tag#6045 CDB: opcode=0xe5 (vendor) [ 526.004121][ C1] sd 0:0:1:0: tag#6045 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 526.009697][T27266] truncated [ 526.015981][ C1] sd 0:0:1:0: tag#6045 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 526.025989][T27266] loop2: p5 size 11290111 extends beyond EOD, [ 526.028083][ C1] sd 0:0:1:0: tag#6045 CDB[20]: ba [ 526.037181][T27266] truncated [ 526.052237][T27266] loop2: p6 start 32481 is beyond EOD, truncated [ 526.126556][T27266] loop2: detected capacity change from 0 to 16383 09:54:22 executing program 2: syz_read_part_table(0x0, 0x2, &(0x7f0000000100)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0000ffffff85000000060000000000024000ffffff82000000e1fe000088770072003007000f00000000000000008000da55aa", 0x40, 0x1c0}, {0x0, 0x0, 0xfffffffffffffffb}]) 09:54:22 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x9, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000e80)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) io_uring_enter(r1, 0x0, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x50}}], 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x58, 0x1, {{'md5\x00'}, 0x80, "f959fb7b2a535a87359f0b633f54f881"}}]}, 0x148}, 0x1, 0x3}, 0x0) 09:54:22 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc000000}}}, 0xf0}}, 0x0) 09:54:22 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x6, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffdfd}) 09:54:22 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="5500000018007f083ffe15b282a380930a00a80248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) 09:54:22 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) mkdirat(r1, &(0x7f00000000c0)='./file0\x00', 0x0) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r3 = syz_io_uring_setup(0x3ede, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000140)) io_uring_enter(r3, 0x2ff, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x5, 0x0, &(0x7f0000000040)=""/18, 0xffffffde}, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, &(0x7f0000000dc0)=[{&(0x7f0000000100)="f4a4848461fb0592d2f8db4c1f3c9e408788e03d28fe5e69dbceea46dd67888cdedd07a068040b956c3af7", 0x2b}, {0x0}, {0x0}], 0x3, &(0x7f0000000540)=ANY=[@ANYBLOB="1400000000000000", @ANYRES32], 0x50}}, {{0x0, 0x0, &(0x7f0000003180)=[{0x0}, {0x0}], 0x2, &(0x7f00000002c0)=ANY=[@ANYBLOB="c9252cdfb191d94ef15953a086ed40b24a018fb18d39f9a1256b33cf339f1d1bb52846ddaaaecd492eb1d0774b26968a44bf794e9d902a3c02af9543bc4096ac7a27", @ANYRES32, @ANYRES32=0x0], 0x50, 0x4041}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYRESDEC, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000003000000000000000010000000100", @ANYRES32, @ANYRES64, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESDEC=r4], 0xd0, 0x20000000}}], 0x3, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x138, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {0x0, 0x0, 0x10000000}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x48, 0x1, {{'md5\x00'}}}]}, 0x138}}, 0x0) [ 526.169935][T27266] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 526.175167][T27266] loop2: p1 size 11290111 extends beyond EOD, truncated [ 526.182854][T27266] loop2: p3 start 32481 is beyond EOD, truncated [ 526.189535][T27266] loop2: p5 size 11290111 extends beyond EOD, truncated [ 526.196873][T27266] loop2: p6 start 32481 is beyond EOD, truncated 09:54:22 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd000000}}}, 0xf0}}, 0x0) 09:54:22 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="5500000018007f083ffe15b282a380930a00d60248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) 09:54:22 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x9, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000e80)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) io_uring_enter(r1, 0x0, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x50}}], 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x58, 0x1, {{'md5\x00'}, 0x80, "f959fb7b2a535a87359f0b633f54f881"}}]}, 0x148}, 0x1, 0x4}, 0x0) [ 526.250469][ C1] sd 0:0:1:0: tag#6044 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 526.260342][ C1] sd 0:0:1:0: tag#6044 CDB: opcode=0xe5 (vendor) [ 526.266721][ C1] sd 0:0:1:0: tag#6044 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 526.275752][ C1] sd 0:0:1:0: tag#6044 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 526.284792][ C1] sd 0:0:1:0: tag#6044 CDB[20]: ba 09:54:22 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) mkdirat(r1, &(0x7f00000000c0)='./file0\x00', 0x0) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r3 = syz_io_uring_setup(0x3ede, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000140)) io_uring_enter(r3, 0x2ff, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x5, 0x0, &(0x7f0000000040)=""/18, 0xffffffde}, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, &(0x7f0000000dc0)=[{&(0x7f0000000100)="f4a4848461fb0592d2f8db4c1f3c9e408788e03d28fe5e69dbceea46dd67888cdedd07a068040b956c3af7", 0x2b}, {0x0}, {0x0}], 0x3, &(0x7f0000000540)=ANY=[@ANYBLOB="1400000000000000", @ANYRES32], 0x50}}, {{0x0, 0x0, &(0x7f0000003180)=[{0x0}, {0x0}], 0x2, &(0x7f00000002c0)=ANY=[@ANYBLOB="c9252cdfb191d94ef15953a086ed40b24a018fb18d39f9a1256b33cf339f1d1bb52846ddaaaecd492eb1d0774b26968a44bf794e9d902a3c02af9543bc4096ac7a27", @ANYRES32, @ANYRES32=0x0], 0x50, 0x4041}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYRESDEC, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000003000000000000000010000000100", @ANYRES32, @ANYRES64, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESDEC=r4], 0xd0, 0x20000000}}], 0x3, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x138, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {0x0, 0x0, 0x11000000}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x48, 0x1, {{'md5\x00'}}}]}, 0x138}}, 0x0) 09:54:22 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x6, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffff0f}) [ 526.295874][ C1] sd 0:0:1:0: [sg_rq_end_io] Sense Key : Illegal Request [current] [ 526.303918][ C1] sd 0:0:1:0: [sg_rq_end_io] Add. Sense: Invalid command operation code 09:54:23 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="5500000018007f083ffe15b282a380930a03040048a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) [ 526.438319][ C0] sd 0:0:1:0: tag#6053 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 526.448159][ C0] sd 0:0:1:0: tag#6053 CDB: opcode=0xe5 (vendor) [ 526.451214][ C1] sd 0:0:1:0: [sg_rq_end_io] Sense Key : Illegal Request [current] [ 526.454465][ C0] sd 0:0:1:0: tag#6053 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 526.454487][ C0] sd 0:0:1:0: tag#6053 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 526.462449][ C1] sd 0:0:1:0: [sg_rq_end_io] Add. Sense: Invalid command operation code [ 526.471444][ C0] sd 0:0:1:0: tag#6053 CDB[20]: ba [ 526.526585][T27300] loop2: detected capacity change from 0 to 16383 [ 526.561349][ T5592] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 526.566571][ T5592] loop2: p1 size 11290111 extends beyond EOD, truncated [ 526.574388][ T5592] loop2: p3 start 65249 is beyond EOD, truncated [ 526.581356][ T5592] loop2: p5 size 11290111 extends beyond EOD, truncated [ 526.588988][ T5592] loop2: p6 start 65249 is beyond EOD, truncated [ 526.597894][T27300] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 526.603157][T27300] loop2: p1 size 11290111 extends beyond EOD, truncated [ 526.610685][T27300] loop2: p3 start 65249 is beyond EOD, truncated [ 526.617419][T27300] loop2: p5 size 11290111 extends beyond EOD, truncated [ 526.624871][T27300] loop2: p6 start 65249 is beyond EOD, truncated 09:54:23 executing program 2: syz_read_part_table(0x0, 0x2, &(0x7f0000000100)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0000ffffff85000000060000000000024000ffffff82000000e104020088770072003007000f00000000000000008000da55aa", 0x40, 0x1c0}, {0x0, 0x0, 0xfffffffffffffffb}]) 09:54:23 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe000000}}}, 0xf0}}, 0x0) 09:54:23 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x9, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000e80)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) io_uring_enter(r1, 0x0, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x50}}], 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x58, 0x1, {{'md5\x00'}, 0x80, "f959fb7b2a535a87359f0b633f54f881"}}]}, 0x148}, 0x1, 0x5}, 0x0) 09:54:23 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x6, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffff7f}) 09:54:23 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) mkdirat(r1, &(0x7f00000000c0)='./file0\x00', 0x0) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r3 = syz_io_uring_setup(0x3ede, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000140)) io_uring_enter(r3, 0x2ff, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x5, 0x0, &(0x7f0000000040)=""/18, 0xffffffde}, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, &(0x7f0000000dc0)=[{&(0x7f0000000100)="f4a4848461fb0592d2f8db4c1f3c9e408788e03d28fe5e69dbceea46dd67888cdedd07a068040b956c3af7", 0x2b}, {0x0}, {0x0}], 0x3, &(0x7f0000000540)=ANY=[@ANYBLOB="1400000000000000", @ANYRES32], 0x50}}, {{0x0, 0x0, &(0x7f0000003180)=[{0x0}, {0x0}], 0x2, &(0x7f00000002c0)=ANY=[@ANYBLOB="c9252cdfb191d94ef15953a086ed40b24a018fb18d39f9a1256b33cf339f1d1bb52846ddaaaecd492eb1d0774b26968a44bf794e9d902a3c02af9543bc4096ac7a27", @ANYRES32, @ANYRES32=0x0], 0x50, 0x4041}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYRESDEC, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000003000000000000000010000000100", @ANYRES32, @ANYRES64, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESDEC=r4], 0xd0, 0x20000000}}], 0x3, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x138, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {0x0, 0x0, 0x14000000}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x48, 0x1, {{'md5\x00'}}}]}, 0x138}}, 0x0) 09:54:23 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="5500000018007f083ffe15b282a380930a03020248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) [ 526.713062][ C1] sd 0:0:1:0: [sg_rq_end_io] Sense Key : Illegal Request [current] [ 526.721183][ C1] sd 0:0:1:0: [sg_rq_end_io] Add. Sense: Invalid command operation code [ 526.728137][ C0] sd 0:0:1:0: tag#6024 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 526.739355][ C0] sd 0:0:1:0: tag#6024 CDB: opcode=0xe5 (vendor) [ 526.745678][ C0] sd 0:0:1:0: tag#6024 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c 09:54:23 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000000}}}, 0xf0}}, 0x0) 09:54:23 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x6, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffff5}) 09:54:23 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x9, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000e80)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) io_uring_enter(r1, 0x0, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x50}}], 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x58, 0x1, {{'md5\x00'}, 0x80, "f959fb7b2a535a87359f0b633f54f881"}}]}, 0x148}, 0x1, 0x6}, 0x0) 09:54:23 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="5500000018007f083ffe15b282a380930a03030248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) 09:54:23 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) mkdirat(r1, &(0x7f00000000c0)='./file0\x00', 0x0) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r3 = syz_io_uring_setup(0x3ede, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000140)) io_uring_enter(r3, 0x2ff, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x5, 0x0, &(0x7f0000000040)=""/18, 0xffffffde}, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, &(0x7f0000000dc0)=[{&(0x7f0000000100)="f4a4848461fb0592d2f8db4c1f3c9e408788e03d28fe5e69dbceea46dd67888cdedd07a068040b956c3af7", 0x2b}, {0x0}, {0x0}], 0x3, &(0x7f0000000540)=ANY=[@ANYBLOB="1400000000000000", @ANYRES32], 0x50}}, {{0x0, 0x0, &(0x7f0000003180)=[{0x0}, {0x0}], 0x2, &(0x7f00000002c0)=ANY=[@ANYBLOB="c9252cdfb191d94ef15953a086ed40b24a018fb18d39f9a1256b33cf339f1d1bb52846ddaaaecd492eb1d0774b26968a44bf794e9d902a3c02af9543bc4096ac7a27", @ANYRES32, @ANYRES32=0x0], 0x50, 0x4041}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYRESDEC, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000003000000000000000010000000100", @ANYRES32, @ANYRES64, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESDEC=r4], 0xd0, 0x20000000}}], 0x3, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x138, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {0x0, 0x0, 0x20000000}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x48, 0x1, {{'md5\x00'}}}]}, 0x138}}, 0x0) [ 526.754725][ C0] sd 0:0:1:0: tag#6024 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 526.763758][ C0] sd 0:0:1:0: tag#6024 CDB[20]: ba 09:54:23 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x11000000}}}, 0xf0}}, 0x0) [ 526.865667][ C1] sd 0:0:1:0: [sg_rq_end_io] Sense Key : Illegal Request [current] [ 526.873706][ C1] sd 0:0:1:0: [sg_rq_end_io] Add. Sense: Invalid command operation code [ 526.955639][T27325] loop2: detected capacity change from 0 to 16383 [ 526.984881][ C0] sd 0:0:1:0: tag#6033 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 526.994708][ C0] sd 0:0:1:0: tag#6033 CDB: opcode=0xe5 (vendor) [ 527.001018][ C0] sd 0:0:1:0: tag#6033 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 527.010031][ C0] sd 0:0:1:0: tag#6033 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 527.019057][ C0] sd 0:0:1:0: tag#6033 CDB[20]: ba [ 527.028002][T27325] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 527.033326][T27325] loop2: p1 size 11290111 extends beyond EOD, truncated [ 527.036834][ C0] sd 0:0:1:0: tag#6064 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 527.042278][T27325] loop2: p3 start 132321 is beyond EOD, [ 527.050059][ C0] sd 0:0:1:0: tag#6064 CDB: opcode=0xe5 (vendor) [ 527.050076][ C0] sd 0:0:1:0: tag#6064 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 527.050115][ C0] sd 0:0:1:0: tag#6064 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 527.055699][T27325] truncated [ 527.056984][T27325] loop2: p5 size 11290111 extends beyond EOD, [ 527.062025][ C0] sd 0:0:1:0: tag#6064 CDB[20]: ba [ 527.094448][T27325] truncated [ 527.097998][T27325] loop2: p6 start 132321 is beyond EOD, truncated [ 527.187045][T27325] loop2: detected capacity change from 0 to 16383 [ 527.251835][ T5592] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 527.257113][ T5592] loop2: p1 size 11290111 extends beyond EOD, truncated [ 527.264822][ T5592] loop2: p3 start 132321 is beyond EOD, truncated [ 527.271549][ T5592] loop2: p5 size 11290111 extends beyond EOD, truncated [ 527.278788][ T5592] loop2: p6 start 132321 is beyond EOD, truncated [ 527.286931][T27325] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 527.292246][T27325] loop2: p1 size 11290111 extends beyond EOD, truncated 09:54:23 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x9, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000e80)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) io_uring_enter(r1, 0x0, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x50}}], 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x58, 0x1, {{'md5\x00'}, 0x80, "f959fb7b2a535a87359f0b633f54f881"}}]}, 0x148}, 0x1, 0x7}, 0x0) 09:54:23 executing program 2: syz_read_part_table(0x0, 0x2, &(0x7f0000000100)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0000ffffff85000000060000000000024000ffffff82000000e100030088770072003007000f00000000000000008000da55aa", 0x40, 0x1c0}, {0x0, 0x0, 0xfffffffffffffffb}]) 09:54:23 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="5500000018007f083ffe15b282a380930a03040248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) 09:54:23 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x6, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffb}) 09:54:23 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x12000000}}}, 0xf0}}, 0x0) 09:54:23 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) mkdirat(r1, &(0x7f00000000c0)='./file0\x00', 0x0) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r3 = syz_io_uring_setup(0x3ede, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000140)) io_uring_enter(r3, 0x2ff, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x5, 0x0, &(0x7f0000000040)=""/18, 0xffffffde}, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, &(0x7f0000000dc0)=[{&(0x7f0000000100)="f4a4848461fb0592d2f8db4c1f3c9e408788e03d28fe5e69dbceea46dd67888cdedd07a068040b956c3af7", 0x2b}, {0x0}, {0x0}], 0x3, &(0x7f0000000540)=ANY=[@ANYBLOB="1400000000000000", @ANYRES32], 0x50}}, {{0x0, 0x0, &(0x7f0000003180)=[{0x0}, {0x0}], 0x2, &(0x7f00000002c0)=ANY=[@ANYBLOB="c9252cdfb191d94ef15953a086ed40b24a018fb18d39f9a1256b33cf339f1d1bb52846ddaaaecd492eb1d0774b26968a44bf794e9d902a3c02af9543bc4096ac7a27", @ANYRES32, @ANYRES32=0x0], 0x50, 0x4041}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYRESDEC, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000003000000000000000010000000100", @ANYRES32, @ANYRES64, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESDEC=r4], 0xd0, 0x20000000}}], 0x3, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x138, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {0x0, 0x0, 0x3f000000}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x48, 0x1, {{'md5\x00'}}}]}, 0x138}}, 0x0) [ 527.300054][T27325] loop2: p3 start 132321 is beyond EOD, truncated [ 527.306803][T27325] loop2: p5 size 11290111 extends beyond EOD, truncated [ 527.314055][T27325] loop2: p6 start 132321 is beyond EOD, truncated 09:54:24 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="5500000018007f083ffe15b282a380930a03050248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) 09:54:24 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1e040000}}}, 0xf0}}, 0x0) 09:54:24 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x6, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe}) 09:54:24 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x9, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000e80)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) io_uring_enter(r1, 0x0, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x50}}], 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x58, 0x1, {{'md5\x00'}, 0x80, "f959fb7b2a535a87359f0b633f54f881"}}]}, 0x148}, 0x1, 0x8}, 0x0) 09:54:24 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) mkdirat(r1, &(0x7f00000000c0)='./file0\x00', 0x0) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r3 = syz_io_uring_setup(0x3ede, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000140)) io_uring_enter(r3, 0x2ff, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x5, 0x0, &(0x7f0000000040)=""/18, 0xffffffde}, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, &(0x7f0000000dc0)=[{&(0x7f0000000100)="f4a4848461fb0592d2f8db4c1f3c9e408788e03d28fe5e69dbceea46dd67888cdedd07a068040b956c3af7", 0x2b}, {0x0}, {0x0}], 0x3, &(0x7f0000000540)=ANY=[@ANYBLOB="1400000000000000", @ANYRES32], 0x50}}, {{0x0, 0x0, &(0x7f0000003180)=[{0x0}, {0x0}], 0x2, &(0x7f00000002c0)=ANY=[@ANYBLOB="c9252cdfb191d94ef15953a086ed40b24a018fb18d39f9a1256b33cf339f1d1bb52846ddaaaecd492eb1d0774b26968a44bf794e9d902a3c02af9543bc4096ac7a27", @ANYRES32, @ANYRES32=0x0], 0x50, 0x4041}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYRESDEC, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000003000000000000000010000000100", @ANYRES32, @ANYRES64, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESDEC=r4], 0xd0, 0x20000000}}], 0x3, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x138, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {0x0, 0x0, 0x40000000}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x48, 0x1, {{'md5\x00'}}}]}, 0x138}}, 0x0) [ 527.375684][ C1] sd 0:0:1:0: [sg_rq_end_io] Sense Key : Illegal Request [current] [ 527.383752][ C1] sd 0:0:1:0: [sg_rq_end_io] Add. Sense: Invalid command operation code 09:54:24 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="5500000018007f083ffe15b282a380930a03060248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) 09:54:24 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000}}}, 0xf0}}, 0x0) [ 527.526482][T27349] __nla_validate_parse: 10 callbacks suppressed [ 527.526495][T27349] netlink: 224 bytes leftover after parsing attributes in process `syz-executor.4'. [ 527.557087][ C1] sd 0:0:1:0: [sg_rq_end_io] Sense Key : Illegal Request [current] [ 527.565115][ C1] sd 0:0:1:0: [sg_rq_end_io] Add. Sense: Invalid command operation code [ 527.612486][T27358] loop2: detected capacity change from 0 to 16383 [ 527.653840][T27358] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 527.659198][T27358] loop2: p1 size 11290111 extends beyond EOD, truncated [ 527.666932][T27358] loop2: p3 start 196833 is beyond EOD, truncated [ 527.673680][T27358] loop2: p5 size 11290111 extends beyond EOD, truncated [ 527.681019][T27358] loop2: p6 start 196833 is beyond EOD, truncated [ 527.718141][T27362] netlink: 224 bytes leftover after parsing attributes in process `syz-executor.4'. [ 527.750536][T27358] loop2: detected capacity change from 0 to 16383 [ 527.798113][ T5592] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 527.803342][ T5592] loop2: p1 size 11290111 extends beyond EOD, truncated [ 527.810989][ T5592] loop2: p3 start 196833 is beyond EOD, truncated [ 527.817621][ T5592] loop2: p5 size 11290111 extends beyond EOD, truncated [ 527.824923][ T5592] loop2: p6 start 196833 is beyond EOD, truncated [ 527.832914][T27358] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 527.838359][T27358] loop2: p1 size 11290111 extends beyond EOD, truncated 09:54:24 executing program 2: syz_read_part_table(0x0, 0x2, &(0x7f0000000100)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0000ffffff85000000060000000000024000ffffff82000000e102040088770072003007000f00000000000000008000da55aa", 0x40, 0x1c0}, {0x0, 0x0, 0xfffffffffffffffb}]) 09:54:24 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x9, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000e80)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) io_uring_enter(r1, 0x0, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x50}}], 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x58, 0x1, {{'md5\x00'}, 0x80, "f959fb7b2a535a87359f0b633f54f881"}}]}, 0x148}, 0x1, 0x9}, 0x0) 09:54:24 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x6, 0x40, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e", 0x0, 0x0, 0x0, 0x0, 0x0}) openat$autofs(0xffffffffffffff9c, &(0x7f0000000040), 0x2001, 0x0) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) mkdirat(r1, &(0x7f00000000c0)='./file0\x00', 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r1, 0x81f8943c, &(0x7f0000000400)) setxattr$incfs_metadata(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), &(0x7f0000000240)="4deca30356e343eec7f799012456902373c1d6f53da60ae6b2a3dd22aaf06fb53fdb8b1058e223499e731a4e7a32a66db79aa70a1acf82a4f7b37a6eb1a4ce10e5f0359022c0992b77db1cb5061fbb9ad55d4ed13f1807921f307ad689a08aad5d86094b4750fdee11ff359d22d8fa9008d49e6d5c458e5c3ba634ce8163beefae12c5a619be097d87f856e18984121a188c43dbf3be46", 0x97, 0x2) pipe(&(0x7f0000000080)={0xffffffffffffffff}) ioctl$SG_SET_FORCE_PACK_ID(r2, 0x227b, &(0x7f0000000100)) openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x40000, 0x80) 09:54:24 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) mkdirat(r1, &(0x7f00000000c0)='./file0\x00', 0x0) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r3 = syz_io_uring_setup(0x3ede, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000140)) io_uring_enter(r3, 0x2ff, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x5, 0x0, &(0x7f0000000040)=""/18, 0xffffffde}, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, &(0x7f0000000dc0)=[{&(0x7f0000000100)="f4a4848461fb0592d2f8db4c1f3c9e408788e03d28fe5e69dbceea46dd67888cdedd07a068040b956c3af7", 0x2b}, {0x0}, {0x0}], 0x3, &(0x7f0000000540)=ANY=[@ANYBLOB="1400000000000000", @ANYRES32], 0x50}}, {{0x0, 0x0, &(0x7f0000003180)=[{0x0}, {0x0}], 0x2, &(0x7f00000002c0)=ANY=[@ANYBLOB="c9252cdfb191d94ef15953a086ed40b24a018fb18d39f9a1256b33cf339f1d1bb52846ddaaaecd492eb1d0774b26968a44bf794e9d902a3c02af9543bc4096ac7a27", @ANYRES32, @ANYRES32=0x0], 0x50, 0x4041}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYRESDEC, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000003000000000000000010000000100", @ANYRES32, @ANYRES64, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESDEC=r4], 0xd0, 0x20000000}}], 0x3, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x138, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {0x0, 0x0, 0x9effffff}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x48, 0x1, {{'md5\x00'}}}]}, 0x138}}, 0x0) 09:54:24 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="5500000018007f083ffe15b282a380930a03070248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) 09:54:24 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x25000000}}}, 0xf0}}, 0x0) [ 527.846135][T27358] loop2: p3 start 196833 is beyond EOD, truncated [ 527.853015][T27358] loop2: p5 size 11290111 extends beyond EOD, truncated [ 527.860376][T27358] loop2: p6 start 196833 is beyond EOD, truncated 09:54:24 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x33000000}}}, 0xf0}}, 0x0) [ 527.907134][T27368] netlink: 224 bytes leftover after parsing attributes in process `syz-executor.4'. [ 527.917124][ C1] sd 0:0:1:0: [sg_rq_end_io] Sense Key : Illegal Request [current] [ 527.925167][ C1] sd 0:0:1:0: [sg_rq_end_io] Add. Sense: Invalid command operation code [ 527.933737][ T23] kauditd_printk_skb: 12 callbacks suppressed 09:54:24 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="5500000018007f083ffe15b282a380930a03080248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) 09:54:24 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x9, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000e80)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) io_uring_enter(r1, 0x0, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x50}}], 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x58, 0x1, {{'md5\x00'}, 0x80, "f959fb7b2a535a87359f0b633f54f881"}}]}, 0x148}, 0x1, 0xa}, 0x0) 09:54:24 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) mkdirat(r1, &(0x7f00000000c0)='./file0\x00', 0x0) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r3 = syz_io_uring_setup(0x3ede, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000140)) io_uring_enter(r3, 0x2ff, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x5, 0x0, &(0x7f0000000040)=""/18, 0xffffffde}, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, &(0x7f0000000dc0)=[{&(0x7f0000000100)="f4a4848461fb0592d2f8db4c1f3c9e408788e03d28fe5e69dbceea46dd67888cdedd07a068040b956c3af7", 0x2b}, {0x0}, {0x0}], 0x3, &(0x7f0000000540)=ANY=[@ANYBLOB="1400000000000000", @ANYRES32], 0x50}}, {{0x0, 0x0, &(0x7f0000003180)=[{0x0}, {0x0}], 0x2, &(0x7f00000002c0)=ANY=[@ANYBLOB="c9252cdfb191d94ef15953a086ed40b24a018fb18d39f9a1256b33cf339f1d1bb52846ddaaaecd492eb1d0774b26968a44bf794e9d902a3c02af9543bc4096ac7a27", @ANYRES32, @ANYRES32=0x0], 0x50, 0x4041}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYRESDEC, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000003000000000000000010000000100", @ANYRES32, @ANYRES64, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESDEC=r4], 0xd0, 0x20000000}}], 0x3, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x138, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {0x0, 0x0, 0xb0020000}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x48, 0x1, {{'md5\x00'}}}]}, 0x138}}, 0x0) [ 527.933748][ T23] audit: type=1400 audit(1636365264.545:486): avc: denied { write } for pid=27366 comm="syz-executor.3" name="autofs" dev="devtmpfs" ino=90 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:autofs_device_t tclass=chr_file permissive=1 [ 527.939849][ C1] sd 0:0:1:0: [sg_rq_end_io] Sense Key : Illegal Request [current] [ 527.939872][ C1] sd 0:0:1:0: [sg_rq_end_io] Add. Sense: Invalid command operation code 09:54:24 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x6, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e", 0x0, 0xfffffffe, 0x0, 0x0, 0x0}) fallocate(r0, 0x60, 0x8, 0xfff) ioctl$SCSI_IOCTL_GET_PCI(r0, 0x5387, &(0x7f0000000040)) 09:54:24 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="5500000018007f083ffe15b282a380930a03090248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) [ 528.080321][T27479] netlink: 224 bytes leftover after parsing attributes in process `syz-executor.4'. [ 528.162580][ C1] sd 0:0:1:0: [sg_rq_end_io] Sense Key : Illegal Request [current] [ 528.170634][ C1] sd 0:0:1:0: [sg_rq_end_io] Add. Sense: Invalid command operation code [ 528.179381][ C1] sd 0:0:1:0: [sg_rq_end_io] Sense Key : Illegal Request [current] [ 528.187381][ C1] sd 0:0:1:0: [sg_rq_end_io] Add. Sense: Invalid command operation code [ 528.216652][T27589] loop2: detected capacity change from 0 to 16383 [ 528.251489][ T5592] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 528.256780][ T5592] loop2: p1 size 11290111 extends beyond EOD, truncated [ 528.264736][ T5592] loop2: p3 start 262881 is beyond EOD, truncated [ 528.271877][ T5592] loop2: p5 size 11290111 extends beyond EOD, truncated [ 528.279419][ T5592] loop2: p6 start 262881 is beyond EOD, truncated [ 528.287705][T27589] loop2: p1 p2 < > p3 p4 < p5 p6 > [ 528.293091][T27589] loop2: p1 size 11290111 extends beyond EOD, truncated [ 528.300744][T27589] loop2: p3 start 262881 is beyond EOD, truncated [ 528.307535][T27589] loop2: p5 size 11290111 extends beyond EOD, truncated [ 528.314907][T27589] loop2: p6 start 262881 is beyond EOD, truncated 09:54:24 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x9, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000e80)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) io_uring_enter(r1, 0x0, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x50}}], 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x58, 0x1, {{'md5\x00'}, 0x80, "f959fb7b2a535a87359f0b633f54f881"}}]}, 0x148}, 0x1, 0xb}, 0x0) 09:54:24 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3e010000}}}, 0xf0}}, 0x0) 09:54:24 executing program 2: syz_read_part_table(0x0, 0x2, &(0x7f0000000100)=[{&(0x7f00000000c0)="0201a9ffffff0a000000ff45ac0000ffffff85000000060000000000024000ffffff82000000e106040088770072003007000f00000000000000008000da55aa", 0x40, 0x1c0}, {0x0, 0x0, 0xfffffffffffffffb}]) 09:54:24 executing program 3: syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) r0 = syz_open_dev$vcsu(&(0x7f0000000080), 0x8, 0x202002) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x6, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000040)="e5f432732f4e", 0x0, 0x80000000, 0x10020, 0x0, 0x0}) sendmsg$DEVLINK_CMD_RATE_NEW(r0, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f00000001c0)={&(0x7f0000000100)={0x88, 0x0, 0x1, 0x70bd2b, 0x25dfdbfc, {}, [@DEVLINK_ATTR_RATE_PARENT_NODE_NAME={0xe}, @DEVLINK_ATTR_RATE_TX_SHARE={0xc, 0xa6, 0x200}, @DEVLINK_ATTR_RATE_NODE_NAME={0xe}, @handle=@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, @DEVLINK_ATTR_PORT_INDEX={0x8, 0x3, 0x2}, @handle=@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}]}, 0x88}}, 0x20008000) 09:54:24 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) mkdirat(r1, &(0x7f00000000c0)='./file0\x00', 0x0) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r3 = syz_io_uring_setup(0x3ede, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000140)) io_uring_enter(r3, 0x2ff, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x5, 0x0, &(0x7f0000000040)=""/18, 0xffffffde}, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, &(0x7f0000000dc0)=[{&(0x7f0000000100)="f4a4848461fb0592d2f8db4c1f3c9e408788e03d28fe5e69dbceea46dd67888cdedd07a068040b956c3af7", 0x2b}, {0x0}, {0x0}], 0x3, &(0x7f0000000540)=ANY=[@ANYBLOB="1400000000000000", @ANYRES32], 0x50}}, {{0x0, 0x0, &(0x7f0000003180)=[{0x0}, {0x0}], 0x2, &(0x7f00000002c0)=ANY=[@ANYBLOB="c9252cdfb191d94ef15953a086ed40b24a018fb18d39f9a1256b33cf339f1d1bb52846ddaaaecd492eb1d0774b26968a44bf794e9d902a3c02af9543bc4096ac7a27", @ANYRES32, @ANYRES32=0x0], 0x50, 0x4041}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYRESDEC, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000003000000000000000010000000100", @ANYRES32, @ANYRES64, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESDEC=r4], 0xd0, 0x20000000}}], 0x3, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x138, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {0x0, 0x0, 0xeaffffff}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x48, 0x1, {{'md5\x00'}}}]}, 0x138}}, 0x0) 09:54:24 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="5500000018007f083ffe15b282a380930a030a0248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) 09:54:25 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="5500000018007f083ffe15b282a380930a030b0248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) 09:54:25 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48000000}}}, 0xf0}}, 0x0) 09:54:25 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x9, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000e80)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) io_uring_enter(r1, 0x0, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x50}}], 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x58, 0x1, {{'md5\x00'}, 0x80, "f959fb7b2a535a87359f0b633f54f881"}}]}, 0x148}, 0x1, 0x10}, 0x0) [ 528.411612][T27597] netlink: 224 bytes leftover after parsing attributes in process `syz-executor.4'. 09:54:25 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) mkdirat(r1, &(0x7f00000000c0)='./file0\x00', 0x0) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r3 = syz_io_uring_setup(0x3ede, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180)=0x0, &(0x7f0000000140)) io_uring_enter(r3, 0x2ff, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x5, 0x0, &(0x7f0000000040)=""/18, 0xffffffde}, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, &(0x7f0000000dc0)=[{&(0x7f0000000100)="f4a4848461fb0592d2f8db4c1f3c9e408788e03d28fe5e69dbceea46dd67888cdedd07a068040b956c3af7", 0x2b}, {0x0}, {0x0}], 0x3, &(0x7f0000000540)=ANY=[@ANYBLOB="1400000000000000", @ANYRES32], 0x50}}, {{0x0, 0x0, &(0x7f0000003180)=[{0x0}, {0x0}], 0x2, &(0x7f00000002c0)=ANY=[@ANYBLOB="c9252cdfb191d94ef15953a086ed40b24a018fb18d39f9a1256b33cf339f1d1bb52846ddaaaecd492eb1d0774b26968a44bf794e9d902a3c02af9543bc4096ac7a27", @ANYRES32, @ANYRES32=0x0], 0x50, 0x4041}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYRESDEC, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000003000000000000000010000000100", @ANYRES32, @ANYRES64, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRESDEC=r4], 0xd0, 0x20000000}}], 0x3, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x138, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60, 0x0, 0x33}, @in=@broadcast, {}, {0x0, 0x0, 0xefffffff}, {}, 0x0, 0x0, 0xa}, [@algo_auth={0x48, 0x1, {{'md5\x00'}}}]}, 0x138}}, 0x0) 09:54:25 executing program 3: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) close(r0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x6, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e", 0x0, 0x0, 0x0, 0x0, 0x0}) readv(0xffffffffffffffff, &(0x7f0000000700)=[{&(0x7f0000000040)=""/111, 0x6f}, {&(0x7f00000000c0)=""/220, 0xdc}, {&(0x7f00000007c0)=""/56, 0x38}, {&(0x7f0000000240)=""/66, 0x42}, {&(0x7f00000002c0)=""/36, 0x24}, {&(0x7f0000000400)=""/149, 0x95}, {&(0x7f00000004c0)=""/182, 0xb6}, {&(0x7f0000000300)=""/89, 0x59}, {&(0x7f0000000580)=""/204, 0xcc}, {&(0x7f0000000680)=""/98, 0x62}], 0xa) r1 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r1, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x0, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200), 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$SG_IO(r1, 0x2285, &(0x7f0000001d00)={0x53, 0xffffffffffffffff, 0xf7, 0x70, @scatter={0x6, 0x0, &(0x7f0000000b40)=[{&(0x7f0000000800)=""/135, 0x87}, {&(0x7f00000008c0)=""/10, 0xa}, {&(0x7f0000000900)=""/209, 0xd1}, {&(0x7f0000000a00)=""/124, 0x7c}, {&(0x7f0000000a80)}, {&(0x7f0000000ac0)=""/78, 0x4e}]}, &(0x7f0000000bc0)="a8d3819ee451fb7029dc1e4769d2e54ff37782ddf56f831bff0680d2ccc90cc61434a7b5e64a09d6869dbf1a8e549f6c5477d7fa86ff6f5b34fc11b215d1fa020e3c4e02ae2dd4cd1fb54f7e7a672fc6fd1e4a9aa6a2279d05f338b65fbef3245fa0994ccb5b893dc4a5955f1af6671ba76f31e31576c211147327afa64f1d1a6b920a5dc1b03340dd3bf78f4ed7312855a3a8fe80e83740bb8badd29b9b62e2af4b599ac212c33dcc23a7ab709ca0c3ee398af1522ee0953be62c60647a6cff797520eee67e63a823ae9c66a7203d2dce4d22f350e33e08105b6c7df4f24a6a757e2f7cdf2e278a1aec941416dcdbce66f56b36808a37", &(0x7f0000000cc0)=""/4096, 0x400, 0x3, 0x3, &(0x7f0000001cc0)}) r2 = openat$urandom(0xffffffffffffff9c, &(0x7f00000001c0), 0x400, 0x0) writev(r2, &(0x7f0000000800), 0x0) 09:54:25 executing program 5: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0xa, &(0x7f00000000c0)=[{&(0x7f0000000180)="5500000018007f083ffe15b282a380930a030c0248a84302916d0200390009003500ff6c0200000005000500fe80ffff070b566881b18432009b1100b1df13000000fb0000400014000040970de3b3000000000900", 0x55}], 0x1}, 0x0) 09:54:25 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0xf0, 0x12, 0x713, 0x0, 0x0, {{@in6=@local, @in=@empty}, {@in=@empty=0x60}, @in=@broadcast, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4c000000}}}, 0xf0}}, 0x0) 09:54:25 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x9, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000e80)) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r1 = syz_io_uring_setup(0x0, 0x0, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) io_uring_enter(r1, 0x0, 0x6c00, 0x0, 0x0, 0x0) syz_io_uring_setup(0x0, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000180), &(0x7f0000000140)) syz_io_uring_submit(0x0, 0x0, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000003ec0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x50}}], 0x1, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newsa={0x148, 0x10, 0x713, 0x0, 0x0, {{@in6=@local, @i