ge from 0 to 16 07:14:18 executing program 4: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x3, r0, &(0x7f0000000000), 0x16002}]) 07:14:18 executing program 1: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000180)='./file1\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="20000000360000001900000060008f000ff68f01000000000000000005000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}], 0x0, &(0x7f0000000140)={[{@jqfmt_vfsv0}]}) 07:14:18 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\x00\x00z', 0xfffffffffffffffe) 07:14:18 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x100, 0x0}) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x28000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5, 0x8}, 0x4000, 0x0, 0x9, 0x7, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000001440)) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r1, 0xd000943e, 0x0) clone(0x40808000, 0x0, 0x0, 0x0, 0x0) r2 = gettid() tkill(r2, 0x1e) r3 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r3, 0x0) ptrace$cont(0x18, 0x0, 0x0, 0x1) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ptrace$cont(0x7, 0x0, 0x0, 0x10001) openat$full(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x2, 0x80, 0x4, 0x4, 0xe0, 0xb, 0x0, 0x0, 0x8000, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x8004, 0x2, @perf_bp={0x0}, 0x4000, 0x8000, 0xfffffff9, 0x7, 0x80000001, 0x8, 0x0, 0x0, 0xa, 0x0, 0x100000000}, r2, 0x8, 0xffffffffffffffff, 0x6ee4ca8bd5713173) 07:14:18 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x100, 0x0}) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x28000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_config_ext={0x5, 0x8}, 0x4000, 0x0, 0x9, 0x7, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000001440)) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r1, 0xd000943e, 0x0) r2 = gettid() clone(0x40808000, 0x0, 0x0, 0x0, 0x0) gettid() r3 = gettid() tkill(r3, 0x1e) r4 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r4, 0x0) preadv(r4, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(r4, 0x8982, &(0x7f0000000040)) ptrace$cont(0x7, r2, 0x0, 0x10001) openat$full(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x2, 0x80, 0x0, 0x4, 0x40, 0xb, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x8004, 0x2, @perf_bp={0x0}, 0x4000, 0x8000, 0xfffffff9, 0x7, 0x80000001, 0x8, 0x0, 0x0, 0x6, 0x0, 0x100000000}, r3, 0x8, 0xffffffffffffffff, 0x6ee4ca8bd5713173) 07:14:18 executing program 3: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000, 0x0, 0x204000000000000}]) [ 928.733578][ T3104] loop3: detected capacity change from 0 to 16 07:14:18 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00w~\x9fp\x94\x9f', 0xfffffffffffffffe) 07:14:19 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x100, 0x0}) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x28000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x5, 0x8}, 0x4000, 0x0, 0x9, 0x7, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000001440)) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r1, 0xd000943e, 0x0) clone(0x40808000, 0x0, 0x0, 0x0, 0x0) r2 = gettid() tkill(r2, 0x1e) r3 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r3, 0x0) ptrace$cont(0x18, 0x0, 0x0, 0x1) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ptrace$cont(0x7, 0x0, 0x0, 0x10001) openat$full(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x2, 0x80, 0x4, 0x4, 0xe0, 0xb, 0x0, 0x0, 0x8000, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x8004, 0x2, @perf_bp={0x0}, 0x4000, 0x8000, 0xfffffff9, 0x7, 0x80000001, 0x8, 0x0, 0x0, 0xa, 0x0, 0x100000000}, r2, 0x8, 0xffffffffffffffff, 0x6ee4ca8bd5713173) [ 928.775710][ T3114] loop1: detected capacity change from 0 to 4 [ 928.802841][ T3114] EXT4-fs (loop1): Quota format mount options ignored when QUOTA feature is enabled [ 928.812240][ T3114] EXT4-fs (loop1): unsupported descriptor size 0 07:14:19 executing program 3: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000, 0x0, 0x300000000000000}]) 07:14:19 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\xff\xff\xff\xfe', 0xfffffffffffffffe) [ 928.903788][ T3114] loop1: detected capacity change from 0 to 4 [ 928.920114][ T3148] loop3: detected capacity change from 0 to 16 [ 928.936649][ T3114] EXT4-fs (loop1): Quota format mount options ignored when QUOTA feature is enabled [ 928.946090][ T3114] EXT4-fs (loop1): unsupported descriptor size 0 07:14:19 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x100, 0x0}) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x28000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_config_ext={0x0, 0x8}, 0x4000, 0x0, 0x9, 0x7, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000001440)) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r1, 0xd000943e, 0x0) clone(0x40808000, 0x0, 0x0, 0x0, 0x0) r2 = gettid() tkill(r2, 0x1e) r3 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r3, 0x0) ptrace$cont(0x18, 0x0, 0x0, 0x1) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ptrace$cont(0x7, 0x0, 0x0, 0x10001) openat$full(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x2, 0x80, 0x4, 0x4, 0xe0, 0xb, 0x0, 0x0, 0x8000, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x8004, 0x2, @perf_bp={0x0}, 0x4000, 0x8000, 0xfffffff9, 0x7, 0x80000001, 0x8, 0x0, 0x0, 0xa, 0x0, 0x100000000}, r2, 0x8, 0xffffffffffffffff, 0x6ee4ca8bd5713173) 07:14:19 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x02\x00\x00\x00\x00\x00\x00', 0xfffffffffffffffe) [ 929.050970][ T3169] loop4: detected capacity change from 0 to 16 07:14:19 executing program 4: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x4, r0, &(0x7f0000000000), 0x16002}]) 07:14:19 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x100, 0x0}) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x28000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_config_ext={0x5, 0x8}, 0x4000, 0x0, 0x9, 0x7, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/timer_list\x00', 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000001440)) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r1, 0xd000943e, 0x0) r2 = gettid() clone(0x40808000, 0x0, 0x0, 0x0, 0x0) r3 = gettid() tkill(r3, 0x1e) r4 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r4, 0x0) preadv(r4, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(r4, 0x8982, &(0x7f0000000040)) ptrace$cont(0x7, r2, 0x0, 0x10001) openat$full(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x2, 0x80, 0x0, 0x4, 0x40, 0xb, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x8004, 0x2, @perf_bp={0x0}, 0x4000, 0x8000, 0xfffffff9, 0x7, 0x80000001, 0x8, 0x0, 0x0, 0x6, 0x0, 0x100000000}, r3, 0x8, 0xffffffffffffffff, 0x6ee4ca8bd5713173) 07:14:19 executing program 1: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000180)='./file1\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="20000000360000001900000060008f000ff68f01000000000000000006000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}], 0x0, &(0x7f0000000140)={[{@jqfmt_vfsv0}]}) 07:14:19 executing program 3: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000, 0x0, 0x400000000000000}]) 07:14:19 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x03\x00\x00\x00\x00\x00\x00', 0xfffffffffffffffe) 07:14:19 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x100, 0x0}) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x28000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_config_ext={0x0, 0x8}, 0x4000, 0x0, 0x9, 0x7, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000001440)) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r1, 0xd000943e, 0x0) clone(0x40808000, 0x0, 0x0, 0x0, 0x0) r2 = gettid() tkill(r2, 0x1e) r3 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r3, 0x0) ptrace$cont(0x18, 0x0, 0x0, 0x1) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ptrace$cont(0x7, 0x0, 0x0, 0x10001) openat$full(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x2, 0x80, 0x4, 0x4, 0xe0, 0xb, 0x0, 0x0, 0x8000, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x8004, 0x2, @perf_bp={0x0}, 0x4000, 0x8000, 0xfffffff9, 0x7, 0x80000001, 0x8, 0x0, 0x0, 0xa, 0x0, 0x100000000}, r2, 0x8, 0xffffffffffffffff, 0x6ee4ca8bd5713173) [ 929.260334][ T3198] loop1: detected capacity change from 0 to 4 [ 929.268506][ T3200] loop3: detected capacity change from 0 to 16 [ 929.292903][ T3198] EXT4-fs (loop1): Quota format mount options ignored when QUOTA feature is enabled [ 929.302334][ T3198] EXT4-fs (loop1): unsupported descriptor size 0 07:14:19 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x04\x00\x00\x00\x00\x00\x00', 0xfffffffffffffffe) 07:14:19 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x100, 0x0}) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) r1 = perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x28000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_config_ext={0x5, 0x8}, 0x4000, 0x0, 0x9, 0x7, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000001440)) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r2, 0xd000943e, 0x0) r3 = gettid() clone(0x40808000, 0x0, 0x0, 0x0, 0x0) r4 = gettid() tkill(r4, 0x1e) r5 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r5, 0x0) perf_event_open(&(0x7f00000000c0)={0x5, 0x80, 0x7, 0x5, 0x81, 0x51, 0x0, 0x5, 0x50000, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000080), 0x3}, 0x4010, 0x5, 0x4, 0x3, 0x8, 0x1, 0x1, 0x0, 0x6, 0x0, 0x1000}, r4, 0xb, r1, 0x0) preadv(r5, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(r5, 0x8982, &(0x7f0000000040)) ptrace$cont(0x7, r3, 0x0, 0x10001) openat$full(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x2, 0x80, 0x0, 0x4, 0x40, 0xb, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x8004, 0x2, @perf_bp={0x0}, 0x4000, 0x8000, 0xfffffff9, 0x7, 0x80000001, 0x8, 0x0, 0x0, 0x6, 0x0, 0x100000000}, r4, 0x8, 0xffffffffffffffff, 0x6ee4ca8bd5713173) 07:14:19 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x05\x00\x00\x00\x00\x00\x00', 0xfffffffffffffffe) 07:14:19 executing program 3: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000, 0x0, 0x500000000000000}]) 07:14:19 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x100, 0x0}) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x28000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_config_ext={0x0, 0x8}, 0x4000, 0x0, 0x9, 0x7, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000001440)) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r1, 0xd000943e, 0x0) clone(0x40808000, 0x0, 0x0, 0x0, 0x0) r2 = gettid() tkill(r2, 0x1e) r3 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r3, 0x0) ptrace$cont(0x18, 0x0, 0x0, 0x1) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ptrace$cont(0x7, 0x0, 0x0, 0x10001) openat$full(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x2, 0x80, 0x4, 0x4, 0xe0, 0xb, 0x0, 0x0, 0x8000, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x8004, 0x2, @perf_bp={0x0}, 0x4000, 0x8000, 0xfffffff9, 0x7, 0x80000001, 0x8, 0x0, 0x0, 0xa, 0x0, 0x100000000}, r2, 0x8, 0xffffffffffffffff, 0x6ee4ca8bd5713173) [ 929.405283][ T3198] loop1: detected capacity change from 0 to 4 [ 929.424215][ T3198] EXT4-fs (loop1): Quota format mount options ignored when QUOTA feature is enabled [ 929.433773][ T3198] EXT4-fs (loop1): unsupported descriptor size 0 07:14:19 executing program 1: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000180)='./file1\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="20000000360000001900000060008f000ff68f01000000000000000007000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}], 0x0, &(0x7f0000000140)={[{@jqfmt_vfsv0}]}) [ 929.497153][ T3248] loop3: detected capacity change from 0 to 16 [ 929.555098][ T3264] loop1: detected capacity change from 0 to 4 [ 929.576662][ T3264] EXT4-fs (loop1): Quota format mount options ignored when QUOTA feature is enabled [ 929.586077][ T3264] EXT4-fs (loop1): unsupported descriptor size 0 [ 929.649492][ T3264] loop1: detected capacity change from 0 to 4 [ 929.669616][ T3264] EXT4-fs (loop1): Quota format mount options ignored when QUOTA feature is enabled [ 929.679582][ T3264] EXT4-fs (loop1): unsupported descriptor size 0 [ 929.699173][ T3281] loop4: detected capacity change from 0 to 16 07:14:20 executing program 4: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x5, r0, &(0x7f0000000000), 0x16002}]) 07:14:20 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x06\x00\x00\x00\x00\x00\x00', 0xfffffffffffffffe) 07:14:20 executing program 3: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000, 0x0, 0x600000000000000}]) 07:14:20 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x100, 0x0}) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x28000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_config_ext={0x5}, 0x4000, 0x0, 0x9, 0x7, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000001440)) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r1, 0xd000943e, 0x0) clone(0x40808000, 0x0, 0x0, 0x0, 0x0) r2 = gettid() tkill(r2, 0x1e) r3 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r3, 0x0) ptrace$cont(0x18, 0x0, 0x0, 0x1) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ptrace$cont(0x7, 0x0, 0x0, 0x10001) openat$full(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x2, 0x80, 0x4, 0x4, 0xe0, 0xb, 0x0, 0x0, 0x8000, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x8004, 0x2, @perf_bp={0x0}, 0x4000, 0x8000, 0xfffffff9, 0x7, 0x80000001, 0x8, 0x0, 0x0, 0xa, 0x0, 0x100000000}, r2, 0x8, 0xffffffffffffffff, 0x6ee4ca8bd5713173) 07:14:20 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x100, 0x0}) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) r1 = perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x28000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_config_ext={0x5, 0x8}, 0x4000, 0x0, 0x9, 0x7, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000001440)) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r2, 0xd000943e, 0x0) r3 = gettid() clone(0x40808000, 0x0, 0x0, 0x0, 0x0) r4 = gettid() tkill(r4, 0x1e) r5 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r5, 0x0) perf_event_open(&(0x7f00000000c0)={0x5, 0x80, 0x7, 0x5, 0x81, 0x51, 0x0, 0x5, 0x50000, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000000080), 0x3}, 0x4010, 0x5, 0x4, 0x3, 0x8, 0x1, 0x1, 0x0, 0x6, 0x0, 0x1000}, r4, 0xb, r1, 0x0) preadv(r5, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(r5, 0x8982, &(0x7f0000000040)) ptrace$cont(0x7, r3, 0x0, 0x10001) openat$full(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x2, 0x80, 0x0, 0x4, 0x40, 0xb, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x8004, 0x2, @perf_bp={0x0}, 0x4000, 0x8000, 0xfffffff9, 0x7, 0x80000001, 0x8, 0x0, 0x0, 0x6, 0x0, 0x100000000}, r4, 0x8, 0xffffffffffffffff, 0x6ee4ca8bd5713173) 07:14:20 executing program 1: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000180)='./file1\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="20000000360000001900000060008f000ff68f01000000000000000008000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}], 0x0, &(0x7f0000000140)={[{@jqfmt_vfsv0}]}) 07:14:20 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\a\x00\x00\x00\x00\x00\x00', 0xfffffffffffffffe) [ 929.884298][ T3297] loop1: detected capacity change from 0 to 4 [ 929.889089][ T3296] loop3: detected capacity change from 0 to 16 [ 929.906494][ T3297] EXT4-fs (loop1): Quota format mount options ignored when QUOTA feature is enabled [ 929.915955][ T3297] EXT4-fs (loop1): unsupported descriptor size 0 07:14:20 executing program 0: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x0e\x00\x00\x00\x00', 0xfffffffffffffffe) [ 929.975452][ T3297] loop1: detected capacity change from 0 to 4 [ 930.000212][ T3297] EXT4-fs (loop1): Quota format mount options ignored when QUOTA feature is enabled [ 930.009651][ T3297] EXT4-fs (loop1): unsupported descriptor size 0 07:14:20 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\b\x00\x00\x00\x00\x00\x00', 0xfffffffffffffffe) 07:14:20 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x100, 0x0}) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x28200, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_config_ext={0x6, 0x8}, 0x4000, 0x0, 0x9, 0x7, 0x80000000, 0x8000, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000440)) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r1, 0xd000943e, 0x0) r2 = gettid() clone(0x40808000, 0x0, 0x0, 0x0, 0x0) r3 = gettid() fork() tkill(r3, 0x1e) r4 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r4, 0x0) preadv(r4, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(r4, 0x8982, &(0x7f0000000040)) ptrace$cont(0x7, r2, 0x0, 0x10001) openat$full(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x2, 0x80, 0x0, 0x4, 0x8, 0xb, 0x0, 0x400000, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x9, 0x2, @perf_bp={0x0}, 0x4000, 0x8000, 0xfffffff9, 0x7, 0x80000001, 0x8, 0x0, 0x0, 0x6, 0x0, 0x100000000}, r3, 0xe, 0xffffffffffffffff, 0x6ee4ca8bd5713173) 07:14:20 executing program 3: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000, 0x0, 0x604000000000000}]) 07:14:20 executing program 1: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000180)='./file1\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="20000000360000001900000060008f000ff68f01000000000000000009000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}], 0x0, &(0x7f0000000140)={[{@jqfmt_vfsv0}]}) [ 930.158102][ T3347] loop1: detected capacity change from 0 to 4 [ 930.160781][ T3350] loop3: detected capacity change from 0 to 16 [ 930.183474][ T3347] EXT4-fs (loop1): Quota format mount options ignored when QUOTA feature is enabled [ 930.192885][ T3347] EXT4-fs (loop1): unsupported descriptor size 0 [ 930.269348][ T3367] loop4: detected capacity change from 0 to 16 [ 930.281987][ T3347] loop1: detected capacity change from 0 to 4 [ 930.294354][ T3347] EXT4-fs (loop1): Quota format mount options ignored when QUOTA feature is enabled [ 930.303779][ T3347] EXT4-fs (loop1): unsupported descriptor size 0 07:14:20 executing program 4: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x6, r0, &(0x7f0000000000), 0x16002}]) 07:14:20 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\t\x00\x00\x00\x00\x00\x00', 0xfffffffffffffffe) 07:14:20 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x100, 0x0}) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x28000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_config_ext={0x5}, 0x4000, 0x0, 0x9, 0x7, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000001440)) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r1, 0xd000943e, 0x0) clone(0x40808000, 0x0, 0x0, 0x0, 0x0) r2 = gettid() tkill(r2, 0x1e) r3 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r3, 0x0) ptrace$cont(0x18, 0x0, 0x0, 0x1) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ptrace$cont(0x7, 0x0, 0x0, 0x10001) openat$full(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x2, 0x80, 0x4, 0x4, 0xe0, 0xb, 0x0, 0x0, 0x8000, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x8004, 0x2, @perf_bp={0x0}, 0x4000, 0x8000, 0xfffffff9, 0x7, 0x80000001, 0x8, 0x0, 0x0, 0xa, 0x0, 0x100000000}, r2, 0x8, 0xffffffffffffffff, 0x6ee4ca8bd5713173) 07:14:20 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x100, 0x0}) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x28200, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_config_ext={0x6, 0x8}, 0x4000, 0x0, 0x9, 0x7, 0x80000000, 0x8000, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000440)) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r1, 0xd000943e, 0x0) r2 = gettid() clone(0x40808000, 0x0, 0x0, 0x0, 0x0) r3 = gettid() fork() tkill(r3, 0x1e) r4 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r4, 0x0) preadv(r4, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(r4, 0x8982, &(0x7f0000000040)) ptrace$cont(0x7, r2, 0x0, 0x10001) openat$full(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x2, 0x80, 0x0, 0x4, 0x8, 0xb, 0x0, 0x400000, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x9, 0x2, @perf_bp={0x0}, 0x4000, 0x8000, 0xfffffff9, 0x7, 0x80000001, 0x8, 0x0, 0x0, 0x6, 0x0, 0x100000000}, r3, 0xe, 0xffffffffffffffff, 0x6ee4ca8bd5713173) 07:14:20 executing program 3: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000, 0x0, 0x700000000000000}]) 07:14:20 executing program 1: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000180)='./file1\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="20000000360000001900000060008f000ff68f0100000000000000000a000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}], 0x0, &(0x7f0000000140)={[{@jqfmt_vfsv0}]}) 07:14:20 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\n\x00\x00\x00\x00\x00\x00', 0xfffffffffffffffe) [ 930.459164][ T3393] loop1: detected capacity change from 0 to 4 [ 930.461756][ T3394] loop3: detected capacity change from 0 to 16 [ 930.479082][ T3393] EXT4-fs (loop1): Quota format mount options ignored when QUOTA feature is enabled [ 930.488497][ T3393] EXT4-fs (loop1): unsupported descriptor size 0 07:14:20 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\v\x00\x00\x00\x00\x00\x00', 0xfffffffffffffffe) 07:14:20 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x100, 0x0}) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x28000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_config_ext={0x5}, 0x4000, 0x0, 0x9, 0x7, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000001440)) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r1, 0xd000943e, 0x0) clone(0x40808000, 0x0, 0x0, 0x0, 0x0) r2 = gettid() tkill(r2, 0x1e) r3 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r3, 0x0) ptrace$cont(0x18, 0x0, 0x0, 0x1) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ptrace$cont(0x7, 0x0, 0x0, 0x10001) openat$full(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x2, 0x80, 0x4, 0x4, 0xe0, 0xb, 0x0, 0x0, 0x8000, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x8004, 0x2, @perf_bp={0x0}, 0x4000, 0x8000, 0xfffffff9, 0x7, 0x80000001, 0x8, 0x0, 0x0, 0xa, 0x0, 0x100000000}, r2, 0x8, 0xffffffffffffffff, 0x6ee4ca8bd5713173) [ 930.565563][ T3393] loop1: detected capacity change from 0 to 4 [ 930.587514][ T3393] EXT4-fs (loop1): Quota format mount options ignored when QUOTA feature is enabled [ 930.596926][ T3393] EXT4-fs (loop1): unsupported descriptor size 0 07:14:20 executing program 3: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000, 0x0, 0x800000000000000}]) 07:14:20 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\f\x00\x00\x00\x00\x00\x00', 0xfffffffffffffffe) 07:14:20 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x100, 0x0}) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x28200, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_config_ext={0x6, 0x8}, 0x4000, 0x0, 0x9, 0x7, 0x80000000, 0x8000, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000000440)) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r1, 0xd000943e, 0x0) r2 = gettid() clone(0x40808000, 0x0, 0x0, 0x0, 0x0) r3 = gettid() fork() tkill(r3, 0x1e) r4 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r4, 0x0) preadv(r4, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(r4, 0x8982, &(0x7f0000000040)) ptrace$cont(0x7, r2, 0x0, 0x10001) openat$full(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x2, 0x80, 0x0, 0x4, 0x8, 0xb, 0x0, 0x400000, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x9, 0x2, @perf_bp={0x0}, 0x4000, 0x8000, 0xfffffff9, 0x7, 0x80000001, 0x8, 0x0, 0x0, 0x6, 0x0, 0x100000000}, r3, 0xe, 0xffffffffffffffff, 0x6ee4ca8bd5713173) [ 930.725633][ T3444] loop3: detected capacity change from 0 to 16 [ 930.870334][ T3477] loop4: detected capacity change from 0 to 16 07:14:21 executing program 4: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x8, r0, &(0x7f0000000000), 0x16002}]) 07:14:21 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\r\x00\x00\x00\x00\x00\x00', 0xfffffffffffffffe) 07:14:21 executing program 1: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000180)='./file1\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="20000000360000001900000060008f000ff68f0100000000000000000b000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}], 0x0, &(0x7f0000000140)={[{@jqfmt_vfsv0}]}) 07:14:21 executing program 0: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000, 0x0, 0x1f000000}]) 07:14:21 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x100, 0x0}) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x28000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_config_ext={0x5, 0x8}, 0x0, 0x0, 0x9, 0x7, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000001440)) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r1, 0xd000943e, 0x0) clone(0x40808000, 0x0, 0x0, 0x0, 0x0) r2 = gettid() tkill(r2, 0x1e) r3 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r3, 0x0) ptrace$cont(0x18, 0x0, 0x0, 0x1) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ptrace$cont(0x7, 0x0, 0x0, 0x10001) openat$full(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x2, 0x80, 0x4, 0x4, 0xe0, 0xb, 0x0, 0x0, 0x8000, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x8004, 0x2, @perf_bp={0x0}, 0x4000, 0x8000, 0xfffffff9, 0x7, 0x80000001, 0x8, 0x0, 0x0, 0xa, 0x0, 0x100000000}, r2, 0x8, 0xffffffffffffffff, 0x6ee4ca8bd5713173) 07:14:21 executing program 3: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000, 0x0, 0x900000000000000}]) [ 930.999748][ T3494] loop3: detected capacity change from 0 to 16 [ 931.006375][ T3495] loop1: detected capacity change from 0 to 4 07:14:21 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x0e\x00\x00\x00\x00\x00\x00', 0xfffffffffffffffe) [ 931.040965][ T3495] EXT4-fs (loop1): Quota format mount options ignored when QUOTA feature is enabled [ 931.050379][ T3495] EXT4-fs (loop1): unsupported descriptor size 0 07:14:21 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x100, 0x0}) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x28000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_config_ext={0x5, 0x8}, 0x4000, 0x0, 0x9, 0x7, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r1, 0xd000943e, 0x0) clone(0x40808000, 0x0, 0x0, 0x0, 0x0) r2 = gettid() tkill(r2, 0x1e) r3 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r3, 0x0) ptrace$cont(0x18, 0x0, 0x0, 0x1) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ptrace$cont(0x7, 0x0, 0x0, 0x10001) openat$full(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x2, 0x80, 0x4, 0x4, 0xe0, 0xb, 0x0, 0x0, 0x8000, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x8004, 0x2, @perf_bp={0x0}, 0x4000, 0x8000, 0xfffffff9, 0x7, 0x80000001, 0x8, 0x0, 0x0, 0xa, 0x0, 0x100000000}, r2, 0x8, 0xffffffffffffffff, 0x6ee4ca8bd5713173) [ 931.087227][ T3495] loop1: detected capacity change from 0 to 4 [ 931.113570][ T3495] EXT4-fs (loop1): Quota format mount options ignored when QUOTA feature is enabled [ 931.122998][ T3495] EXT4-fs (loop1): unsupported descriptor size 0 [ 931.130600][ C0] scsi_io_completion_action: 17 callbacks suppressed 07:14:21 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x0f\x00\x00\x00\x00\x00\x00', 0xfffffffffffffffe) 07:14:21 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x10\x00\x00\x00\x00\x00\x00', 0xfffffffffffffffe) [ 931.130625][ C0] sd 0:0:1:0: [sg0] tag#5642 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 931.147647][ C0] sd 0:0:1:0: [sg0] tag#5642 CDB: opcode=0xe5 (vendor) [ 931.154511][ C0] sd 0:0:1:0: [sg0] tag#5642 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 931.164061][ C0] sd 0:0:1:0: [sg0] tag#5642 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 931.173698][ C0] sd 0:0:1:0: [sg0] tag#5642 CDB[20]: ba 07:14:21 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x100, 0x0}) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x28000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_config_ext={0x5, 0x8}, 0x0, 0x0, 0x9, 0x7, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000001440)) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r1, 0xd000943e, 0x0) clone(0x40808000, 0x0, 0x0, 0x0, 0x0) r2 = gettid() tkill(r2, 0x1e) r3 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r3, 0x0) ptrace$cont(0x18, 0x0, 0x0, 0x1) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ptrace$cont(0x7, 0x0, 0x0, 0x10001) openat$full(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x2, 0x80, 0x4, 0x4, 0xe0, 0xb, 0x0, 0x0, 0x8000, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x8004, 0x2, @perf_bp={0x0}, 0x4000, 0x8000, 0xfffffff9, 0x7, 0x80000001, 0x8, 0x0, 0x0, 0xa, 0x0, 0x100000000}, r2, 0x8, 0xffffffffffffffff, 0x6ee4ca8bd5713173) 07:14:21 executing program 3: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000, 0x0, 0xa00000000000000}]) [ 931.257494][ C0] sd 0:0:1:0: [sg0] tag#5643 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 931.267873][ C0] sd 0:0:1:0: [sg0] tag#5643 CDB: opcode=0xe5 (vendor) [ 931.275368][ C0] sd 0:0:1:0: [sg0] tag#5643 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 931.284936][ C0] sd 0:0:1:0: [sg0] tag#5643 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 931.289297][ T3543] loop3: detected capacity change from 0 to 16 [ 931.294497][ C0] sd 0:0:1:0: [sg0] tag#5643 CDB[20]: ba [ 931.358888][ T3558] loop4: detected capacity change from 0 to 16 07:14:21 executing program 4: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x9, r0, &(0x7f0000000000), 0x16002}]) 07:14:21 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x11\x00\x00\x00\x00\x00\x00', 0xfffffffffffffffe) 07:14:21 executing program 1: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000180)='./file1\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="20000000360000001900000060008f000ff68f0100000000000000000c000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}], 0x0, &(0x7f0000000140)={[{@jqfmt_vfsv0}]}) 07:14:21 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x100, 0x0}) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x28000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_config_ext={0x5, 0x8}, 0x4000, 0x0, 0x9, 0x7, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r1, 0xd000943e, 0x0) clone(0x40808000, 0x0, 0x0, 0x0, 0x0) r2 = gettid() tkill(r2, 0x1e) r3 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r3, 0x0) ptrace$cont(0x18, 0x0, 0x0, 0x1) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ptrace$cont(0x7, 0x0, 0x0, 0x10001) openat$full(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x2, 0x80, 0x4, 0x4, 0xe0, 0xb, 0x0, 0x0, 0x8000, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x8004, 0x2, @perf_bp={0x0}, 0x4000, 0x8000, 0xfffffff9, 0x7, 0x80000001, 0x8, 0x0, 0x0, 0xa, 0x0, 0x100000000}, r2, 0x8, 0xffffffffffffffff, 0x6ee4ca8bd5713173) 07:14:21 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x100, 0x0}) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x28000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_config_ext={0x5, 0x8}, 0x0, 0x0, 0x9, 0x7, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000001440)) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r1, 0xd000943e, 0x0) clone(0x40808000, 0x0, 0x0, 0x0, 0x0) r2 = gettid() tkill(r2, 0x1e) r3 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r3, 0x0) ptrace$cont(0x18, 0x0, 0x0, 0x1) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ptrace$cont(0x7, 0x0, 0x0, 0x10001) openat$full(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x2, 0x80, 0x4, 0x4, 0xe0, 0xb, 0x0, 0x0, 0x8000, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x8004, 0x2, @perf_bp={0x0}, 0x4000, 0x8000, 0xfffffff9, 0x7, 0x80000001, 0x8, 0x0, 0x0, 0xa, 0x0, 0x100000000}, r2, 0x8, 0xffffffffffffffff, 0x6ee4ca8bd5713173) 07:14:21 executing program 3: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000, 0x0, 0xb00000000000000}]) [ 931.523568][ C1] sd 0:0:1:0: [sg0] tag#5644 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 931.530790][ C0] sd 0:0:1:0: [sg0] tag#5645 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 931.533951][ C1] sd 0:0:1:0: [sg0] tag#5644 CDB: opcode=0xe5 (vendor) [ 931.544272][ C0] sd 0:0:1:0: [sg0] tag#5645 CDB: opcode=0xe5 (vendor) [ 931.544298][ C0] sd 0:0:1:0: [sg0] tag#5645 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 931.551119][ C1] sd 0:0:1:0: [sg0] tag#5644 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 931.557960][ C0] sd 0:0:1:0: [sg0] tag#5645 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 931.567465][ C1] sd 0:0:1:0: [sg0] tag#5644 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 931.576975][ C0] sd 0:0:1:0: [sg0] tag#5645 CDB[20]: ba [ 931.586503][ C1] sd 0:0:1:0: [sg0] tag#5644 CDB[20]: ba 07:14:21 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x12\x00\x00\x00\x00\x00\x00', 0xfffffffffffffffe) [ 931.627552][ T3581] loop1: detected capacity change from 0 to 4 07:14:21 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00H\x00\x00\x00\x00\x00\x00', 0xfffffffffffffffe) 07:14:21 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00L\x00\x00\x00\x00\x00\x00', 0xfffffffffffffffe) 07:14:21 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x100, 0x0}) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x28000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_config_ext={0x5, 0x8}, 0x4000, 0x0, 0x0, 0x7, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000001440)) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r1, 0xd000943e, 0x0) clone(0x40808000, 0x0, 0x0, 0x0, 0x0) r2 = gettid() tkill(r2, 0x1e) r3 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r3, 0x0) ptrace$cont(0x18, 0x0, 0x0, 0x1) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ptrace$cont(0x7, 0x0, 0x0, 0x10001) openat$full(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x2, 0x80, 0x4, 0x4, 0xe0, 0xb, 0x0, 0x0, 0x8000, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x8004, 0x2, @perf_bp={0x0}, 0x4000, 0x8000, 0xfffffff9, 0x7, 0x80000001, 0x8, 0x0, 0x0, 0xa, 0x0, 0x100000000}, r2, 0x8, 0xffffffffffffffff, 0x6ee4ca8bd5713173) [ 931.767007][ T3581] EXT4-fs (loop1): Quota format mount options ignored when QUOTA feature is enabled [ 931.768551][ C0] sd 0:0:1:0: [sg0] tag#5646 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 931.776452][ T3581] EXT4-fs (loop1): unsupported descriptor size 0 [ 931.786792][ C0] sd 0:0:1:0: [sg0] tag#5646 CDB: opcode=0xe5 (vendor) [ 931.799931][ C0] sd 0:0:1:0: [sg0] tag#5646 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c 07:14:21 executing program 0: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x100, 0x0}) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x28000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_config_ext={0x5, 0x8}, 0x4000, 0x0, 0x9, 0x7, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r1, 0xd000943e, 0x0) clone(0x40808000, 0x0, 0x0, 0x0, 0x0) r2 = gettid() tkill(r2, 0x1e) r3 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r3, 0x0) ptrace$cont(0x18, 0x0, 0x0, 0x1) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ptrace$cont(0x7, 0x0, 0x0, 0x10001) openat$full(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x2, 0x80, 0x4, 0x4, 0xe0, 0xb, 0x0, 0x0, 0x8000, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x8004, 0x2, @perf_bp={0x0}, 0x4000, 0x8000, 0xfffffff9, 0x7, 0x80000001, 0x8, 0x0, 0x0, 0xa, 0x0, 0x100000000}, r2, 0x8, 0xffffffffffffffff, 0x6ee4ca8bd5713173) [ 931.809484][ C0] sd 0:0:1:0: [sg0] tag#5646 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 931.819043][ C0] sd 0:0:1:0: [sg0] tag#5646 CDB[20]: ba [ 931.839486][ T3616] loop3: detected capacity change from 0 to 16 07:14:22 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00h\x00\x00\x00\x00\x00\x00', 0xfffffffffffffffe) [ 931.962613][ C0] sd 0:0:1:0: [sg0] tag#5647 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 931.972991][ C0] sd 0:0:1:0: [sg0] tag#5647 CDB: opcode=0xe5 (vendor) [ 931.979840][ C0] sd 0:0:1:0: [sg0] tag#5647 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 931.989424][ C0] sd 0:0:1:0: [sg0] tag#5647 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 931.998992][ C0] sd 0:0:1:0: [sg0] tag#5647 CDB[20]: ba [ 932.056301][ T3581] loop1: detected capacity change from 0 to 4 [ 932.061576][ T3648] loop4: detected capacity change from 0 to 16 [ 932.079193][ T3581] EXT4-fs (loop1): Quota format mount options ignored when QUOTA feature is enabled [ 932.088717][ T3581] EXT4-fs (loop1): unsupported descriptor size 0 07:14:22 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x100, 0x0}) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x28000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_config_ext={0x5, 0x8}, 0x4000, 0x0, 0x0, 0x7, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000001440)) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r1, 0xd000943e, 0x0) clone(0x40808000, 0x0, 0x0, 0x0, 0x0) r2 = gettid() tkill(r2, 0x1e) r3 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r3, 0x0) ptrace$cont(0x18, 0x0, 0x0, 0x1) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ptrace$cont(0x7, 0x0, 0x0, 0x10001) openat$full(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x2, 0x80, 0x4, 0x4, 0xe0, 0xb, 0x0, 0x0, 0x8000, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x8004, 0x2, @perf_bp={0x0}, 0x4000, 0x8000, 0xfffffff9, 0x7, 0x80000001, 0x8, 0x0, 0x0, 0xa, 0x0, 0x100000000}, r2, 0x8, 0xffffffffffffffff, 0x6ee4ca8bd5713173) 07:14:22 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00l\x00\x00\x00\x00\x00\x00', 0xfffffffffffffffe) 07:14:22 executing program 4: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0xc, r0, &(0x7f0000000000), 0x16002}]) 07:14:22 executing program 0 (fault-call:10 fault-nth:0): syz_mount_image$vfat(&(0x7f00000002c0), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f736617e43c00088020000200000004f8000020004000000000000000000001", 0x25}, {0x0, 0x0, 0x200000000011000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6900) ftruncate(r0, 0x800) lseek(r0, 0x1200, 0x0) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, r1, 0x0, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @private2}, 0x1c) sendfile(r0, r1, 0x0, 0x108d1521) r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_FEATURES_SET(r2, 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHGPRL(0xffffffffffffffff, 0x89f7, &(0x7f00000001c0)={'ip6tnl0\x00', 0x0}) sendmsg$ETHTOOL_MSG_LINKINFO_GET(0xffffffffffffffff, 0x0, 0x0) sendfile(r0, r1, 0x0, 0x8400fffffffa) close(0xffffffffffffffff) 07:14:22 executing program 3: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000, 0x0, 0xc00000000000000}]) 07:14:22 executing program 1: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000180)='./file1\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="20000000360000001900000060008f000ff68f0100000000000000000d000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}], 0x0, &(0x7f0000000140)={[{@jqfmt_vfsv0}]}) [ 932.217189][ C0] sd 0:0:1:0: [sg0] tag#5648 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 932.225643][ T3672] loop1: detected capacity change from 0 to 4 [ 932.227576][ C0] sd 0:0:1:0: [sg0] tag#5648 CDB: opcode=0xe5 (vendor) [ 932.234097][ T3673] loop3: detected capacity change from 0 to 16 [ 932.240623][ C0] sd 0:0:1:0: [sg0] tag#5648 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 932.240644][ C0] sd 0:0:1:0: [sg0] tag#5648 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 932.265858][ C0] sd 0:0:1:0: [sg0] tag#5648 CDB[20]: ba [ 932.282543][ T3669] FAULT_INJECTION: forcing a failure. [ 932.282543][ T3669] name failslab, interval 1, probability 0, space 0, times 0 [ 932.295179][ T3669] CPU: 1 PID: 3669 Comm: syz-executor.0 Not tainted 5.14.0-rc4-syzkaller #0 [ 932.303847][ T3669] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 932.313894][ T3669] Call Trace: [ 932.317163][ T3669] dump_stack_lvl+0xb7/0x103 [ 932.321758][ T3669] dump_stack+0x11/0x1a [ 932.325975][ T3669] should_fail+0x23c/0x250 [ 932.330394][ T3669] __should_failslab+0x81/0x90 [ 932.335223][ T3669] ? alloc_pipe_info+0xac/0x350 [ 932.340069][ T3669] should_failslab+0x5/0x20 [ 932.344563][ T3669] kmem_cache_alloc_trace+0x49/0x310 [ 932.349939][ T3669] alloc_pipe_info+0xac/0x350 [ 932.352686][ T3672] EXT4-fs (loop1): Quota format mount options ignored when QUOTA feature is enabled [ 932.354608][ T3669] splice_direct_to_actor+0x5f7/0x650 [ 932.364103][ T3672] EXT4-fs (loop1): unsupported descriptor size 0 [ 932.369424][ T3669] ? do_splice_direct+0x170/0x170 [ 932.380763][ T3669] ? security_file_permission+0x87/0xa0 [ 932.386311][ T3669] ? rw_verify_area+0x136/0x250 [ 932.391157][ T3669] do_splice_direct+0xf5/0x170 [ 932.395921][ T3669] do_sendfile+0x773/0xda0 [ 932.400411][ T3669] __x64_sys_sendfile64+0xf2/0x130 [ 932.405525][ T3669] do_syscall_64+0x3d/0x90 [ 932.409949][ T3669] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 932.415837][ T3669] RIP: 0033:0x4665e9 [ 932.419710][ T3669] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 932.439402][ T3669] RSP: 002b:00007fad2bf19188 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 [ 932.447796][ T3669] RAX: ffffffffffffffda RBX: 000000000056bf80 RCX: 00000000004665e9 [ 932.455744][ T3669] RDX: 0000000000000000 RSI: 0000000000000004 RDI: 0000000000000003 07:14:22 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00t\x00\x00\x00\x00\x00\x00', 0xfffffffffffffffe) 07:14:22 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x100, 0x0}) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x28000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_config_ext={0x5, 0x8}, 0x4000, 0x0, 0x0, 0x7, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000001440)) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r1, 0xd000943e, 0x0) clone(0x40808000, 0x0, 0x0, 0x0, 0x0) r2 = gettid() tkill(r2, 0x1e) r3 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r3, 0x0) ptrace$cont(0x18, 0x0, 0x0, 0x1) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ptrace$cont(0x7, 0x0, 0x0, 0x10001) openat$full(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x2, 0x80, 0x4, 0x4, 0xe0, 0xb, 0x0, 0x0, 0x8000, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x8004, 0x2, @perf_bp={0x0}, 0x4000, 0x8000, 0xfffffff9, 0x7, 0x80000001, 0x8, 0x0, 0x0, 0xa, 0x0, 0x100000000}, r2, 0x8, 0xffffffffffffffff, 0x6ee4ca8bd5713173) 07:14:22 executing program 1: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000180)='./file1\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="20000000360000001900000060008f000ff68f0100000000000000000e000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}], 0x0, &(0x7f0000000140)={[{@jqfmt_vfsv0}]}) [ 932.463694][ T3669] RBP: 00007fad2bf191d0 R08: 0000000000000000 R09: 0000000000000000 [ 932.471649][ T3669] R10: 00000000108d1521 R11: 0000000000000246 R12: 0000000000000001 [ 932.479601][ T3669] R13: 00007ffd3c1748df R14: 00007fad2bf19300 R15: 0000000000022000 [ 932.541459][ C1] sd 0:0:1:0: [sg0] tag#5650 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 932.551845][ C1] sd 0:0:1:0: [sg0] tag#5650 CDB: opcode=0xe5 (vendor) [ 932.556353][ T3699] loop1: detected capacity change from 0 to 4 [ 932.558728][ C1] sd 0:0:1:0: [sg0] tag#5650 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 932.575869][ C1] sd 0:0:1:0: [sg0] tag#5650 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d 07:14:22 executing program 3: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000, 0x0, 0xd00000000000000}]) 07:14:22 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00z\x00\x00\x00\x00\x00\x00', 0xfffffffffffffffe) 07:14:22 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x03\x00\x00\x00\x00\x00', 0xfffffffffffffffe) [ 932.576812][ T3699] EXT4-fs (loop1): Quota format mount options ignored when QUOTA feature is enabled [ 932.586261][ C1] sd 0:0:1:0: [sg0] tag#5650 CDB[20]: ba [ 932.595734][ T3699] EXT4-fs (loop1): unsupported descriptor size 0 07:14:22 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x05\x00\x00\x00\x00\x00', 0xfffffffffffffffe) 07:14:22 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x100, 0x0}) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x28000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_config_ext={0x5, 0x8}, 0x4000, 0x0, 0x9, 0x0, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000001440)) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r1, 0xd000943e, 0x0) clone(0x40808000, 0x0, 0x0, 0x0, 0x0) r2 = gettid() tkill(r2, 0x1e) r3 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r3, 0x0) ptrace$cont(0x18, 0x0, 0x0, 0x1) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ptrace$cont(0x7, 0x0, 0x0, 0x10001) openat$full(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x2, 0x80, 0x4, 0x4, 0xe0, 0xb, 0x0, 0x0, 0x8000, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x8004, 0x2, @perf_bp={0x0}, 0x4000, 0x8000, 0xfffffff9, 0x7, 0x80000001, 0x8, 0x0, 0x0, 0xa, 0x0, 0x100000000}, r2, 0x8, 0xffffffffffffffff, 0x6ee4ca8bd5713173) [ 932.704381][ T3699] loop1: detected capacity change from 0 to 4 [ 932.729846][ T3699] EXT4-fs (loop1): Quota format mount options ignored when QUOTA feature is enabled [ 932.737498][ T3728] loop3: detected capacity change from 0 to 16 [ 932.739268][ T3699] EXT4-fs (loop1): unsupported descriptor size 0 [ 932.771982][ C1] sd 0:0:1:0: [sg0] tag#5679 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 932.782807][ C1] sd 0:0:1:0: [sg0] tag#5679 CDB: opcode=0xe5 (vendor) [ 932.789653][ C1] sd 0:0:1:0: [sg0] tag#5679 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 932.792489][ T3739] loop4: detected capacity change from 0 to 16 [ 932.799773][ C1] sd 0:0:1:0: [sg0] tag#5679 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 932.815895][ C1] sd 0:0:1:0: [sg0] tag#5679 CDB[20]: ba 07:14:23 executing program 0 (fault-call:10 fault-nth:1): syz_mount_image$vfat(&(0x7f00000002c0), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f736617e43c00088020000200000004f8000020004000000000000000000001", 0x25}, {0x0, 0x0, 0x200000000011000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6900) ftruncate(r0, 0x800) lseek(r0, 0x1200, 0x0) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, r1, 0x0, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @private2}, 0x1c) sendfile(r0, r1, 0x0, 0x108d1521) r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_FEATURES_SET(r2, 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHGPRL(0xffffffffffffffff, 0x89f7, &(0x7f00000001c0)={'ip6tnl0\x00', 0x0}) sendmsg$ETHTOOL_MSG_LINKINFO_GET(0xffffffffffffffff, 0x0, 0x0) sendfile(r0, r1, 0x0, 0x8400fffffffa) close(0xffffffffffffffff) 07:14:23 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x06\x00\x00\x00\x00\x00', 0xfffffffffffffffe) 07:14:23 executing program 1: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000180)='./file1\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="20000000360000001900000060008f000ff68f0100000000000000000f000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}], 0x0, &(0x7f0000000140)={[{@jqfmt_vfsv0}]}) 07:14:23 executing program 3: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000, 0x0, 0xe00000000000000}]) 07:14:23 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x100, 0x0}) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x28000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_config_ext={0x5, 0x8}, 0x4000, 0x0, 0x9, 0x0, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000001440)) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r1, 0xd000943e, 0x0) clone(0x40808000, 0x0, 0x0, 0x0, 0x0) r2 = gettid() tkill(r2, 0x1e) r3 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r3, 0x0) ptrace$cont(0x18, 0x0, 0x0, 0x1) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ptrace$cont(0x7, 0x0, 0x0, 0x10001) openat$full(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x2, 0x80, 0x4, 0x4, 0xe0, 0xb, 0x0, 0x0, 0x8000, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x8004, 0x2, @perf_bp={0x0}, 0x4000, 0x8000, 0xfffffff9, 0x7, 0x80000001, 0x8, 0x0, 0x0, 0xa, 0x0, 0x100000000}, r2, 0x8, 0xffffffffffffffff, 0x6ee4ca8bd5713173) 07:14:23 executing program 4: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x10, r0, &(0x7f0000000000), 0x16002}]) [ 933.089134][ T3765] loop1: detected capacity change from 0 to 4 [ 933.095498][ T3767] loop3: detected capacity change from 0 to 16 [ 933.107096][ T3765] EXT4-fs (loop1): Quota format mount options ignored when QUOTA feature is enabled [ 933.113152][ C1] sd 0:0:1:0: [sg0] tag#5690 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 933.116500][ T3765] EXT4-fs (loop1): unsupported descriptor size 0 [ 933.126822][ C1] sd 0:0:1:0: [sg0] tag#5690 CDB: opcode=0xe5 (vendor) [ 933.140755][ C1] sd 0:0:1:0: [sg0] tag#5690 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 933.150965][ C1] sd 0:0:1:0: [sg0] tag#5690 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 933.160714][ C1] sd 0:0:1:0: [sg0] tag#5690 CDB[20]: ba [ 933.167114][ T3777] loop4: detected capacity change from 0 to 16 [ 933.178118][ T3773] FAULT_INJECTION: forcing a failure. [ 933.178118][ T3773] name failslab, interval 1, probability 0, space 0, times 0 [ 933.190935][ T3773] CPU: 1 PID: 3773 Comm: syz-executor.0 Not tainted 5.14.0-rc4-syzkaller #0 [ 933.199609][ T3773] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 933.210093][ T3773] Call Trace: [ 933.213459][ T3773] dump_stack_lvl+0xb7/0x103 [ 933.218137][ T3773] dump_stack+0x11/0x1a [ 933.222320][ T3773] should_fail+0x23c/0x250 [ 933.227378][ T3773] ? kcalloc+0x32/0x40 [ 933.231653][ T3773] __should_failslab+0x81/0x90 07:14:23 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\a\x00\x00\x00\x00\x00', 0xfffffffffffffffe) [ 933.236453][ T3773] should_failslab+0x5/0x20 [ 933.240958][ T3773] __kmalloc+0x66/0x340 [ 933.245112][ T3773] ? kmem_cache_alloc_trace+0x20f/0x310 [ 933.250825][ T3773] ? alloc_pipe_info+0xac/0x350 [ 933.255693][ T3773] kcalloc+0x32/0x40 [ 933.259621][ T3773] alloc_pipe_info+0x1be/0x350 [ 933.264936][ T3773] splice_direct_to_actor+0x5f7/0x650 [ 933.270467][ T3773] ? do_splice_direct+0x170/0x170 [ 933.276273][ T3773] ? security_file_permission+0x87/0xa0 [ 933.281812][ T3773] ? rw_verify_area+0x136/0x250 [ 933.286769][ T3773] do_splice_direct+0xf5/0x170 [ 933.291547][ T3773] do_sendfile+0x773/0xda0 [ 933.295965][ T3773] __x64_sys_sendfile64+0xf2/0x130 [ 933.301072][ T3773] do_syscall_64+0x3d/0x90 [ 933.305580][ T3773] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 933.311466][ T3773] RIP: 0033:0x4665e9 [ 933.315344][ T3773] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 07:14:23 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x100, 0x0}) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x28000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_config_ext={0x5, 0x8}, 0x4000, 0x0, 0x9, 0x0, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000001440)) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r1, 0xd000943e, 0x0) clone(0x40808000, 0x0, 0x0, 0x0, 0x0) r2 = gettid() tkill(r2, 0x1e) r3 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r3, 0x0) ptrace$cont(0x18, 0x0, 0x0, 0x1) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ptrace$cont(0x7, 0x0, 0x0, 0x10001) openat$full(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x2, 0x80, 0x4, 0x4, 0xe0, 0xb, 0x0, 0x0, 0x8000, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x8004, 0x2, @perf_bp={0x0}, 0x4000, 0x8000, 0xfffffff9, 0x7, 0x80000001, 0x8, 0x0, 0x0, 0xa, 0x0, 0x100000000}, r2, 0x8, 0xffffffffffffffff, 0x6ee4ca8bd5713173) 07:14:23 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\t\x00\x00\x00\x00\x00', 0xfffffffffffffffe) [ 933.334937][ T3773] RSP: 002b:00007fad2bf19188 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 [ 933.343344][ T3773] RAX: ffffffffffffffda RBX: 000000000056bf80 RCX: 00000000004665e9 [ 933.351349][ T3773] RDX: 0000000000000000 RSI: 0000000000000004 RDI: 0000000000000003 [ 933.359324][ T3773] RBP: 00007fad2bf191d0 R08: 0000000000000000 R09: 0000000000000000 [ 933.367346][ T3773] R10: 00000000108d1521 R11: 0000000000000246 R12: 0000000000000001 [ 933.375309][ T3773] R13: 00007ffd3c1748df R14: 00007fad2bf19300 R15: 0000000000022000 07:14:23 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x100, 0x0}) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x28000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_config_ext={0x5, 0x8}, 0x4000, 0x0, 0x9, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000001440)) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r1, 0xd000943e, 0x0) clone(0x40808000, 0x0, 0x0, 0x0, 0x0) r2 = gettid() tkill(r2, 0x1e) r3 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r3, 0x0) ptrace$cont(0x18, 0x0, 0x0, 0x1) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ptrace$cont(0x7, 0x0, 0x0, 0x10001) openat$full(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x2, 0x80, 0x4, 0x4, 0xe0, 0xb, 0x0, 0x0, 0x8000, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x8004, 0x2, @perf_bp={0x0}, 0x4000, 0x8000, 0xfffffff9, 0x7, 0x80000001, 0x8, 0x0, 0x0, 0xa, 0x0, 0x100000000}, r2, 0x8, 0xffffffffffffffff, 0x6ee4ca8bd5713173) 07:14:23 executing program 3: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000, 0x0, 0xf00000000000000}]) 07:14:23 executing program 4: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x12, r0, &(0x7f0000000000), 0x16002}]) [ 933.432582][ T3765] loop1: detected capacity change from 0 to 4 [ 933.443808][ T3765] EXT4-fs (loop1): Quota format mount options ignored when QUOTA feature is enabled [ 933.453261][ T3765] EXT4-fs (loop1): unsupported descriptor size 0 [ 933.530268][ T3837] loop3: detected capacity change from 0 to 16 [ 933.629212][ T3847] loop4: detected capacity change from 0 to 16 07:14:24 executing program 0 (fault-call:10 fault-nth:2): syz_mount_image$vfat(&(0x7f00000002c0), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f736617e43c00088020000200000004f8000020004000000000000000000001", 0x25}, {0x0, 0x0, 0x200000000011000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6900) ftruncate(r0, 0x800) lseek(r0, 0x1200, 0x0) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, r1, 0x0, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @private2}, 0x1c) sendfile(r0, r1, 0x0, 0x108d1521) r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_FEATURES_SET(r2, 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHGPRL(0xffffffffffffffff, 0x89f7, &(0x7f00000001c0)={'ip6tnl0\x00', 0x0}) sendmsg$ETHTOOL_MSG_LINKINFO_GET(0xffffffffffffffff, 0x0, 0x0) sendfile(r0, r1, 0x0, 0x8400fffffffa) close(0xffffffffffffffff) 07:14:24 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\n\x00\x00\x00\x00\x00', 0xfffffffffffffffe) 07:14:24 executing program 1: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000180)='./file1\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="20000000360000001900000060008f000ff68f01000000000000000010000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}], 0x0, &(0x7f0000000140)={[{@jqfmt_vfsv0}]}) 07:14:24 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x100, 0x0}) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x28000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_config_ext={0x5, 0x8}, 0x4000, 0x0, 0x9, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000001440)) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r1, 0xd000943e, 0x0) clone(0x40808000, 0x0, 0x0, 0x0, 0x0) r2 = gettid() tkill(r2, 0x1e) r3 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r3, 0x0) ptrace$cont(0x18, 0x0, 0x0, 0x1) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ptrace$cont(0x7, 0x0, 0x0, 0x10001) openat$full(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x2, 0x80, 0x4, 0x4, 0xe0, 0xb, 0x0, 0x0, 0x8000, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x8004, 0x2, @perf_bp={0x0}, 0x4000, 0x8000, 0xfffffff9, 0x7, 0x80000001, 0x8, 0x0, 0x0, 0xa, 0x0, 0x100000000}, r2, 0x8, 0xffffffffffffffff, 0x6ee4ca8bd5713173) 07:14:24 executing program 3: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000, 0x0, 0x1000000000000000}]) 07:14:24 executing program 4: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x16, r0, &(0x7f0000000000), 0x16002}]) [ 933.980804][ T3864] loop1: detected capacity change from 0 to 4 [ 933.990051][ T3868] loop3: detected capacity change from 0 to 16 [ 933.994322][ T3864] EXT4-fs (loop1): Quota format mount options ignored when QUOTA feature is enabled [ 934.005706][ T3864] EXT4-fs (loop1): unsupported descriptor size 0 [ 934.028981][ T3872] FAULT_INJECTION: forcing a failure. [ 934.028981][ T3872] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 934.042254][ T3872] CPU: 0 PID: 3872 Comm: syz-executor.0 Not tainted 5.14.0-rc4-syzkaller #0 [ 934.050998][ T3872] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 934.061044][ T3872] Call Trace: [ 934.064314][ T3872] dump_stack_lvl+0xb7/0x103 [ 934.068936][ T3872] dump_stack+0x11/0x1a [ 934.070930][ T3879] loop4: detected capacity change from 0 to 16 [ 934.073086][ T3872] should_fail+0x23c/0x250 [ 934.073111][ T3872] __alloc_pages+0x102/0x320 [ 934.088210][ T3872] alloc_pages+0x2e8/0x340 [ 934.092701][ T3872] __page_cache_alloc+0x4d/0xf0 [ 934.097569][ T3872] page_cache_ra_unbounded+0x1ae/0x410 [ 934.103077][ T3872] ondemand_readahead+0x579/0x7b0 [ 934.108117][ T3872] ? filemap_get_read_batch+0x3c2/0x3f0 [ 934.113789][ T3872] page_cache_sync_ra+0xaf/0xe0 [ 934.118619][ T3872] filemap_read+0x388/0x1220 [ 934.123192][ T3872] ? mntput_no_expire+0x64/0x730 [ 934.128120][ T3872] generic_file_read_iter+0x75/0x2c0 [ 934.133426][ T3872] ? terminate_walk+0x263/0x280 [ 934.138302][ T3872] ? __fsnotify_parent+0x32f/0x430 [ 934.143391][ T3872] ext4_file_read_iter+0x1db/0x290 [ 934.148518][ T3872] generic_file_splice_read+0x22a/0x310 [ 934.154072][ T3872] ? splice_shrink_spd+0x60/0x60 [ 934.159003][ T3872] splice_direct_to_actor+0x2aa/0x650 [ 934.164406][ T3872] ? do_splice_direct+0x170/0x170 [ 934.169423][ T3872] do_splice_direct+0xf5/0x170 [ 934.174606][ T3872] do_sendfile+0x773/0xda0 [ 934.179069][ T3872] __x64_sys_sendfile64+0xf2/0x130 [ 934.184276][ T3872] do_syscall_64+0x3d/0x90 [ 934.188672][ T3872] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 934.194569][ T3872] RIP: 0033:0x4665e9 [ 934.198460][ T3872] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 934.218083][ T3872] RSP: 002b:00007fad2bf19188 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 07:14:24 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\v\x00\x00\x00\x00\x00', 0xfffffffffffffffe) [ 934.226478][ T3872] RAX: ffffffffffffffda RBX: 000000000056bf80 RCX: 00000000004665e9 [ 934.234431][ T3872] RDX: 0000000000000000 RSI: 0000000000000004 RDI: 0000000000000003 [ 934.242381][ T3872] RBP: 00007fad2bf191d0 R08: 0000000000000000 R09: 0000000000000000 [ 934.250428][ T3872] R10: 00000000108d1521 R11: 0000000000000246 R12: 0000000000000001 [ 934.258378][ T3872] R13: 00007ffd3c1748df R14: 00007fad2bf19300 R15: 0000000000022000 07:14:24 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\f\x00\x00\x00\x00\x00', 0xfffffffffffffffe) 07:14:24 executing program 3: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000, 0x0, 0x1100000000000000}]) [ 934.307296][ T3864] loop1: detected capacity change from 0 to 4 [ 934.335970][ T3864] EXT4-fs (loop1): Quota format mount options ignored when QUOTA feature is enabled [ 934.345396][ T3864] EXT4-fs (loop1): unsupported descriptor size 0 07:14:24 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\r\x00\x00\x00\x00\x00', 0xfffffffffffffffe) 07:14:24 executing program 1: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000180)='./file1\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="20000000360000001900000060008f000ff68f01000000000000000011000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}], 0x0, &(0x7f0000000140)={[{@jqfmt_vfsv0}]}) 07:14:24 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x100, 0x0}) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x28000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_config_ext={0x5, 0x8}, 0x4000, 0x0, 0x9, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000001440)) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r1, 0xd000943e, 0x0) clone(0x40808000, 0x0, 0x0, 0x0, 0x0) r2 = gettid() tkill(r2, 0x1e) r3 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r3, 0x0) ptrace$cont(0x18, 0x0, 0x0, 0x1) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ptrace$cont(0x7, 0x0, 0x0, 0x10001) openat$full(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x2, 0x80, 0x4, 0x4, 0xe0, 0xb, 0x0, 0x0, 0x8000, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x8004, 0x2, @perf_bp={0x0}, 0x4000, 0x8000, 0xfffffff9, 0x7, 0x80000001, 0x8, 0x0, 0x0, 0xa, 0x0, 0x100000000}, r2, 0x8, 0xffffffffffffffff, 0x6ee4ca8bd5713173) [ 934.449599][ T3911] loop3: detected capacity change from 0 to 16 [ 934.469129][ T3918] loop1: detected capacity change from 0 to 4 [ 934.483378][ T3918] EXT4-fs (loop1): Quota format mount options ignored when QUOTA feature is enabled [ 934.492841][ T3918] EXT4-fs (loop1): unsupported descriptor size 0 [ 934.533410][ T3918] loop1: detected capacity change from 0 to 4 [ 934.543512][ T3918] EXT4-fs (loop1): Quota format mount options ignored when QUOTA feature is enabled [ 934.553223][ T3918] EXT4-fs (loop1): unsupported descriptor size 0 07:14:25 executing program 0: syz_mount_image$vfat(&(0x7f00000002c0), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f736617e43c00088020000200000004f8000020004000000000000000000001", 0x25}, {0x0, 0x0, 0x200000000011000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6900) ftruncate(r0, 0x800) lseek(r0, 0x1200, 0x0) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, r1, 0x0, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @private2}, 0x1c) sendfile(r0, r1, 0x0, 0x108d1521) r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_FEATURES_SET(r2, 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHGPRL(0xffffffffffffffff, 0x89f7, &(0x7f00000001c0)={'ip6tnl0\x00', 0x0}) sendmsg$ETHTOOL_MSG_LINKINFO_GET(0xffffffffffffffff, 0x0, 0x0) sendfile(r0, r1, 0x0, 0x8400fffffffa) close(0xffffffffffffffff) 07:14:25 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x0e\x00\x00\x00\x00\x00', 0xfffffffffffffffe) 07:14:25 executing program 1: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000180)='./file1\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="20000000360000001900000060008f000ff68f01000000000000000012000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}], 0x0, &(0x7f0000000140)={[{@jqfmt_vfsv0}]}) 07:14:25 executing program 4: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x17, r0, &(0x7f0000000000), 0x16002}]) 07:14:25 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x100, 0x0}) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x28000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_config_ext={0x5, 0x8}, 0x4000, 0x0, 0x9, 0x7, 0x80000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000001440)) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r1, 0xd000943e, 0x0) clone(0x40808000, 0x0, 0x0, 0x0, 0x0) r2 = gettid() tkill(r2, 0x1e) r3 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r3, 0x0) ptrace$cont(0x18, 0x0, 0x0, 0x1) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ptrace$cont(0x7, 0x0, 0x0, 0x10001) openat$full(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x2, 0x80, 0x4, 0x4, 0xe0, 0xb, 0x0, 0x0, 0x8000, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x8004, 0x2, @perf_bp={0x0}, 0x4000, 0x8000, 0xfffffff9, 0x7, 0x80000001, 0x8, 0x0, 0x0, 0xa, 0x0, 0x100000000}, r2, 0x8, 0xffffffffffffffff, 0x6ee4ca8bd5713173) 07:14:25 executing program 3: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000, 0x0, 0x1200000000000000}]) 07:14:25 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x0f\x00\x00\x00\x00\x00', 0xfffffffffffffffe) [ 934.883163][ T3952] loop3: detected capacity change from 0 to 16 [ 934.893353][ T3953] loop1: detected capacity change from 0 to 4 07:14:25 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x11\x00\x00\x00\x00\x00', 0xfffffffffffffffe) [ 934.947736][ T3953] EXT4-fs (loop1): Quota format mount options ignored when QUOTA feature is enabled [ 934.950701][ T3970] loop4: detected capacity change from 0 to 16 [ 934.957159][ T3953] EXT4-fs (loop1): unsupported descriptor size 0 07:14:25 executing program 3: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000, 0x0, 0x1300000000000000}]) 07:14:25 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x12\x00\x00\x00\x00\x00', 0xfffffffffffffffe) [ 935.021370][ T3953] loop1: detected capacity change from 0 to 4 [ 935.049984][ T3953] EXT4-fs (loop1): Quota format mount options ignored when QUOTA feature is enabled [ 935.059428][ T3953] EXT4-fs (loop1): unsupported descriptor size 0 07:14:25 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00H\x00\x00\x00\x00\x00', 0xfffffffffffffffe) 07:14:25 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x100, 0x0}) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x28000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_config_ext={0x5, 0x8}, 0x4000, 0x0, 0x9, 0x7, 0x80000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000001440)) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r1, 0xd000943e, 0x0) clone(0x40808000, 0x0, 0x0, 0x0, 0x0) r2 = gettid() tkill(r2, 0x1e) r3 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r3, 0x0) ptrace$cont(0x18, 0x0, 0x0, 0x1) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ptrace$cont(0x7, 0x0, 0x0, 0x10001) openat$full(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x2, 0x80, 0x4, 0x4, 0xe0, 0xb, 0x0, 0x0, 0x8000, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x8004, 0x2, @perf_bp={0x0}, 0x4000, 0x8000, 0xfffffff9, 0x7, 0x80000001, 0x8, 0x0, 0x0, 0xa, 0x0, 0x100000000}, r2, 0x8, 0xffffffffffffffff, 0x6ee4ca8bd5713173) [ 935.093631][ T4000] loop3: detected capacity change from 0 to 16 07:14:25 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00L\x00\x00\x00\x00\x00', 0xfffffffffffffffe) 07:14:25 executing program 1: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000180)='./file1\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="20000000360000001900000060008f000ff68f01000000000000000014000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}], 0x0, &(0x7f0000000140)={[{@jqfmt_vfsv0}]}) 07:14:25 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x100, 0x0}) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x28000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_config_ext={0x5, 0x8}, 0x4000, 0x0, 0x9, 0x7, 0x80000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000001440)) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r1, 0xd000943e, 0x0) clone(0x40808000, 0x0, 0x0, 0x0, 0x0) r2 = gettid() tkill(r2, 0x1e) r3 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r3, 0x0) ptrace$cont(0x18, 0x0, 0x0, 0x1) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ptrace$cont(0x7, 0x0, 0x0, 0x10001) openat$full(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x2, 0x80, 0x4, 0x4, 0xe0, 0xb, 0x0, 0x0, 0x8000, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x8004, 0x2, @perf_bp={0x0}, 0x4000, 0x8000, 0xfffffff9, 0x7, 0x80000001, 0x8, 0x0, 0x0, 0xa, 0x0, 0x100000000}, r2, 0x8, 0xffffffffffffffff, 0x6ee4ca8bd5713173) 07:14:25 executing program 3: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000, 0x0, 0x1400000000000000}]) 07:14:25 executing program 4: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x300, r0, &(0x7f0000000000), 0x16002}]) 07:14:25 executing program 0: syz_mount_image$vfat(&(0x7f00000002c0), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f736617e43c00088020000200000004f8000020004000000000000000000001", 0x25}, {0x0, 0x0, 0x200000000011000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6900) ftruncate(r0, 0x800) lseek(r0, 0x1200, 0x0) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, r1, 0x0, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @private2}, 0x1c) sendfile(r0, r1, 0x0, 0x108d1502) r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_FEATURES_SET(r2, 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHGPRL(0xffffffffffffffff, 0x89f7, &(0x7f00000001c0)={'ip6tnl0\x00', 0x0}) sendmsg$ETHTOOL_MSG_LINKINFO_GET(0xffffffffffffffff, 0x0, 0x0) sendfile(r0, r1, 0x0, 0x8400fffffffa) close(0xffffffffffffffff) [ 935.780139][ T4035] loop1: detected capacity change from 0 to 4 [ 935.781635][ T4034] loop3: detected capacity change from 0 to 16 [ 935.801677][ T4035] EXT4-fs (loop1): Quota format mount options ignored when QUOTA feature is enabled [ 935.811087][ T4035] EXT4-fs (loop1): unsupported descriptor size 0 07:14:26 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00h\x00\x00\x00\x00\x00', 0xfffffffffffffffe) 07:14:26 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x100, 0x0}) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x28000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_config_ext={0x5, 0x8}, 0x4000, 0x0, 0x9, 0x7, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0x0, 0xffffffffffffffff, 0xa) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000001440)) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r1, 0xd000943e, 0x0) clone(0x40808000, 0x0, 0x0, 0x0, 0x0) r2 = gettid() tkill(r2, 0x1e) r3 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r3, 0x0) ptrace$cont(0x18, 0x0, 0x0, 0x1) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ptrace$cont(0x7, 0x0, 0x0, 0x10001) openat$full(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x2, 0x80, 0x4, 0x4, 0xe0, 0xb, 0x0, 0x0, 0x8000, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x8004, 0x2, @perf_bp={0x0}, 0x4000, 0x8000, 0xfffffff9, 0x7, 0x80000001, 0x8, 0x0, 0x0, 0xa, 0x0, 0x100000000}, r2, 0x8, 0xffffffffffffffff, 0x6ee4ca8bd5713173) 07:14:26 executing program 3: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000, 0x0, 0x1500000000000000}]) 07:14:26 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x100, 0x0}) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x28000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_config_ext={0x5, 0x8}, 0x4000, 0x0, 0x9, 0x7, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0x0, 0xffffffffffffffff, 0xa) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000001440)) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r1, 0xd000943e, 0x0) clone(0x40808000, 0x0, 0x0, 0x0, 0x0) r2 = gettid() tkill(r2, 0x1e) r3 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r3, 0x0) ptrace$cont(0x18, 0x0, 0x0, 0x1) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ptrace$cont(0x7, 0x0, 0x0, 0x10001) openat$full(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x2, 0x80, 0x4, 0x4, 0xe0, 0xb, 0x0, 0x0, 0x8000, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x8004, 0x2, @perf_bp={0x0}, 0x4000, 0x8000, 0xfffffff9, 0x7, 0x80000001, 0x8, 0x0, 0x0, 0xa, 0x0, 0x100000000}, r2, 0x8, 0xffffffffffffffff, 0x6ee4ca8bd5713173) 07:14:26 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00l\x00\x00\x00\x00\x00', 0xfffffffffffffffe) 07:14:26 executing program 1: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000180)='./file1\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="20000000360000001900000060008f000ff68f01000000000000000028000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}], 0x0, &(0x7f0000000140)={[{@jqfmt_vfsv0}]}) [ 935.901415][ T4035] loop1: detected capacity change from 0 to 4 [ 935.921435][ T4035] EXT4-fs (loop1): Quota format mount options ignored when QUOTA feature is enabled [ 935.930849][ T4035] EXT4-fs (loop1): unsupported descriptor size 0 [ 935.998515][ T4085] loop3: detected capacity change from 0 to 16 07:14:26 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00t\x00\x00\x00\x00\x00', 0xfffffffffffffffe) 07:14:26 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x100, 0x0}) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x28000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_config_ext={0x5, 0x8}, 0x4000, 0x0, 0x9, 0x7, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0x0, 0xffffffffffffffff, 0xa) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000001440)) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r1, 0xd000943e, 0x0) clone(0x40808000, 0x0, 0x0, 0x0, 0x0) r2 = gettid() tkill(r2, 0x1e) r3 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r3, 0x0) ptrace$cont(0x18, 0x0, 0x0, 0x1) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ptrace$cont(0x7, 0x0, 0x0, 0x10001) openat$full(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x2, 0x80, 0x4, 0x4, 0xe0, 0xb, 0x0, 0x0, 0x8000, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x8004, 0x2, @perf_bp={0x0}, 0x4000, 0x8000, 0xfffffff9, 0x7, 0x80000001, 0x8, 0x0, 0x0, 0xa, 0x0, 0x100000000}, r2, 0x8, 0xffffffffffffffff, 0x6ee4ca8bd5713173) 07:14:26 executing program 3: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000, 0x0, 0x1600000000000000}]) 07:14:26 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00z\x00\x00\x00\x00\x00', 0xfffffffffffffffe) [ 936.048656][ T4099] loop4: detected capacity change from 0 to 16 [ 936.051221][ T4090] loop1: detected capacity change from 0 to 4 [ 936.083986][ T4090] EXT4-fs (loop1): Invalid log cluster size: 40 [ 936.131416][ T4090] loop1: detected capacity change from 0 to 4 [ 936.147403][ T4116] loop3: detected capacity change from 0 to 16 [ 936.147420][ T4090] EXT4-fs (loop1): Invalid log cluster size: 40 07:14:26 executing program 4: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x408, r0, &(0x7f0000000000), 0x16002}]) [ 936.350675][ T4140] loop4: detected capacity change from 0 to 16 07:14:26 executing program 0: syz_mount_image$vfat(&(0x7f00000002c0), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f736617e43c00088020000200000004f8000020004000000000000000000001", 0x25}, {0x0, 0x0, 0x200000000011000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6900) ftruncate(r0, 0x800) lseek(r0, 0x1200, 0x0) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, r1, 0x0, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @private2}, 0x1c) sendfile(r0, r1, 0x0, 0x108d1510) r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_FEATURES_SET(r2, 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHGPRL(0xffffffffffffffff, 0x89f7, &(0x7f00000001c0)={'ip6tnl0\x00', 0x0}) sendmsg$ETHTOOL_MSG_LINKINFO_GET(0xffffffffffffffff, 0x0, 0x0) sendfile(r0, r1, 0x0, 0x8400fffffffa) close(0xffffffffffffffff) 07:14:26 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\xff\xff\xfe\x00\x00\x00\x00', 0xfffffffffffffffe) 07:14:26 executing program 1: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000180)='./file1\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="20000000360000001900000060008f000ff68f0100000000000000002e000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}], 0x0, &(0x7f0000000140)={[{@jqfmt_vfsv0}]}) 07:14:26 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x100, 0x0}) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x28000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_config_ext={0x5, 0x8}, 0x4000, 0x0, 0x9, 0x7, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000001440)) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r1, 0xd000943e, 0x0) clone(0x40808000, 0x0, 0x0, 0x0, 0x0) r2 = gettid() tkill(r2, 0x1e) r3 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r3, 0x0) ptrace$cont(0x18, 0x0, 0x0, 0x1) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ptrace$cont(0x7, 0x0, 0x0, 0x10001) openat$full(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x2, 0x80, 0x4, 0x4, 0xe0, 0xb, 0x0, 0x0, 0x8000, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x8004, 0x2, @perf_bp={0x0}, 0x4000, 0x8000, 0xfffffff9, 0x7, 0x80000001, 0x8, 0x0, 0x0, 0xa, 0x0, 0x100000000}, r2, 0x8, 0xffffffffffffffff, 0x6ee4ca8bd5713173) 07:14:26 executing program 3: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000, 0x0, 0x1700000000000000}]) 07:14:26 executing program 4: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x500, r0, &(0x7f0000000000), 0x16002}]) [ 936.778799][ T4155] loop1: detected capacity change from 0 to 4 [ 936.789621][ C1] scsi_io_completion_action: 10 callbacks suppressed [ 936.789658][ C1] sd 0:0:1:0: [sg0] tag#5666 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 936.792780][ T4163] loop3: detected capacity change from 0 to 16 [ 936.796396][ C1] sd 0:0:1:0: [sg0] tag#5666 CDB: opcode=0xe5 (vendor) 07:14:27 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x01\x00\x00\x00', 0xfffffffffffffffe) 07:14:27 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x02\x00\x00\x00', 0xfffffffffffffffe) [ 936.819758][ C1] sd 0:0:1:0: [sg0] tag#5666 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 936.829327][ C1] sd 0:0:1:0: [sg0] tag#5666 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 936.839024][ C1] sd 0:0:1:0: [sg0] tag#5666 CDB[20]: ba 07:14:27 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x100, 0x0}) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x28000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_config_ext={0x5, 0x8}, 0x4000, 0x0, 0x9, 0x7, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000001440)) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r1, 0xd000943e, 0x0) clone(0x40808000, 0x0, 0x0, 0x0, 0x0) r2 = gettid() tkill(r2, 0x1e) r3 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r3, 0x0) ptrace$cont(0x18, 0x0, 0x0, 0x1) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ptrace$cont(0x7, 0x0, 0x0, 0x10001) openat$full(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x2, 0x80, 0x4, 0x4, 0xe0, 0xb, 0x0, 0x0, 0x8000, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x8004, 0x2, @perf_bp={0x0}, 0x4000, 0x8000, 0xfffffff9, 0x7, 0x80000001, 0x8, 0x0, 0x0, 0xa, 0x0, 0x100000000}, r2, 0x8, 0xffffffffffffffff, 0x6ee4ca8bd5713173) 07:14:27 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x03\x00\x00\x00', 0xfffffffffffffffe) 07:14:27 executing program 3: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000, 0x0, 0x1800000000000000}]) [ 936.920918][ T4155] EXT4-fs (loop1): Invalid log cluster size: 46 [ 936.944059][ T4190] loop4: detected capacity change from 0 to 16 [ 936.962141][ T4155] loop1: detected capacity change from 0 to 4 [ 936.976869][ T4155] EXT4-fs (loop1): Invalid log cluster size: 46 [ 936.985315][ C0] sd 0:0:1:0: [sg0] tag#5659 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 936.995809][ C0] sd 0:0:1:0: [sg0] tag#5659 CDB: opcode=0xe5 (vendor) [ 937.002693][ C0] sd 0:0:1:0: [sg0] tag#5659 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 937.012263][ C0] sd 0:0:1:0: [sg0] tag#5659 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 937.021804][ C0] sd 0:0:1:0: [sg0] tag#5659 CDB[20]: ba 07:14:27 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x04\x00\x00\x00', 0xfffffffffffffffe) [ 937.068893][ T4214] loop3: detected capacity change from 0 to 16 07:14:27 executing program 0: syz_mount_image$vfat(&(0x7f00000002c0), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f736617e43c00088020000200000004f8000020004000000000000000000001", 0x25}, {0x0, 0x0, 0x200000000011000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6900) ftruncate(r0, 0x800) lseek(r0, 0x1200, 0x0) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, r1, 0x0, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @private2}, 0x1c) sendfile(r0, r1, 0x0, 0x108d1511) r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_FEATURES_SET(r2, 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHGPRL(0xffffffffffffffff, 0x89f7, &(0x7f00000001c0)={'ip6tnl0\x00', 0x0}) sendmsg$ETHTOOL_MSG_LINKINFO_GET(0xffffffffffffffff, 0x0, 0x0) sendfile(r0, r1, 0x0, 0x8400fffffffa) close(0xffffffffffffffff) 07:14:27 executing program 1: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000180)='./file1\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="20000000360000001900000060008f000ff68f0100000000000000003f000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}], 0x0, &(0x7f0000000140)={[{@jqfmt_vfsv0}]}) 07:14:27 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x05\x00\x00\x00', 0xfffffffffffffffe) 07:14:27 executing program 3: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000, 0x0, 0x1900000000000000}]) 07:14:27 executing program 4: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x600, r0, &(0x7f0000000000), 0x16002}]) 07:14:27 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x100, 0x0}) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x28000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_config_ext={0x5, 0x8}, 0x4000, 0x0, 0x9, 0x7, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000001440)) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r1, 0xd000943e, 0x0) clone(0x40808000, 0x0, 0x0, 0x0, 0x0) r2 = gettid() tkill(r2, 0x1e) r3 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r3, 0x0) ptrace$cont(0x18, 0x0, 0x0, 0x1) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ptrace$cont(0x7, 0x0, 0x0, 0x10001) openat$full(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x2, 0x80, 0x4, 0x4, 0xe0, 0xb, 0x0, 0x0, 0x8000, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x8004, 0x2, @perf_bp={0x0}, 0x4000, 0x8000, 0xfffffff9, 0x7, 0x80000001, 0x8, 0x0, 0x0, 0xa, 0x0, 0x100000000}, r2, 0x8, 0xffffffffffffffff, 0x6ee4ca8bd5713173) 07:14:27 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x06\x00\x00\x00', 0xfffffffffffffffe) [ 937.752035][ C1] sd 0:0:1:0: [sg0] tag#5695 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 937.762398][ C1] sd 0:0:1:0: [sg0] tag#5695 CDB: opcode=0xe5 (vendor) [ 937.769252][ C1] sd 0:0:1:0: [sg0] tag#5695 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 937.778821][ C1] sd 0:0:1:0: [sg0] tag#5695 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 937.788641][ C1] sd 0:0:1:0: [sg0] tag#5695 CDB[20]: ba [ 937.795436][ T4242] loop3: detected capacity change from 0 to 16 [ 937.802095][ T4244] loop1: detected capacity change from 0 to 4 [ 937.828018][ T4244] EXT4-fs (loop1): Invalid log cluster size: 63 07:14:28 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\a\x00\x00\x00', 0xfffffffffffffffe) 07:14:28 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\b\x00\x00\x00', 0xfffffffffffffffe) 07:14:28 executing program 3: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000, 0x0, 0x1a00000000000000}]) [ 937.870757][ T4263] loop4: detected capacity change from 0 to 16 [ 937.886690][ T4244] loop1: detected capacity change from 0 to 4 [ 937.905619][ T4244] EXT4-fs (loop1): Invalid log cluster size: 63 07:14:28 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\t\x00\x00\x00', 0xfffffffffffffffe) 07:14:28 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x100, 0x0}) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x28000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_config_ext={0x5, 0x8}, 0x4000, 0x0, 0x9, 0x7, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) r1 = openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000001440)) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r1, 0xd000943e, 0x0) clone(0x40808000, 0x0, 0x0, 0x0, 0x0) r2 = gettid() tkill(r2, 0x1e) r3 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r3, 0x0) ptrace$cont(0x18, 0x0, 0x0, 0x1) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ptrace$cont(0x7, 0x0, 0x0, 0x10001) openat$full(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x2, 0x80, 0x4, 0x4, 0xe0, 0xb, 0x0, 0x0, 0x8000, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x8004, 0x2, @perf_bp={0x0}, 0x4000, 0x8000, 0xfffffff9, 0x7, 0x80000001, 0x8, 0x0, 0x0, 0xa, 0x0, 0x100000000}, r2, 0x8, 0xffffffffffffffff, 0x6ee4ca8bd5713173) [ 938.018273][ T4287] loop3: detected capacity change from 0 to 16 [ 938.066973][ C0] sd 0:0:1:0: [sg0] tag#5661 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 938.077349][ C0] sd 0:0:1:0: [sg0] tag#5661 CDB: opcode=0xe5 (vendor) [ 938.084304][ C0] sd 0:0:1:0: [sg0] tag#5661 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 938.093889][ C0] sd 0:0:1:0: [sg0] tag#5661 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 938.103447][ C0] sd 0:0:1:0: [sg0] tag#5661 CDB[20]: ba 07:14:28 executing program 0: syz_mount_image$vfat(&(0x7f00000002c0), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f736617e43c00088020000200000004f8000020004000000000000000000001", 0x25}, {0x0, 0x0, 0x200000000011000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6900) ftruncate(r0, 0x800) lseek(r0, 0x1200, 0x0) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, r1, 0x0, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @private2}, 0x1c) sendfile(r0, r1, 0x0, 0x108d1522) r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_FEATURES_SET(r2, 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHGPRL(0xffffffffffffffff, 0x89f7, &(0x7f00000001c0)={'ip6tnl0\x00', 0x0}) sendmsg$ETHTOOL_MSG_LINKINFO_GET(0xffffffffffffffff, 0x0, 0x0) sendfile(r0, r1, 0x0, 0x8400fffffffa) close(0xffffffffffffffff) 07:14:28 executing program 1: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000180)='./file1\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="20000000360000001900000060008f000ff68f01000000777ef65b01df000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}], 0x0, &(0x7f0000000140)={[{@jqfmt_vfsv0}]}) 07:14:28 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\n\x00\x00\x00', 0xfffffffffffffffe) 07:14:28 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x100, 0x0}) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x28000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_config_ext={0x5, 0x8}, 0x4000, 0x0, 0x9, 0x7, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) r1 = openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000001440)) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r1, 0xd000943e, 0x0) clone(0x40808000, 0x0, 0x0, 0x0, 0x0) r2 = gettid() tkill(r2, 0x1e) r3 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r3, 0x0) ptrace$cont(0x18, 0x0, 0x0, 0x1) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ptrace$cont(0x7, 0x0, 0x0, 0x10001) openat$full(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x2, 0x80, 0x4, 0x4, 0xe0, 0xb, 0x0, 0x0, 0x8000, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x8004, 0x2, @perf_bp={0x0}, 0x4000, 0x8000, 0xfffffff9, 0x7, 0x80000001, 0x8, 0x0, 0x0, 0xa, 0x0, 0x100000000}, r2, 0x8, 0xffffffffffffffff, 0x6ee4ca8bd5713173) 07:14:28 executing program 3: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000, 0x0, 0x1b00000000000000}]) 07:14:28 executing program 4: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x804, r0, &(0x7f0000000000), 0x16002}]) [ 938.700225][ T4314] loop1: detected capacity change from 0 to 4 [ 938.713308][ T4314] EXT4-fs (loop1): Invalid log block size: 22804094 [ 938.720226][ T4319] loop3: detected capacity change from 0 to 16 [ 938.728809][ C1] sd 0:0:1:0: [sg0] tag#5683 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 938.739192][ C1] sd 0:0:1:0: [sg0] tag#5683 CDB: opcode=0xe5 (vendor) 07:14:28 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\v\x00\x00\x00', 0xfffffffffffffffe) [ 938.746152][ C1] sd 0:0:1:0: [sg0] tag#5683 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 938.755813][ C1] sd 0:0:1:0: [sg0] tag#5683 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 938.765477][ C1] sd 0:0:1:0: [sg0] tag#5683 CDB[20]: ba 07:14:29 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\f\x00\x00\x00', 0xfffffffffffffffe) 07:14:29 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x100, 0x0}) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x28000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_config_ext={0x5, 0x8}, 0x4000, 0x0, 0x9, 0x7, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) r1 = openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000001440)) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r1, 0xd000943e, 0x0) clone(0x40808000, 0x0, 0x0, 0x0, 0x0) r2 = gettid() tkill(r2, 0x1e) r3 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r3, 0x0) ptrace$cont(0x18, 0x0, 0x0, 0x1) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ptrace$cont(0x7, 0x0, 0x0, 0x10001) openat$full(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x2, 0x80, 0x4, 0x4, 0xe0, 0xb, 0x0, 0x0, 0x8000, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x8004, 0x2, @perf_bp={0x0}, 0x4000, 0x8000, 0xfffffff9, 0x7, 0x80000001, 0x8, 0x0, 0x0, 0xa, 0x0, 0x100000000}, r2, 0x8, 0xffffffffffffffff, 0x6ee4ca8bd5713173) [ 938.815922][ T4337] loop4: detected capacity change from 0 to 16 07:14:29 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\r\x00\x00\x00', 0xfffffffffffffffe) [ 938.858173][ T4314] loop1: detected capacity change from 0 to 4 [ 938.880152][ T4314] EXT4-fs (loop1): Invalid log block size: 22804094 [ 938.894385][ C1] sd 0:0:1:0: [sg0] tag#5681 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s 07:14:29 executing program 3: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000, 0x0, 0x1c00000000000000}]) 07:14:29 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x0e\x00\x00\x00', 0xfffffffffffffffe) [ 938.904753][ C1] sd 0:0:1:0: [sg0] tag#5681 CDB: opcode=0xe5 (vendor) [ 938.911605][ C1] sd 0:0:1:0: [sg0] tag#5681 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 938.921154][ C1] sd 0:0:1:0: [sg0] tag#5681 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 938.930712][ C1] sd 0:0:1:0: [sg0] tag#5681 CDB[20]: ba [ 939.031957][ T4378] loop3: detected capacity change from 0 to 16 07:14:29 executing program 0: syz_mount_image$vfat(&(0x7f00000002c0), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f736617e43c00088020000200000004f8000020004000000000000000000001", 0x25}, {0x0, 0x0, 0x200000000011000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6900) ftruncate(r0, 0x800) lseek(r0, 0x1200, 0x0) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, r1, 0x0, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @private2}, 0x1c) sendfile(r0, r1, 0x0, 0x108d1523) r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_FEATURES_SET(r2, 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHGPRL(0xffffffffffffffff, 0x89f7, &(0x7f00000001c0)={'ip6tnl0\x00', 0x0}) sendmsg$ETHTOOL_MSG_LINKINFO_GET(0xffffffffffffffff, 0x0, 0x0) sendfile(r0, r1, 0x0, 0x8400fffffffa) close(0xffffffffffffffff) 07:14:29 executing program 1: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000180)='./file1\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="20000000360000001900000060008f000ff68f010000000000ffffffff000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}], 0x0, &(0x7f0000000140)={[{@jqfmt_vfsv0}]}) 07:14:29 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x100, 0x0}) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x28000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_config_ext={0x5, 0x8}, 0x4000, 0x0, 0x9, 0x7, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, 0x0) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r1, 0xd000943e, 0x0) clone(0x40808000, 0x0, 0x0, 0x0, 0x0) r2 = gettid() tkill(r2, 0x1e) r3 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r3, 0x0) ptrace$cont(0x18, 0x0, 0x0, 0x1) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ptrace$cont(0x7, 0x0, 0x0, 0x10001) openat$full(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x2, 0x80, 0x4, 0x4, 0xe0, 0xb, 0x0, 0x0, 0x8000, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x8004, 0x2, @perf_bp={0x0}, 0x4000, 0x8000, 0xfffffff9, 0x7, 0x80000001, 0x8, 0x0, 0x0, 0xa, 0x0, 0x100000000}, r2, 0x8, 0xffffffffffffffff, 0x6ee4ca8bd5713173) 07:14:29 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x0f\x00\x00\x00', 0xfffffffffffffffe) 07:14:29 executing program 4: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x900, r0, &(0x7f0000000000), 0x16002}]) 07:14:29 executing program 3: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000, 0x0, 0x1d00000000000000}]) [ 939.754164][ T4398] loop1: detected capacity change from 0 to 4 [ 939.754355][ C1] sd 0:0:1:0: [sg0] tag#5673 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 939.766973][ T4398] EXT4-fs (loop1): Invalid log block size: 4294967040 [ 939.770683][ C1] sd 0:0:1:0: [sg0] tag#5673 CDB: opcode=0xe5 (vendor) [ 939.784537][ C1] sd 0:0:1:0: [sg0] tag#5673 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 939.788940][ T4403] loop4: detected capacity change from 0 to 16 07:14:30 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x10\x00\x00\x00', 0xfffffffffffffffe) 07:14:30 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x11\x00\x00\x00', 0xfffffffffffffffe) [ 939.794104][ C1] sd 0:0:1:0: [sg0] tag#5673 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 939.809805][ C1] sd 0:0:1:0: [sg0] tag#5673 CDB[20]: ba [ 939.834814][ T4411] loop3: detected capacity change from 0 to 16 07:14:30 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x100, 0x0}) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x28000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_config_ext={0x5, 0x8}, 0x4000, 0x0, 0x9, 0x7, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, 0x0) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r1, 0xd000943e, 0x0) clone(0x40808000, 0x0, 0x0, 0x0, 0x0) r2 = gettid() tkill(r2, 0x1e) r3 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r3, 0x0) ptrace$cont(0x18, 0x0, 0x0, 0x1) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ptrace$cont(0x7, 0x0, 0x0, 0x10001) openat$full(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x2, 0x80, 0x4, 0x4, 0xe0, 0xb, 0x0, 0x0, 0x8000, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x8004, 0x2, @perf_bp={0x0}, 0x4000, 0x8000, 0xfffffff9, 0x7, 0x80000001, 0x8, 0x0, 0x0, 0xa, 0x0, 0x100000000}, r2, 0x8, 0xffffffffffffffff, 0x6ee4ca8bd5713173) 07:14:30 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x12\x00\x00\x00', 0xfffffffffffffffe) [ 939.936712][ T4398] loop1: detected capacity change from 0 to 4 [ 939.953010][ T4398] EXT4-fs (loop1): Invalid log block size: 4294967040 [ 939.959033][ C1] sd 0:0:1:0: [sg0] tag#5633 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 939.970132][ C1] sd 0:0:1:0: [sg0] tag#5633 CDB: opcode=0xe5 (vendor) [ 939.977001][ C1] sd 0:0:1:0: [sg0] tag#5633 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c 07:14:30 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00H\x00\x00\x00', 0xfffffffffffffffe) 07:14:30 executing program 3: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000, 0x0, 0x1e00000000000000}]) [ 939.986550][ C1] sd 0:0:1:0: [sg0] tag#5633 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 939.996116][ C1] sd 0:0:1:0: [sg0] tag#5633 CDB[20]: ba [ 940.088060][ T4461] loop3: detected capacity change from 0 to 16 07:14:30 executing program 1: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000180)='./file1\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="20000000360000001900000060008f000ff68f01000000000000000001000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}], 0x0, &(0x7f0000000140)={[{@jqfmt_vfsv0}]}) 07:14:30 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00L\x00\x00\x00', 0xfffffffffffffffe) 07:14:30 executing program 4: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0xc00, r0, &(0x7f0000000000), 0x16002}]) 07:14:30 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x100, 0x0}) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x28000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_config_ext={0x5, 0x8}, 0x4000, 0x0, 0x9, 0x7, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, 0x0) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r1, 0xd000943e, 0x0) clone(0x40808000, 0x0, 0x0, 0x0, 0x0) r2 = gettid() tkill(r2, 0x1e) r3 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r3, 0x0) ptrace$cont(0x18, 0x0, 0x0, 0x1) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ptrace$cont(0x7, 0x0, 0x0, 0x10001) openat$full(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x2, 0x80, 0x4, 0x4, 0xe0, 0xb, 0x0, 0x0, 0x8000, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x8004, 0x2, @perf_bp={0x0}, 0x4000, 0x8000, 0xfffffff9, 0x7, 0x80000001, 0x8, 0x0, 0x0, 0xa, 0x0, 0x100000000}, r2, 0x8, 0xffffffffffffffff, 0x6ee4ca8bd5713173) 07:14:30 executing program 0: syz_mount_image$vfat(&(0x7f00000002c0), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f736617e43c00088020000200000004f8000020004000000000000000000001", 0x25}, {0x0, 0x0, 0x200000000011000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6900) ftruncate(r0, 0x800) lseek(r0, 0x1200, 0x0) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, r1, 0x0, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @private2}, 0x1c) sendfile(r0, r1, 0x0, 0x108d1524) r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_FEATURES_SET(r2, 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHGPRL(0xffffffffffffffff, 0x89f7, &(0x7f00000001c0)={'ip6tnl0\x00', 0x0}) sendmsg$ETHTOOL_MSG_LINKINFO_GET(0xffffffffffffffff, 0x0, 0x0) sendfile(r0, r1, 0x0, 0x8400fffffffa) close(0xffffffffffffffff) 07:14:30 executing program 3: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000, 0x0, 0x1f00000000000000}]) [ 940.715404][ T4486] loop1: detected capacity change from 0 to 4 [ 940.716622][ T4483] loop3: detected capacity change from 0 to 16 [ 940.724920][ T4486] EXT4-fs (loop1): Quota format mount options ignored when QUOTA feature is enabled [ 940.729362][ C0] sd 0:0:1:0: [sg0] tag#5695 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 940.737146][ T4486] EXT4-fs (loop1): unsupported descriptor size 0 [ 940.753826][ C0] sd 0:0:1:0: [sg0] tag#5695 CDB: opcode=0xe5 (vendor) 07:14:30 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00h\x00\x00\x00', 0xfffffffffffffffe) [ 940.755333][ T4492] loop4: detected capacity change from 0 to 16 [ 940.760668][ C0] sd 0:0:1:0: [sg0] tag#5695 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 940.760685][ C0] sd 0:0:1:0: [sg0] tag#5695 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 940.760723][ C0] sd 0:0:1:0: [sg0] tag#5695 CDB[20]: ba 07:14:31 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00l\x00\x00\x00', 0xfffffffffffffffe) 07:14:31 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x100, 0x0}) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x28000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_config_ext={0x5, 0x8}, 0x4000, 0x0, 0x9, 0x7, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000001440)) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) clone(0x40808000, 0x0, 0x0, 0x0, 0x0) r1 = gettid() tkill(r1, 0x1e) r2 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r2, 0x0) ptrace$cont(0x18, 0x0, 0x0, 0x1) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ptrace$cont(0x7, 0x0, 0x0, 0x10001) openat$full(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x2, 0x80, 0x4, 0x4, 0xe0, 0xb, 0x0, 0x0, 0x8000, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x8004, 0x2, @perf_bp={0x0}, 0x4000, 0x8000, 0xfffffff9, 0x7, 0x80000001, 0x8, 0x0, 0x0, 0xa, 0x0, 0x100000000}, r1, 0x8, 0xffffffffffffffff, 0x6ee4ca8bd5713173) 07:14:31 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00t\x00\x00\x00', 0xfffffffffffffffe) 07:14:31 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00z\x00\x00\x00', 0xfffffffffffffffe) [ 940.896999][ T4486] loop1: detected capacity change from 0 to 4 [ 940.903945][ C1] sd 0:0:1:0: [sg0] tag#5692 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 940.914329][ C1] sd 0:0:1:0: [sg0] tag#5692 CDB: opcode=0xe5 (vendor) [ 940.921173][ C1] sd 0:0:1:0: [sg0] tag#5692 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 940.930731][ C1] sd 0:0:1:0: [sg0] tag#5692 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 940.940295][ C1] sd 0:0:1:0: [sg0] tag#5692 CDB[20]: ba 07:14:31 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\xff\xff\xff\xfe\x00\x00\x00', 0xfffffffffffffffe) [ 940.943656][ T4486] EXT4-fs (loop1): Quota format mount options ignored when QUOTA feature is enabled [ 940.955305][ T4486] EXT4-fs (loop1): unsupported descriptor size 0 07:14:31 executing program 1: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000180)='./file1\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="20000000360000001900000060008f000ff68f01000000000000000002000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}], 0x0, &(0x7f0000000140)={[{@jqfmt_vfsv0}]}) 07:14:31 executing program 3: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000, 0x0, 0x2200000000000000}]) [ 941.064642][ T4554] loop3: detected capacity change from 0 to 16 [ 941.084701][ T4556] loop1: detected capacity change from 0 to 4 07:14:31 executing program 4: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x1200, r0, &(0x7f0000000000), 0x16002}]) 07:14:31 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\xfe\xff\xff\x00\x00\x00', 0xfffffffffffffffe) [ 941.115785][ T4556] EXT4-fs (loop1): Quota format mount options ignored when QUOTA feature is enabled [ 941.125218][ T4556] EXT4-fs (loop1): unsupported descriptor size 0 [ 941.206944][ T4556] loop1: detected capacity change from 0 to 4 [ 941.216677][ T4574] loop4: detected capacity change from 0 to 16 [ 941.223290][ T4556] EXT4-fs (loop1): Quota format mount options ignored when QUOTA feature is enabled [ 941.232687][ T4556] EXT4-fs (loop1): unsupported descriptor size 0 07:14:31 executing program 0: syz_mount_image$vfat(&(0x7f00000002c0), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f736617e43c00088020000200000004f8000020004000000000000000000001", 0x25}, {0x0, 0x0, 0x200000000011000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6900) ftruncate(r0, 0x800) lseek(r0, 0x1200, 0x0) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, r1, 0x0, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @private2}, 0x1c) sendfile(r0, r1, 0x0, 0x7ffff000) r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_FEATURES_SET(r2, 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHGPRL(0xffffffffffffffff, 0x89f7, &(0x7f00000001c0)={'ip6tnl0\x00', 0x0}) sendmsg$ETHTOOL_MSG_LINKINFO_GET(0xffffffffffffffff, 0x0, 0x0) sendfile(r0, r1, 0x0, 0x8400fffffffa) close(0xffffffffffffffff) 07:14:31 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\xfe\xff\xff\xff\x00\x00\x00', 0xfffffffffffffffe) 07:14:31 executing program 3: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000, 0x0, 0x3f00000000000000}]) 07:14:31 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x100, 0x0}) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x28000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_config_ext={0x5, 0x8}, 0x4000, 0x0, 0x9, 0x7, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000001440)) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) clone(0x40808000, 0x0, 0x0, 0x0, 0x0) r1 = gettid() tkill(r1, 0x1e) r2 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r2, 0x0) ptrace$cont(0x18, 0x0, 0x0, 0x1) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ptrace$cont(0x7, 0x0, 0x0, 0x10001) openat$full(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x2, 0x80, 0x4, 0x4, 0xe0, 0xb, 0x0, 0x0, 0x8000, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x8004, 0x2, @perf_bp={0x0}, 0x4000, 0x8000, 0xfffffff9, 0x7, 0x80000001, 0x8, 0x0, 0x0, 0xa, 0x0, 0x100000000}, r1, 0x8, 0xffffffffffffffff, 0x6ee4ca8bd5713173) 07:14:31 executing program 1: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000180)='./file1\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="20000000360000001900000060008f000ff68f01000002000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}], 0x0, &(0x7f0000000140)={[{@jqfmt_vfsv0}]}) 07:14:31 executing program 4: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x1600, r0, &(0x7f0000000000), 0x16002}]) 07:14:31 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x9f\x94p\x9f~w\x00', 0xfffffffffffffffe) [ 941.768899][ T4602] loop3: detected capacity change from 0 to 16 [ 941.771199][ T4603] loop1: detected capacity change from 0 to 4 [ 941.800809][ T4603] EXT4-fs (loop1): Quota format mount options ignored when QUOTA feature is enabled [ 941.810303][ T4603] EXT4-fs (loop1): unsupported descriptor size 0 07:14:32 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\xff\xff\xfe', 0xfffffffffffffffe) 07:14:32 executing program 3: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000, 0x0, 0x4000000000000000}]) 07:14:32 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\x00\x00\x00', 0xfffffffffffffffe) [ 941.883387][ T4632] loop4: detected capacity change from 0 to 16 [ 941.897396][ T4603] loop1: detected capacity change from 0 to 4 [ 941.924432][ T4603] EXT4-fs (loop1): Quota format mount options ignored when QUOTA feature is enabled [ 941.933887][ T4603] EXT4-fs (loop1): unsupported descriptor size 0 07:14:32 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\x00\x00\x00', 0xfffffffffffffffe) 07:14:32 executing program 1: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000180)='./file1\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="20000000360000001900000060008f000ff68f01000003000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}], 0x0, &(0x7f0000000140)={[{@jqfmt_vfsv0}]}) [ 941.994094][ T4648] loop3: detected capacity change from 0 to 16 [ 942.039722][ T4659] loop1: detected capacity change from 0 to 4 [ 942.049685][ T4659] EXT4-fs (loop1): Quota format mount options ignored when QUOTA feature is enabled [ 942.059198][ T4659] EXT4-fs (loop1): unsupported descriptor size 0 07:14:32 executing program 0: syz_mount_image$vfat(&(0x7f00000002c0), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f736617e43c00088020000200000004f8000020004000000000000000000001", 0x25}, {0x0, 0x0, 0x200000000011000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6900) ftruncate(r0, 0x800) lseek(r0, 0x1200, 0x0) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, r1, 0x0, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @private2}, 0x1c) sendfile(r0, r1, 0x0, 0xffffffff000) r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_FEATURES_SET(r2, 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHGPRL(0xffffffffffffffff, 0x89f7, &(0x7f00000001c0)={'ip6tnl0\x00', 0x0}) sendmsg$ETHTOOL_MSG_LINKINFO_GET(0xffffffffffffffff, 0x0, 0x0) sendfile(r0, r1, 0x0, 0x8400fffffffa) close(0xffffffffffffffff) 07:14:32 executing program 1: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000180)='./file1\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="20000000360000001900000060008f000ff68f01000004000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}], 0x0, &(0x7f0000000140)={[{@jqfmt_vfsv0}]}) 07:14:32 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x100, 0x0}) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x28000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_config_ext={0x5, 0x8}, 0x4000, 0x0, 0x9, 0x7, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000001440)) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) clone(0x40808000, 0x0, 0x0, 0x0, 0x0) r1 = gettid() tkill(r1, 0x1e) r2 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r2, 0x0) ptrace$cont(0x18, 0x0, 0x0, 0x1) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ptrace$cont(0x7, 0x0, 0x0, 0x10001) openat$full(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x2, 0x80, 0x4, 0x4, 0xe0, 0xb, 0x0, 0x0, 0x8000, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x8004, 0x2, @perf_bp={0x0}, 0x4000, 0x8000, 0xfffffff9, 0x7, 0x80000001, 0x8, 0x0, 0x0, 0xa, 0x0, 0x100000000}, r1, 0x8, 0xffffffffffffffff, 0x6ee4ca8bd5713173) 07:14:32 executing program 3: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000, 0x0, 0x8000000000000000}]) 07:14:32 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\x00\x00\x00', 0xfffffffffffffffe) 07:14:32 executing program 4: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x1700, r0, &(0x7f0000000000), 0x16002}]) [ 942.648380][ C1] scsi_io_completion_action: 1 callbacks suppressed [ 942.648407][ C1] sd 0:0:1:0: [sg0] tag#5636 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 942.652664][ T4684] loop3: detected capacity change from 0 to 16 [ 942.655048][ C1] sd 0:0:1:0: [sg0] tag#5636 CDB: opcode=0xe5 (vendor) [ 942.678341][ C1] sd 0:0:1:0: [sg0] tag#5636 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 942.687891][ C1] sd 0:0:1:0: [sg0] tag#5636 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d 07:14:32 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\x00\x00\x00', 0xfffffffffffffffe) [ 942.697450][ C1] sd 0:0:1:0: [sg0] tag#5636 CDB[20]: ba [ 942.713465][ T4685] loop1: detected capacity change from 0 to 4 [ 942.737990][ T4685] EXT4-fs (loop1): Quota format mount options ignored when QUOTA feature is enabled 07:14:32 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\x00\x00\x00', 0xfffffffffffffffe) [ 942.747401][ T4685] EXT4-fs (loop1): unsupported descriptor size 0 07:14:33 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\x00\x00\x00', 0xfffffffffffffffe) 07:14:33 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x100, 0x0}) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x28000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_config_ext={0x5, 0x8}, 0x4000, 0x0, 0x9, 0x7, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000001440)) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r1, 0xd000943e, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) r2 = gettid() tkill(r2, 0x1e) r3 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r3, 0x0) ptrace$cont(0x18, 0x0, 0x0, 0x1) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ptrace$cont(0x7, 0x0, 0x0, 0x10001) openat$full(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x2, 0x80, 0x4, 0x4, 0xe0, 0xb, 0x0, 0x0, 0x8000, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x8004, 0x2, @perf_bp={0x0}, 0x4000, 0x8000, 0xfffffff9, 0x7, 0x80000001, 0x8, 0x0, 0x0, 0xa, 0x0, 0x100000000}, r2, 0x8, 0xffffffffffffffff, 0x6ee4ca8bd5713173) [ 942.783329][ T4705] loop4: detected capacity change from 0 to 16 07:14:33 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\x00\x00\x00', 0xfffffffffffffffe) 07:14:33 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\x00\x00\x00', 0xfffffffffffffffe) [ 942.837653][ C1] sd 0:0:1:0: [sg0] tag#5654 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 942.848019][ C1] sd 0:0:1:0: [sg0] tag#5654 CDB: opcode=0xe5 (vendor) [ 942.854874][ C1] sd 0:0:1:0: [sg0] tag#5654 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 942.864441][ C1] sd 0:0:1:0: [sg0] tag#5654 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 942.874002][ C1] sd 0:0:1:0: [sg0] tag#5654 CDB[20]: ba [ 942.925604][ T4685] loop1: detected capacity change from 0 to 4 [ 942.941095][ T4685] EXT4-fs (loop1): Quota format mount options ignored when QUOTA feature is enabled [ 942.950507][ T4685] EXT4-fs (loop1): unsupported descriptor size 0 07:14:33 executing program 0: syz_mount_image$vfat(&(0x7f00000002c0), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f736617e43c00088020000200000004f8000020004000000000000000000001", 0x25}, {0x0, 0x0, 0x200000000011000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6900) ftruncate(r0, 0x800) lseek(r0, 0x1200, 0x0) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, r1, 0x0, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @private2}, 0x1c) sendfile(r0, r1, 0x0, 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_FEATURES_SET(r2, 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHGPRL(0xffffffffffffffff, 0x89f7, &(0x7f00000001c0)={'ip6tnl0\x00', 0x0}) sendmsg$ETHTOOL_MSG_LINKINFO_GET(0xffffffffffffffff, 0x0, 0x0) sendfile(r0, r1, 0x0, 0x8400fffffffa) close(0xffffffffffffffff) 07:14:33 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x100, 0x0}) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x28000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_config_ext={0x5, 0x8}, 0x4000, 0x0, 0x9, 0x7, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000001440)) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r1, 0xd000943e, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) r2 = gettid() tkill(r2, 0x1e) r3 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r3, 0x0) ptrace$cont(0x18, 0x0, 0x0, 0x1) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ptrace$cont(0x7, 0x0, 0x0, 0x10001) openat$full(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x2, 0x80, 0x4, 0x4, 0xe0, 0xb, 0x0, 0x0, 0x8000, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x8004, 0x2, @perf_bp={0x0}, 0x4000, 0x8000, 0xfffffff9, 0x7, 0x80000001, 0x8, 0x0, 0x0, 0xa, 0x0, 0x100000000}, r2, 0x8, 0xffffffffffffffff, 0x6ee4ca8bd5713173) 07:14:33 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\x00\x00\x00', 0xfffffffffffffffe) 07:14:33 executing program 3: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000, 0x0, 0xb000000000000000}]) 07:14:33 executing program 4: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x3f00, r0, &(0x7f0000000000), 0x16002}]) 07:14:33 executing program 1: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000180)='./file1\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="20000000360000001900000060008f000ff68f01000005000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}], 0x0, &(0x7f0000000140)={[{@jqfmt_vfsv0}]}) [ 943.687081][ T4752] loop1: detected capacity change from 0 to 4 [ 943.694880][ T4753] loop3: detected capacity change from 0 to 16 [ 943.695802][ T4752] EXT4-fs (loop1): Quota format mount options ignored when QUOTA feature is enabled [ 943.701699][ C0] sd 0:0:1:0: [sg0] tag#5685 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 943.710418][ T4752] EXT4-fs (loop1): unsupported descriptor size 0 [ 943.720729][ C0] sd 0:0:1:0: [sg0] tag#5685 CDB: opcode=0xe5 (vendor) 07:14:33 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\x00\x00\x00', 0xfffffffffffffffe) [ 943.733890][ C0] sd 0:0:1:0: [sg0] tag#5685 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 943.741055][ T4762] loop4: detected capacity change from 0 to 16 [ 943.743452][ C0] sd 0:0:1:0: [sg0] tag#5685 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 943.759143][ C0] sd 0:0:1:0: [sg0] tag#5685 CDB[20]: ba 07:14:34 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\x00\x00\x00', 0xfffffffffffffffe) 07:14:34 executing program 3: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000, 0x0, 0xeffdffffffffffff}]) 07:14:34 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\x00\x00\x00', 0xfffffffffffffffe) [ 943.839759][ T4752] loop1: detected capacity change from 0 to 4 [ 943.850878][ T4752] EXT4-fs (loop1): Quota format mount options ignored when QUOTA feature is enabled [ 943.860333][ T4752] EXT4-fs (loop1): unsupported descriptor size 0 07:14:34 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x100, 0x0}) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x28000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_config_ext={0x5, 0x8}, 0x4000, 0x0, 0x9, 0x7, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000001440)) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r1, 0xd000943e, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) r2 = gettid() tkill(r2, 0x1e) r3 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r3, 0x0) ptrace$cont(0x18, 0x0, 0x0, 0x1) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ptrace$cont(0x7, 0x0, 0x0, 0x10001) openat$full(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x2, 0x80, 0x4, 0x4, 0xe0, 0xb, 0x0, 0x0, 0x8000, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x8004, 0x2, @perf_bp={0x0}, 0x4000, 0x8000, 0xfffffff9, 0x7, 0x80000001, 0x8, 0x0, 0x0, 0xa, 0x0, 0x100000000}, r2, 0x8, 0xffffffffffffffff, 0x6ee4ca8bd5713173) 07:14:34 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\x00\x00\x00', 0xfffffffffffffffe) [ 943.953939][ C1] sd 0:0:1:0: [sg0] tag#5682 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 943.964422][ C1] sd 0:0:1:0: [sg0] tag#5682 CDB: opcode=0xe5 (vendor) [ 943.971370][ C1] sd 0:0:1:0: [sg0] tag#5682 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 943.980971][ C1] sd 0:0:1:0: [sg0] tag#5682 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 943.990524][ C1] sd 0:0:1:0: [sg0] tag#5682 CDB[20]: ba [ 944.007826][ T4797] loop3: detected capacity change from 0 to 16 07:14:34 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\x00\x00\x00', 0xfffffffffffffffe) 07:14:34 executing program 1: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000180)='./file1\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="20000000360000001900000060008f000ff68f01000006000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}], 0x0, &(0x7f0000000140)={[{@jqfmt_vfsv0}]}) 07:14:34 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x100, 0x0}) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x28000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_config_ext={0x5, 0x8}, 0x4000, 0x0, 0x9, 0x7, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000001440)) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r1, 0xd000943e, 0x0) clone(0x40808000, 0x0, 0x0, 0x0, 0x0) r2 = gettid() tkill(0x0, 0x1e) r3 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r3, 0x0) ptrace$cont(0x18, 0x0, 0x0, 0x1) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ptrace$cont(0x7, 0x0, 0x0, 0x10001) openat$full(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x2, 0x80, 0x4, 0x4, 0xe0, 0xb, 0x0, 0x0, 0x8000, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x8004, 0x2, @perf_bp={0x0}, 0x4000, 0x8000, 0xfffffff9, 0x7, 0x80000001, 0x8, 0x0, 0x0, 0xa, 0x0, 0x100000000}, r2, 0x8, 0xffffffffffffffff, 0x6ee4ca8bd5713173) 07:14:34 executing program 4: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x4000, r0, &(0x7f0000000000), 0x16002}]) 07:14:34 executing program 0: syz_mount_image$vfat(&(0x7f00000002c0), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f736617e43c00088020000200000004f8000020004000000000000000000001", 0x25}, {0x0, 0x0, 0x200000000011000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6900) ftruncate(r0, 0x800) lseek(r0, 0x1200, 0x0) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, r1, 0x0, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x7, @private2}, 0x1c) sendfile(r0, r1, 0x0, 0x108d1521) r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_FEATURES_SET(r2, 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHGPRL(0xffffffffffffffff, 0x89f7, &(0x7f00000001c0)={'ip6tnl0\x00', 0x0}) sendmsg$ETHTOOL_MSG_LINKINFO_GET(0xffffffffffffffff, 0x0, 0x0) sendfile(r0, r1, 0x0, 0x8400fffffffa) close(0xffffffffffffffff) r3 = accept4$inet(r0, &(0x7f0000000080)={0x2, 0x0, @remote}, &(0x7f0000000140)=0x10, 0x80800) getsockopt$inet_int(r3, 0x0, 0x17, &(0x7f0000000180), &(0x7f0000000240)=0x4) 07:14:34 executing program 3: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000, 0x0, 0xefffffffffffffff}]) 07:14:34 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\x00\x00\x00', 0xfffffffffffffffe) [ 944.642213][ T4826] loop3: detected capacity change from 0 to 16 [ 944.646755][ T4830] loop1: detected capacity change from 0 to 4 [ 944.649913][ C0] sd 0:0:1:0: [sg0] tag#5657 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 944.664946][ C0] sd 0:0:1:0: [sg0] tag#5657 CDB: opcode=0xe5 (vendor) [ 944.671269][ T4830] EXT4-fs (loop1): Quota format mount options ignored when QUOTA feature is enabled [ 944.671795][ C0] sd 0:0:1:0: [sg0] tag#5657 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 944.671813][ C0] sd 0:0:1:0: [sg0] tag#5657 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 944.671827][ C0] sd 0:0:1:0: [sg0] tag#5657 CDB[20]: ba [ 944.705930][ T4830] EXT4-fs (loop1): unsupported descriptor size 0 07:14:34 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\x00\x00\x00', 0xfffffffffffffffe) 07:14:34 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\x00\x00\x00', 0xfffffffffffffffe) [ 944.754115][ T4852] loop4: detected capacity change from 0 to 16 07:14:35 executing program 3: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000, 0x0, 0xf000000000000000}]) 07:14:35 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x100, 0x0}) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x28000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_config_ext={0x5, 0x8}, 0x4000, 0x0, 0x9, 0x7, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000001440)) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r1, 0xd000943e, 0x0) clone(0x40808000, 0x0, 0x0, 0x0, 0x0) r2 = gettid() tkill(0x0, 0x1e) r3 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r3, 0x0) ptrace$cont(0x18, 0x0, 0x0, 0x1) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ptrace$cont(0x7, 0x0, 0x0, 0x10001) openat$full(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x2, 0x80, 0x4, 0x4, 0xe0, 0xb, 0x0, 0x0, 0x8000, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x8004, 0x2, @perf_bp={0x0}, 0x4000, 0x8000, 0xfffffff9, 0x7, 0x80000001, 0x8, 0x0, 0x0, 0xa, 0x0, 0x100000000}, r2, 0x8, 0xffffffffffffffff, 0x6ee4ca8bd5713173) 07:14:35 executing program 1: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000180)='./file1\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="20000000360000001900000060008f000ff68f01000007000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}], 0x0, &(0x7f0000000140)={[{@jqfmt_vfsv0}]}) 07:14:35 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\x00\x00\x00', 0xfffffffffffffffe) [ 944.807463][ T4830] loop1: detected capacity change from 0 to 4 [ 944.823387][ T4830] EXT4-fs (loop1): Quota format mount options ignored when QUOTA feature is enabled [ 944.832828][ T4830] EXT4-fs (loop1): unsupported descriptor size 0 07:14:35 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\x00\x00\x00', 0xfffffffffffffffe) 07:14:35 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\x00\x00\x00', 0xfffffffffffffffe) [ 944.887410][ C1] sd 0:0:1:0: [sg0] tag#5672 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 944.897787][ C1] sd 0:0:1:0: [sg0] tag#5672 CDB: opcode=0xe5 (vendor) [ 944.904651][ C1] sd 0:0:1:0: [sg0] tag#5672 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 944.914203][ C1] sd 0:0:1:0: [sg0] tag#5672 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 944.923748][ C1] sd 0:0:1:0: [sg0] tag#5672 CDB[20]: ba 07:14:35 executing program 4: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0xff01, r0, &(0x7f0000000000), 0x16002}]) [ 945.005661][ T4906] loop3: detected capacity change from 0 to 16 [ 945.009378][ T4905] loop1: detected capacity change from 0 to 4 [ 945.025157][ T4905] EXT4-fs (loop1): Quota format mount options ignored when QUOTA feature is enabled [ 945.034587][ T4905] EXT4-fs (loop1): unsupported descriptor size 0 [ 945.094594][ T4905] loop1: detected capacity change from 0 to 4 [ 945.105579][ T4905] EXT4-fs (loop1): Quota format mount options ignored when QUOTA feature is enabled [ 945.114995][ T4905] EXT4-fs (loop1): unsupported descriptor size 0 [ 945.138491][ T4923] loop4: detected capacity change from 0 to 16 07:14:35 executing program 0: syz_mount_image$vfat(&(0x7f00000002c0), &(0x7f0000000100)='./file0\x00', 0x0, 0x4, &(0x7f0000000140)=[{&(0x7f0000010000)="601c6d6b646f736617e43c00088020000200000004f8000020004000000000000000000001", 0x25}, {0x0, 0x0, 0x200000000011000}, {&(0x7f0000000080)="74df", 0x2, 0x2}, {&(0x7f0000000300)="bb6cc2ad5ed5077f2969bf27982828538ab57e58a49f22bd243a5242d87cff4a734d48c7a36f203746efca50fb3cd7d2b61446cc41d5061482c0c0fcbc80a1748c55568253b9a65a3ccddfc71916dad90527ea35799c6027bd976c08aa4eada545e9af0d4b586eddb90f97a4b1890e9d82cfe19e8d17ef48be6e81f1243f08b7b0e638229a88f5221c02a0345688425b7de9024da7b6e6ff7ec8080d6b07c253c18dd9c3f267ff40af43fe0e4eaf6fd4f5c8825dc956014dbb9a730d837b1dd6e89088606392722f9b67ddc4dfbe9cf426f273be74d01e319888a773131337d2a51c16350259892eb5124dd03b2e8c403309212a5ffb4c1c4468f162a6e5c0bf24f42a0950fd99eec2c9f2cc8884f67837369d5298d2a2b0fa16404e3467712a21ec967d85351f811a480c96ee80a539e23be581600a3c1be4e993857984b32e34f25b128730fc6788d7ef708f35bfad2b9ad3727e07fa534826677938cbd9b183080a7035fe6925902115b086e8326d36224ccec17f3798feaa298c5e5436127a9da8d67df38a3f84f23964ea8f889c41a817ca5181e1400ea1cd1a9284a091157e6e1b260f405945e7187c800237b71ee2e3362a9ed252b17d1df9f331a74e26face0f20d49dc1c864ad3a2f7b09137452460a7bf6cc271f28befdd7b7b09acf2b4583295366e6c15ed2bac55570cd8a53f839bd5b7d363dd82270101abf83b1fe92c2ff7ab036985cb35b022bb799e7ddef50ada70e64c89bd3f19788783c22ca85f5d11bf62cb3832a323d7c5e9206ddbd42d415ce488765a13cd74f8ff7772ea0ab352954eaecc14c5b3378a3b299b65f26b789a5dbd7e807c1cab4907b19ee483147868724bd084effa1611f64660160af1058bc8e5fe263ee2c8632a6bb7feaf03ee2b77d88c8fb25c93626ec26c16ae9ab84080cff45eef6e58b0414f2982a6b84f7dc1d0dee68e7316d5da6b800b3e8b88736fef0b1efc3cb2ea87ca1cdf02e8e997b8b624921ce8302ce2a1d07985b26101c5b304955d17a3832b9f9ad74e1937019e82abf5d15861a132d83d179ec391053e5aec96b3dc187a9325b6317eba1bd9b2d793ce6701f7feeb54c335b5c1800c86cd00b6937d620019f2a6f3d52e220d7aacba660b2af347c9e2e9589f9c6f04c8fb55af63d45744f03ae1d13c09c5e44835ad535dc6b638fc3019859ffa682469953dd24f241f437c7a6c4bfaf24507867a5cab49045c12dc8b1b741e004ea37823afd568367138c4050fc7fe5e530dad6d76c79526ed2c014e2a1004bfb7bfe9b661b4e74a97c645ade82d3f11aa8ec90e3efb57e2ca43830afc50aa9727f4b25447567a1b30b1ee1afc370e9e721acc61f066176abfe9bde9fee9cb1aec6317a368cd57f22b91449c7c6dd154fb14fa04e6aae3f6002d474621178c66274b0288af7daef9927ab29acf1ed9ffb7a6998ccc746eb3ff83fc7143e9a428973104caa9735daa2c7cd14af1a437b30b6c191d17e4699b2df3375f1717ab949af47f6d38aa4386a60ce4bca7319b34d2dd60ded8714bc93b641d957a756d11b1a94825b7c4645f72ae741c2935b587a57b8def50639271df88d1fa595146d5733b5410378bc4c18befe4f9337ad12fcfb17ea05643093ffc5a5921e0d3f54fbb378623b78a951a1feca3743824d35744f65ea5db27781ed4c2ffd113ea98a7bbf84c379ebb08033bc1f521ef7f75230faa4082d92750903d26f84e310738041a3af0ca983f48efddda5575d8adfdb946543b94331b19eb548a63b0a31af889a58bd4fe53d6093cb6517c70c8c7dfdbe3f92be16f3df0c5cf7ce64295fdaa5263279594abc8a1219e875e195046d28dc05fe7296cb66b8dc70f1eb1b47766a8c4d12f2da264fc0d1e4992d2266530d29629871b6309f2b537d8e511d436053c3a01285d758c4d6443ce89c3d6e92f88eb7470dbe42ed66c5e5df33751df0745843c389e95f3e10471f97b88ee3e8f78d2edd81e7632a6c80955c2ce51c317302498acc44fca275074fc953af32cedbb23f37d237705514b531c2cbd09d82f4b8bae9b9c881a5b8762414d5c1d1eecddbf427298e2e7cf6426185d1095fd8fb3c677cde068315dc1c9012bf8163f658b11c79867923d66361bdf287f85ed5da569200aad591a65a1b1aa385bede23ca3086e8a13f9bbc8c380495c68d1736f07c0964d6337d9592177ad97d289948c1c7d3f8995fac323511b5c614d031b61bef0d7f35fe6b4b8872f1b9b8b1f95dc51bdbee605c8966b0c3a658fb3f9a2db581da8a2269901f3952fea63a430ae35cce2d39de4c1e4404cf8303fddbd7b11b6b9e04f2a4f31c8f2d93fa8e4eb899212a1ad4950730f9f0f07a95892a089c31a6d524b00b8c9b95cc4ee026a0ffcf7ea0d957775359b9362b492920fa0603e9f646c1934e7eb64d3f9c72845f2bf5fd4b7198dfbf01a8c3b00443b96ad53e450090352aa24a7b94b440b01809b672d5f653518243361715a2c12231cdc1b7f10b297eb4ff227477612bf4360945944929bc7d5d5d4c1393a74a17b4c367689e89b54a618def1cef495756b4be846966ea21129168a886996487ffbc8d9b1a8a6477e0a21d543a3013b60c249eaf0d4a8032c7c266af0901d1182dc4ea6182f71dd92bd49ebc1c3215da6e6588bc98ebf41399a016499d7b312063d09a1db00a8e4786839bd7315dec4465990148008d216a109abe0bacf9001e7f15d6c423256e3c0cafbc57f0cad589a8b7ef7d16c6933f47dbe1abb7ee125ba0fe6a0152931fb35f2fcf172ffd7214e6668f8dfe91a13d547fd53ce47c321ed0e7a14f9f4e400ffa823efd12efe248bcd29c53cdcc73de111c8dcdb6fc2a116d96343a29751e801f967ee5ac1f656b15d1639c9d693143fbb625553729a823f7c5d38c394c04137545df020489b8bb1fd985b1344492b0ded89009e65e50ce295f149780a6ce66ff19157e85a3297746801f84f3cba6defe59c5f3b79ced063d0582748964dd81dd9d540d0a251b759deba20d2cb37e067b6a705a485536aaa1fb7cbeac15f559eacd1eabdbb5f60a9e8c69e3df77dd86e0e62fcd0c4213b25836cbb864ef9ba09f0f0509941eebb9d6310f34893f005d9d68392207b3712e85e7521d3398a01d61b16c00e409edb996e4084d5d21c05892ac4d131bff817612c23e40a86930a52ff973f2cc110f2cad1ea03a70ca6915a402b238ee026a77d2e6da388473a1988f1da82962834a0a380d9504b9ca4e75f872ef381cd8698e8c10d8668593aff2d64a34dca276c61ba856f1c98985bd9df2354787c5b58dfc748aafc4f735d5c8db80230b9e9b9f01e63216866c76fa1fe8424f2c9427644ba81441d675fff52593fd7c3a6a18c7e23c474a16beb3205adf3ae967a1b16f322a61530bacb568c868095a8c4991ac8c5e5f7fe625963608ea5375a444403cf5c62b27846d44eebe29fd3a6afe20f81fd7f7e5d803e422636306bf0f0a6637187ec192912ba7182c313b2555551d8edf930da4ea0928ac3abe78fa097c162a51893001b857eb6847dc2d837e710743e70f130b3ececad4403fed0420eccc2f8e4284e3c45fdf0676c5605aa303c48c132fc164f1fe17b2e97370c8601774deeb08a20ee798d97daea4c88a1f358eec50f51b9dd6f726d10372ac861858d59597034aa69017ca94b81f31335977a8fe4ace11dd7c906a13e7e4694dd907c8ac0c971b6d40fb8af71ab56728fb4cf9927a1d0bb0df3fa643f0dbb853b464133cbfa710d38463c2c796a0be3ceef1596d8f0caf13874f3f6646a1f81341eb9a5fd6ec73f6ff8cf3fd3521ffd1fa486db88375e6af1b501422ec18eff0f206eb2636255a6b6f3ce066ff00b714ca3425dbd40320cebf44a9ad9496a1956dab8bc72fdb10cc50fffe819607dc23d6be7220c8ddf313e1303572492d0cfb90c085ba9c1ddbcc6f2e696b735045f7983ed78606bf52b86c03603ca4dffe83625774f212fa82df97899f35149adf71ac69052e75cf11f06c0858320f5af2dba51eb605fe12345c464027cc00fde69f522a670243b6a484175b81e039bbd269225ce21fd031a94962ef3203a2048d92af5d52d3e41a2c20260a4a00ef8da59f44d3b5881e8af5723672ef99193b1095f52a2b2fe51598d95d092160b9cce74602a47f56e21abb740abd250742c7c403b1dc8a9b460802f962768713e678712c6622adb96197b7bc251a453ab5ea94295b0bcece637d707129235d3b453aea1fb57ca4580535572c7b74ad72159df12edfff5817268f5af7f2e736076be97c816817fb67e7f4047881251ef49b476876f9b0b9a5929303b3cf5451cdce7a0f5501fe75ef04c752e3e4131c8c6edf0454d87fe554861f9f6de8bf35d9f38c94e9eec29456b8a6d1ca485771a00e3cdd714dac629d15121d722b1014680bee01068b1f59f645c79968e4f761f7a69916766ce6e9f54f92959a477aa21b7713cceeaa243c3ddc872814b8ff88f8a4b717c5d5d3c0057d3a28cc695d43f30cc6c229edcbc0c2322fbc29f1279eda80eb0040bdaaa3c924f3f7370475d00cecab159d0a7a899733617642f5ed6da1c94ea16c795fb427d66d4896fccc5e36166e3d488d6f488d767451f4d4eceaf4dc0376d9110fe93364b548de7bbadbf4130db1321a795f2e0499855a83e6e46b286bbb77c9d6cf7eddcda320c996480a0c8a385b7de4d7efcaecff73f0b0ba51cd868eda8a27d94af3259611288dc0b0230f7471ff6347152f97ecef6de740cbe0d0b06aa860e35c34abbab2fa7ecabace1a376e32d267febbf0de8da1957b88b951e6994563a560b6977f056b453305d6a51c78cde1d8fbf0d1712d24e7afb7b556847958af53b10ded77951d113198539793bce38bd9bf18b1976e0c912944f0f365145355cd0378d7b4d4847208d7955254229d9fca73face3c5a27377873107a3dc4fa5d4e6eb15f829c4d40ed5d2f6eede6402ee7d3b2ccdf7f08ec66777126033373b99f2da30e4daefef54ca4c1c349797e9065cb4d2029539ca1c21dbbd711630fa515a5370693e8d10bf9cbe49a982199768f3116958ac93b0fd1fef5a1b493664cb33b6d3a5d29964deb008bb8a644562e80df804a511186d6ffd64e143e5371577b6ea48a8eded7a3eeacb55d511981a3c8cb5038243bd8187265013691311feb77f992bea4aee2f3624a02c8a6e798ba53a927087b631987d1a2e5dafaf5f8b3355f1b8f3e59ec59c0a3444940723cec060b57dfb8bfec8eb140d53108e1694529efd23624c27f20fa3533f2f9f134ad4b12ca123f98cbe669ae71abc9c10986941906906984d4ca53ef86dc68e8e9369b2af5da743a9cd53991154634c3ba0134650eda9849dc4cdf723e3350f1fe337bd15d60383ed69dcfcc8fc104072421598abf45572ec86dadaec9d0741cdd983c4807ad4989d53facc319850711814e9e669e5e2b87959945e76c32e94203aeda29afbe2f32158142c8030291b7533f62e494c829cdcc62ca12e3ff4758cdd0867f082ae512c5bc0e171870d51bef5121a698f459edd220237ef039910e15f6da42e59131945e9c4430d191a2300f710546cfbe1aa4f1da38f5b2594cfa593fc865f6077eac402d24a173f5b4e8d31f493ab71192b23eb6497f5a0d9f3ab3d044e4dfb1c3c657fba8b386198b3e54d90d01a94a18abddffec3f548e2497a2e28185eb77bd8d6b838108460b56c0973de8a8186d6f914bce6e8c29a803174e93c04c17a649a4da0590d065a348a346cc36f4a91134", 0x1000, 0x7ff}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6900) ftruncate(r0, 0x800) lseek(r0, 0x1200, 0x0) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, r1, 0x0, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @private2}, 0x1c) sendfile(r0, r1, 0x0, 0x108d1521) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) r4 = dup3(r0, r0, 0x0) sendmsg$ETHTOOL_MSG_CHANNELS_GET(r4, &(0x7f0000000280)={&(0x7f0000000200), 0xc, &(0x7f0000000240)={&(0x7f0000001300)={0x90, r3, 0x8, 0x70bd26, 0x25dfdbfe, {}, [@HEADER={0x34, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'bridge_slave_0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth1\x00'}]}, @HEADER={0x48, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'bridge_slave_0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}]}]}, 0x90}, 0x1, 0x0, 0x0, 0x80}, 0x8804) sendmsg$ETHTOOL_MSG_FEATURES_SET(r2, 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHGPRL(0xffffffffffffffff, 0x89f7, &(0x7f00000001c0)={'ip6tnl0\x00', 0x0}) sendfile(r0, r1, 0x0, 0x8400fffffffa) close(0xffffffffffffffff) 07:14:35 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\x00\x00\x00', 0xfffffffffffffffe) 07:14:35 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x100, 0x0}) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x28000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_config_ext={0x5, 0x8}, 0x4000, 0x0, 0x9, 0x7, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000001440)) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r1, 0xd000943e, 0x0) clone(0x40808000, 0x0, 0x0, 0x0, 0x0) r2 = gettid() tkill(0x0, 0x1e) r3 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r3, 0x0) ptrace$cont(0x18, 0x0, 0x0, 0x1) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ptrace$cont(0x7, 0x0, 0x0, 0x10001) openat$full(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x2, 0x80, 0x4, 0x4, 0xe0, 0xb, 0x0, 0x0, 0x8000, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x8004, 0x2, @perf_bp={0x0}, 0x4000, 0x8000, 0xfffffff9, 0x7, 0x80000001, 0x8, 0x0, 0x0, 0xa, 0x0, 0x100000000}, r2, 0x8, 0xffffffffffffffff, 0x6ee4ca8bd5713173) 07:14:35 executing program 1: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000180)='./file1\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="20000000360000001900000060008f000ff68f01000008000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}], 0x0, &(0x7f0000000140)={[{@jqfmt_vfsv0}]}) 07:14:35 executing program 3: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000, 0x0, 0xf2ffffffffffffff}]) 07:14:35 executing program 4: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0xff0f, r0, &(0x7f0000000000), 0x16002}]) [ 945.615138][ T4944] loop3: detected capacity change from 0 to 16 [ 945.623111][ T4946] loop1: detected capacity change from 0 to 4 [ 945.624837][ C0] sd 0:0:1:0: [sg0] tag#5689 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 945.639731][ C0] sd 0:0:1:0: [sg0] tag#5689 CDB: opcode=0xe5 (vendor) [ 945.646624][ C0] sd 0:0:1:0: [sg0] tag#5689 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c 07:14:35 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\x00\x00\x00', 0xfffffffffffffffe) [ 945.648747][ T4946] EXT4-fs (loop1): Quota format mount options ignored when QUOTA feature is enabled [ 945.656183][ C0] sd 0:0:1:0: [sg0] tag#5689 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 945.656200][ C0] sd 0:0:1:0: [sg0] tag#5689 CDB[20]: ba [ 945.681129][ T4946] EXT4-fs (loop1): unsupported descriptor size 0 07:14:35 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\x00\x00\x00', 0xfffffffffffffffe) 07:14:35 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x100, 0x0}) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x28000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_config_ext={0x5, 0x8}, 0x4000, 0x0, 0x9, 0x7, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000001440)) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r1, 0xd000943e, 0x0) clone(0x40808000, 0x0, 0x0, 0x0, 0x0) r2 = gettid() tkill(r2, 0x0) r3 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r3, 0x0) ptrace$cont(0x18, 0x0, 0x0, 0x1) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ptrace$cont(0x7, 0x0, 0x0, 0x10001) openat$full(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x2, 0x80, 0x4, 0x4, 0xe0, 0xb, 0x0, 0x0, 0x8000, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x8004, 0x2, @perf_bp={0x0}, 0x4000, 0x8000, 0xfffffff9, 0x7, 0x80000001, 0x8, 0x0, 0x0, 0xa, 0x0, 0x100000000}, r2, 0x8, 0xffffffffffffffff, 0x6ee4ca8bd5713173) [ 945.751119][ T4968] loop4: detected capacity change from 0 to 16 07:14:35 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\x00\x00\x00', 0xfffffffffffffffe) 07:14:35 executing program 3: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000, 0x0, 0xf4ffffff00000000}]) [ 945.796771][ T4946] loop1: detected capacity change from 0 to 4 [ 945.813950][ T4946] EXT4-fs (loop1): Quota format mount options ignored when QUOTA feature is enabled [ 945.815927][ C1] sd 0:0:1:0: [sg0] tag#5651 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 945.823361][ T4946] EXT4-fs (loop1): unsupported descriptor size 0 [ 945.833806][ C1] sd 0:0:1:0: [sg0] tag#5651 CDB: opcode=0xe5 (vendor) 07:14:36 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00w~\x9fp\x94', 0xfffffffffffffffe) [ 945.846950][ C1] sd 0:0:1:0: [sg0] tag#5651 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 945.856515][ C1] sd 0:0:1:0: [sg0] tag#5651 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 945.866085][ C1] sd 0:0:1:0: [sg0] tag#5651 CDB[20]: ba [ 945.908750][ T4999] loop3: detected capacity change from 0 to 16 [ 946.077634][ T4076] attempt to access beyond end of device [ 946.077634][ T4076] loop4: rw=1, want=257, limit=16 [ 946.088374][ T4076] attempt to access beyond end of device [ 946.088374][ T4076] loop4: rw=1, want=258, limit=16 [ 946.098938][ T4076] Buffer I/O error on dev loop4, logical block 257, lost async page write [ 946.107925][ T4076] attempt to access beyond end of device [ 946.107925][ T4076] loop4: rw=1, want=259, limit=16 [ 946.118435][ T4076] Buffer I/O error on dev loop4, logical block 258, lost async page write [ 946.127041][ T4076] attempt to access beyond end of device [ 946.127041][ T4076] loop4: rw=1, want=260, limit=16 [ 946.137547][ T4076] Buffer I/O error on dev loop4, logical block 259, lost async page write [ 946.146200][ T4076] attempt to access beyond end of device [ 946.146200][ T4076] loop4: rw=1, want=261, limit=16 [ 946.156717][ T4076] Buffer I/O error on dev loop4, logical block 260, lost async page write 07:14:36 executing program 0: syz_mount_image$vfat(&(0x7f00000002c0), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f736617e43c00088020000200000004f8000020004000000000000000000001", 0x25}, {0x0, 0x0, 0x200000000011000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6900) lseek(r0, 0x1200, 0x0) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, r1, 0x0, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @private2}, 0x1c) sendfile(r0, r1, 0x0, 0x108d1521) r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) ioctl$FS_IOC_SETFLAGS(r1, 0x40086602, &(0x7f0000000080)=0x20000) sendmsg$ETHTOOL_MSG_FEATURES_SET(r2, 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHGPRL(0xffffffffffffffff, 0x89f7, &(0x7f00000001c0)={'ip6tnl0\x00', 0x0}) sendmsg$ETHTOOL_MSG_LINKINFO_GET(0xffffffffffffffff, 0x0, 0x0) preadv(0xffffffffffffffff, &(0x7f0000000540)=[{&(0x7f0000000300)=""/209, 0xd1}, {&(0x7f0000000180)=""/32, 0x20}, {&(0x7f0000000240)=""/67, 0x43}, {&(0x7f0000000400)=""/137, 0x89}, {&(0x7f00000004c0)=""/120, 0x78}], 0x5, 0x100, 0xa4) sendfile(r0, r1, 0x0, 0x8400fffffffa) close(0xffffffffffffffff) 07:14:36 executing program 1: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000180)='./file1\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="20000000360000001900000060008f000ff68f01000009000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}], 0x0, &(0x7f0000000140)={[{@jqfmt_vfsv0}]}) 07:14:36 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\xff\xff\xff', 0xfffffffffffffffe) 07:14:36 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x100, 0x0}) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x28000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_config_ext={0x5, 0x8}, 0x4000, 0x0, 0x9, 0x7, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000001440)) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r1, 0xd000943e, 0x0) clone(0x40808000, 0x0, 0x0, 0x0, 0x0) r2 = gettid() tkill(r2, 0x0) r3 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r3, 0x0) ptrace$cont(0x18, 0x0, 0x0, 0x1) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ptrace$cont(0x7, 0x0, 0x0, 0x10001) openat$full(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x2, 0x80, 0x4, 0x4, 0xe0, 0xb, 0x0, 0x0, 0x8000, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x8004, 0x2, @perf_bp={0x0}, 0x4000, 0x8000, 0xfffffff9, 0x7, 0x80000001, 0x8, 0x0, 0x0, 0xa, 0x0, 0x100000000}, r2, 0x8, 0xffffffffffffffff, 0x6ee4ca8bd5713173) 07:14:36 executing program 3: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000, 0x0, 0xf700000000000000}]) 07:14:36 executing program 4: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0xffff, r0, &(0x7f0000000000), 0x16002}]) [ 946.527326][ C1] sd 0:0:1:0: [sg0] tag#5634 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 946.537696][ C1] sd 0:0:1:0: [sg0] tag#5634 CDB: opcode=0xe5 (vendor) [ 946.540421][ T5030] loop1: detected capacity change from 0 to 4 [ 946.544563][ C1] sd 0:0:1:0: [sg0] tag#5634 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 946.544583][ C1] sd 0:0:1:0: [sg0] tag#5634 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 946.554587][ T5030] EXT4-fs (loop1): Quota format mount options ignored when QUOTA feature is enabled [ 946.560170][ C1] sd 0:0:1:0: [sg0] tag#5634 CDB[20]: ba [ 946.569700][ T5030] EXT4-fs (loop1): unsupported descriptor size 0 [ 946.593554][ T5036] loop3: detected capacity change from 0 to 16 07:14:36 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x02\x00\x00\x00\x00\x00', 0xfffffffffffffffe) 07:14:36 executing program 0: syz_mount_image$vfat(&(0x7f00000002c0), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f736617e43c00088020000200000004f8000020004000000000000000000001", 0x25}, {0x0, 0x0, 0x200000000011000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6900) ftruncate(r0, 0x800) lseek(r0, 0x1200, 0x0) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, r1, 0x0, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @private2}, 0x1c) sendfile(r0, r1, 0x0, 0x108d1521) r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) ioctl$sock_inet6_SIOCSIFADDR(0xffffffffffffffff, 0x8916, &(0x7f0000000000)={@remote, 0x16}) sendmsg$ETHTOOL_MSG_LINKSTATE_GET(0xffffffffffffffff, &(0x7f00000004c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000480)={&(0x7f0000000340)={0x128, 0x0, 0x200, 0x70bd2c, 0x25dfdbfe, {}, [@HEADER={0x70, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'nr0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'nr0\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'team0\x00'}]}, @HEADER={0x38, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'bridge0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}]}, @HEADER={0x20, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'nr0\x00'}]}, @HEADER={0x4c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'syzkaller0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_to_hsr\x00'}]}]}, 0x128}, 0x1, 0x0, 0x0, 0x40}, 0x20000000) sendmsg$ETHTOOL_MSG_FEATURES_SET(r2, 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHGPRL(0xffffffffffffffff, 0x89f7, &(0x7f00000001c0)={'ip6tnl0\x00', 0x0}) sendmsg$ETHTOOL_MSG_LINKINFO_GET(0xffffffffffffffff, 0x0, 0x0) sendfile(r0, r1, 0x0, 0x8400fffffffa) close(0xffffffffffffffff) 07:14:36 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x100, 0x0}) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x28000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_config_ext={0x5, 0x8}, 0x4000, 0x0, 0x9, 0x7, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000001440)) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r1, 0xd000943e, 0x0) clone(0x40808000, 0x0, 0x0, 0x0, 0x0) r2 = gettid() tkill(r2, 0x0) r3 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r3, 0x0) ptrace$cont(0x18, 0x0, 0x0, 0x1) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ptrace$cont(0x7, 0x0, 0x0, 0x10001) openat$full(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x2, 0x80, 0x4, 0x4, 0xe0, 0xb, 0x0, 0x0, 0x8000, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x8004, 0x2, @perf_bp={0x0}, 0x4000, 0x8000, 0xfffffff9, 0x7, 0x80000001, 0x8, 0x0, 0x0, 0xa, 0x0, 0x100000000}, r2, 0x8, 0xffffffffffffffff, 0x6ee4ca8bd5713173) 07:14:36 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x03\x00\x00\x00\x00\x00', 0xfffffffffffffffe) 07:14:36 executing program 1: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000180)='./file1\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="20000000360000001900000060008f000ff68f0100000a000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}], 0x0, &(0x7f0000000140)={[{@jqfmt_vfsv0}]}) 07:14:36 executing program 3: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000, 0x0, 0xf800000000000000}]) 07:14:36 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x04\x00\x00\x00\x00\x00', 0xfffffffffffffffe) [ 946.718897][ C1] sd 0:0:1:0: [sg0] tag#5632 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 946.719782][ T5063] loop1: detected capacity change from 0 to 4 [ 946.729279][ C1] sd 0:0:1:0: [sg0] tag#5632 CDB: opcode=0xe5 (vendor) [ 946.742185][ C1] sd 0:0:1:0: [sg0] tag#5632 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 946.751747][ C1] sd 0:0:1:0: [sg0] tag#5632 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 946.761308][ C1] sd 0:0:1:0: [sg0] tag#5632 CDB[20]: ba 07:14:37 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x05\x00\x00\x00\x00\x00', 0xfffffffffffffffe) [ 946.778935][ T5063] EXT4-fs (loop1): Quota format mount options ignored when QUOTA feature is enabled [ 946.788336][ T5063] EXT4-fs (loop1): unsupported descriptor size 0 07:14:37 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x100, 0x0}) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x28000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_config_ext={0x5, 0x8}, 0x4000, 0x0, 0x9, 0x7, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000001440)) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r1, 0xd000943e, 0x0) clone(0x40808000, 0x0, 0x0, 0x0, 0x0) r2 = gettid() tkill(r2, 0x1e) r3 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r3, 0x0) ptrace$cont(0x18, 0x0, 0x0, 0x1) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ptrace$cont(0x7, 0x0, 0x0, 0x10001) openat$full(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x2, 0x80, 0x4, 0x4, 0xe0, 0xb, 0x0, 0x0, 0x8000, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x8004, 0x2, @perf_bp={0x0}, 0x4000, 0x8000, 0xfffffff9, 0x7, 0x80000001, 0x8, 0x0, 0x0, 0xa, 0x0, 0x100000000}, r2, 0x8, 0xffffffffffffffff, 0x6ee4ca8bd5713173) [ 946.836242][ T5087] loop4: detected capacity change from 0 to 16 07:14:37 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x06\x00\x00\x00\x00\x00', 0xfffffffffffffffe) 07:14:37 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\a\x00\x00\x00\x00\x00', 0xfffffffffffffffe) [ 946.909234][ T5063] loop1: detected capacity change from 0 to 4 [ 946.918047][ T5063] EXT4-fs (loop1): Quota format mount options ignored when QUOTA feature is enabled [ 946.927473][ T5063] EXT4-fs (loop1): unsupported descriptor size 0 [ 946.942165][ T5109] loop3: detected capacity change from 0 to 16 07:14:37 executing program 4: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x11f00}]) 07:14:37 executing program 1: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000180)='./file1\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="20000000360000001900000060008f000ff68f0100000b000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}], 0x0, &(0x7f0000000140)={[{@jqfmt_vfsv0}]}) [ 947.072027][ T1848] attempt to access beyond end of device [ 947.072027][ T1848] loop4: rw=1, want=256, limit=16 [ 947.096964][ T5139] loop1: detected capacity change from 0 to 4 [ 947.107746][ T5139] EXT4-fs (loop1): Quota format mount options ignored when QUOTA feature is enabled [ 947.117206][ T5139] EXT4-fs (loop1): unsupported descriptor size 0 [ 947.181074][ T5139] loop1: detected capacity change from 0 to 4 [ 947.183770][ T5150] loop4: detected capacity change from 0 to 16 [ 947.194176][ T5139] EXT4-fs (loop1): Quota format mount options ignored when QUOTA feature is enabled [ 947.203606][ T5139] EXT4-fs (loop1): unsupported descriptor size 0 07:14:37 executing program 0: r0 = syz_mount_image$vfat(&(0x7f00000002c0), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f736617e43c00088020000200000004f8000020004000000000000000000001", 0x25}, {0x0, 0x0, 0x200000000011000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r1 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6900) ftruncate(r1, 0x800) lseek(r1, 0x1200, 0x0) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, 0x0, 0x0) r2 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, r2, 0x0, 0x0) readahead(r0, 0x1000002, 0x6) bind$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @private2}, 0x1c) sendfile(r1, r2, 0x0, 0x108d1521) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_FEATURES_SET(r3, 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHGPRL(0xffffffffffffffff, 0x89f7, &(0x7f00000001c0)={'ip6tnl0\x00', 0x0}) sendmsg$ETHTOOL_MSG_LINKINFO_GET(0xffffffffffffffff, 0x0, 0x0) sendfile(r1, r2, 0x0, 0x8400fffffffa) close(0xffffffffffffffff) 07:14:37 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\b\x00\x00\x00\x00\x00', 0xfffffffffffffffe) 07:14:37 executing program 3: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000, 0x0, 0xfbffffff00000000}]) 07:14:37 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x100, 0x0}) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x28000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_config_ext={0x5, 0x8}, 0x4000, 0x0, 0x9, 0x7, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000001440)) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r1, 0xd000943e, 0x0) clone(0x40808000, 0x0, 0x0, 0x0, 0x0) r2 = gettid() tkill(r2, 0x1e) r3 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r3, 0x0) ptrace$cont(0x18, 0x0, 0x0, 0x1) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ptrace$cont(0x7, 0x0, 0x0, 0x10001) openat$full(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x2, 0x80, 0x4, 0x4, 0xe0, 0xb, 0x0, 0x0, 0x8000, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x8004, 0x2, @perf_bp={0x0}, 0x4000, 0x8000, 0xfffffff9, 0x7, 0x80000001, 0x8, 0x0, 0x0, 0xa, 0x0, 0x100000000}, r2, 0x8, 0xffffffffffffffff, 0x6ee4ca8bd5713173) 07:14:37 executing program 1: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000180)='./file1\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="20000000360000001900000060008f000ff68f0100000c000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}], 0x0, &(0x7f0000000140)={[{@jqfmt_vfsv0}]}) 07:14:37 executing program 4: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16004}]) 07:14:37 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\t\x00\x00\x00\x00\x00', 0xfffffffffffffffe) [ 947.625771][ T5171] loop1: detected capacity change from 0 to 4 [ 947.630357][ T5173] loop3: detected capacity change from 0 to 16 [ 947.652767][ T5171] EXT4-fs (loop1): Quota format mount options ignored when QUOTA feature is enabled [ 947.662220][ T5171] EXT4-fs (loop1): unsupported descriptor size 0 07:14:37 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\n\x00\x00\x00\x00\x00', 0xfffffffffffffffe) 07:14:37 executing program 3: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000, 0x0, 0xff5f010000000000}]) 07:14:37 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\v\x00\x00\x00\x00\x00', 0xfffffffffffffffe) [ 947.734456][ T5171] loop1: detected capacity change from 0 to 4 [ 947.761932][ T5171] EXT4-fs (loop1): Quota format mount options ignored when QUOTA feature is enabled [ 947.771407][ T5171] EXT4-fs (loop1): unsupported descriptor size 0 07:14:38 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\f\x00\x00\x00\x00\x00', 0xfffffffffffffffe) [ 947.825172][ T5212] loop4: detected capacity change from 0 to 16 07:14:38 executing program 1: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000180)='./file1\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="20000000360000001900000060008f000ff68f0100000d000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}], 0x0, &(0x7f0000000140)={[{@jqfmt_vfsv0}]}) [ 947.907529][ T5222] loop3: detected capacity change from 0 to 16 [ 947.930722][ T5227] loop1: detected capacity change from 0 to 4 [ 947.952645][ T5227] EXT4-fs (loop1): Quota format mount options ignored when QUOTA feature is enabled [ 947.962081][ T5227] EXT4-fs (loop1): unsupported descriptor size 0 [ 948.004718][ T5227] loop1: detected capacity change from 0 to 4 [ 948.022199][ T5227] EXT4-fs (loop1): Quota format mount options ignored when QUOTA feature is enabled [ 948.031583][ T5227] EXT4-fs (loop1): unsupported descriptor size 0 07:14:38 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x100, 0x0}) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x28000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_config_ext={0x5, 0x8}, 0x4000, 0x0, 0x9, 0x7, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000001440)) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r1, 0xd000943e, 0x0) clone(0x40808000, 0x0, 0x0, 0x0, 0x0) r2 = gettid() tkill(r2, 0x1e) r3 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r3, 0x0) ptrace$cont(0x18, 0x0, 0x0, 0x1) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ptrace$cont(0x7, 0x0, 0x0, 0x10001) openat$full(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x2, 0x80, 0x4, 0x4, 0xe0, 0xb, 0x0, 0x0, 0x8000, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x8004, 0x2, @perf_bp={0x0}, 0x4000, 0x8000, 0xfffffff9, 0x7, 0x80000001, 0x8, 0x0, 0x0, 0xa, 0x0, 0x100000000}, r2, 0x8, 0xffffffffffffffff, 0x6ee4ca8bd5713173) 07:14:38 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\r\x00\x00\x00\x00\x00', 0xfffffffffffffffe) 07:14:38 executing program 1: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000180)='./file1\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="20000000360000001900000060008f000ff68f0100000e000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}], 0x0, &(0x7f0000000140)={[{@jqfmt_vfsv0}]}) 07:14:38 executing program 3: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000, 0x0, 0xffefffff00000000}]) 07:14:38 executing program 4: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16008}]) [ 948.499005][ C1] scsi_io_completion_action: 2 callbacks suppressed [ 948.499030][ C1] sd 0:0:1:0: [sg0] tag#5677 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 948.515998][ C1] sd 0:0:1:0: [sg0] tag#5677 CDB: opcode=0xe5 (vendor) [ 948.518082][ T5261] loop3: detected capacity change from 0 to 16 [ 948.522872][ C1] sd 0:0:1:0: [sg0] tag#5677 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 948.535628][ T5263] 9pnet: Insufficient options for proto=fd 07:14:38 executing program 0: r0 = syz_mount_image$vfat(&(0x7f00000002c0), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f736617e43c00088020000200000004f8000020004000000000000000000001", 0x25, 0x3}, {0x0, 0x0, 0x8}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r1 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x0) ftruncate(r1, 0x800) lseek(r1, 0x1200, 0x0) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, 0x0, 0x0) r2 = open(&(0x7f0000000140)='./bus\x00', 0x430480, 0x0) sendfile(0xffffffffffffffff, r2, 0x0, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @private2}, 0x1c) sendfile(r2, 0xffffffffffffffff, 0x0, 0x8001) sendfile(r1, r2, 0x0, 0x108d1521) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_FEATURES_SET(r3, 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHGPRL(0xffffffffffffffff, 0x89f7, &(0x7f00000001c0)={'ip6tnl0\x00', 0x0}) sendmsg$ETHTOOL_MSG_LINKINFO_GET(0xffffffffffffffff, 0x0, 0x0) mount$9p_fd(0x0, &(0x7f0000000080)='./bus\x00', &(0x7f0000000180), 0x1000000, &(0x7f0000000540)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r2, @ANYBLOB=',wfdno=', @ANYRESHEX, @ANYBLOB=',posixacl,cache=loose,dfltuid=', @ANYRESHEX=0x0, @ANYBLOB=',uid>', @ANYRESDEC=0x0, @ANYBLOB="040000bcef", @ANYRESDEC=0x0, @ANYBLOB="2c736d61636b6673666c6f6f723d697036746e6c30002c6f626a5f757365723d9f5e5b5d3a2c00"]) sendfile(r1, r2, 0x0, 0x8400fffffffa) close(r3) 07:14:38 executing program 0: syz_mount_image$vfat(&(0x7f00000002c0), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f736617e43c00088000000200000004f8000020004000000000000000000001", 0x25}, {0x0, 0x3d, 0x200000000011000}], 0x0, &(0x7f0000002880)=ANY=[@ANYRES16=0x0]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6900) ftruncate(r0, 0x800) lseek(r0, 0x1200, 0x0) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @private2}, 0x1c) sendfile(r0, r1, 0x0, 0x108d1521) r2 = socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) recvmmsg$unix(r0, &(0x7f0000002b40)=[{{&(0x7f0000000140), 0x6e, &(0x7f0000001740)=[{&(0x7f0000000240)=""/102, 0x66}, {&(0x7f0000000300)=""/234, 0xea}, {&(0x7f0000000400)=""/139, 0x8b}, {&(0x7f00000004c0)=""/4096, 0x1000}, {&(0x7f00000014c0)=""/109, 0x6d}, {&(0x7f0000001540)=""/202, 0xca}, {&(0x7f0000001640)=""/128, 0x80}, {&(0x7f00000016c0)=""/76, 0x4c}], 0x8, &(0x7f0000000080)=[@rights={{0x2c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0x30}}, {{&(0x7f00000017c0)=@abs, 0x6e, &(0x7f0000002840)=[{&(0x7f0000001840)=""/4096, 0x1000}], 0x1, &(0x7f0000002880)}}, {{0x0, 0x0, &(0x7f0000002b00)=[{&(0x7f00000028c0)=""/225, 0xe1}, {&(0x7f00000029c0)=""/89, 0x59}, {&(0x7f0000002a40)=""/161, 0xa1}], 0x3}}], 0x3, 0x80000001, &(0x7f0000002c00)={0x0, 0x989680}) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_FEATURES_SET(r2, 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHGPRL(0xffffffffffffffff, 0x89f7, &(0x7f00000001c0)={'ip6tnl0\x00', 0x0}) sendmsg$ETHTOOL_MSG_LINKINFO_GET(0xffffffffffffffff, 0x0, 0x0) sendfile(r0, r1, 0x0, 0x8400fffffffa) close(0xffffffffffffffff) [ 948.538538][ C1] sd 0:0:1:0: [sg0] tag#5677 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 948.553881][ C1] sd 0:0:1:0: [sg0] tag#5677 CDB[20]: ba [ 948.556239][ T5263] 9pnet: Insufficient options for proto=fd [ 948.561285][ T5260] loop1: detected capacity change from 0 to 4 07:14:38 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x0e\x00\x00\x00\x00\x00', 0xfffffffffffffffe) 07:14:38 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x0f\x00\x00\x00\x00\x00', 0xfffffffffffffffe) 07:14:38 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x100, 0x0}) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x28000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_config_ext={0x5, 0x8}, 0x4000, 0x0, 0x9, 0x7, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000001440)) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r1, 0xd000943e, 0x0) clone(0x40808000, 0x0, 0x0, 0x0, 0x0) r2 = gettid() tkill(r2, 0x1e) r3 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0, 0x12, r3, 0x0) ptrace$cont(0x18, 0x0, 0x0, 0x1) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ptrace$cont(0x7, 0x0, 0x0, 0x10001) openat$full(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x2, 0x80, 0x4, 0x4, 0xe0, 0xb, 0x0, 0x0, 0x8000, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x8004, 0x2, @perf_bp={0x0}, 0x4000, 0x8000, 0xfffffff9, 0x7, 0x80000001, 0x8, 0x0, 0x0, 0xa, 0x0, 0x100000000}, r2, 0x8, 0xffffffffffffffff, 0x6ee4ca8bd5713173) [ 948.633527][ T5282] loop4: detected capacity change from 0 to 16 [ 948.648084][ T5260] EXT4-fs (loop1): Quota format mount options ignored when QUOTA feature is enabled [ 948.657564][ T5260] EXT4-fs (loop1): unsupported descriptor size 0 07:14:38 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x10\x00\x00\x00\x00\x00', 0xfffffffffffffffe) [ 948.698512][ C0] sd 0:0:1:0: [sg0] tag#5650 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 948.708900][ C0] sd 0:0:1:0: [sg0] tag#5650 CDB: opcode=0xe5 (vendor) [ 948.715776][ C0] sd 0:0:1:0: [sg0] tag#5650 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 948.725361][ C0] sd 0:0:1:0: [sg0] tag#5650 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 948.734934][ C0] sd 0:0:1:0: [sg0] tag#5650 CDB[20]: ba 07:14:38 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x11\x00\x00\x00\x00\x00', 0xfffffffffffffffe) 07:14:38 executing program 3: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000, 0x0, 0xffffff0f00000000}]) [ 948.771243][ T5260] loop1: detected capacity change from 0 to 4 07:14:39 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x12\x00\x00\x00\x00\x00', 0xfffffffffffffffe) [ 948.813595][ T5260] EXT4-fs (loop1): Quota format mount options ignored when QUOTA feature is enabled [ 948.823095][ T5260] EXT4-fs (loop1): unsupported descriptor size 0 07:14:39 executing program 1: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000180)='./file1\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="20000000360000001900000060008f000ff68f0100000f000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}], 0x0, &(0x7f0000000140)={[{@jqfmt_vfsv0}]}) 07:14:39 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x100, 0x0}) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x28000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_config_ext={0x5, 0x8}, 0x4000, 0x0, 0x9, 0x7, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000001440)) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r1, 0xd000943e, 0x0) clone(0x40808000, 0x0, 0x0, 0x0, 0x0) r2 = gettid() tkill(r2, 0x1e) r3 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0, 0x12, r3, 0x0) ptrace$cont(0x18, 0x0, 0x0, 0x1) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ptrace$cont(0x7, 0x0, 0x0, 0x10001) openat$full(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x2, 0x80, 0x4, 0x4, 0xe0, 0xb, 0x0, 0x0, 0x8000, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x8004, 0x2, @perf_bp={0x0}, 0x4000, 0x8000, 0xfffffff9, 0x7, 0x80000001, 0x8, 0x0, 0x0, 0xa, 0x0, 0x100000000}, r2, 0x8, 0xffffffffffffffff, 0x6ee4ca8bd5713173) [ 948.878774][ T5333] loop3: detected capacity change from 0 to 16 [ 948.929881][ T5342] loop1: detected capacity change from 0 to 4 [ 948.936794][ C0] sd 0:0:1:0: [sg0] tag#5679 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 948.947332][ C0] sd 0:0:1:0: [sg0] tag#5679 CDB: opcode=0xe5 (vendor) [ 948.954288][ C0] sd 0:0:1:0: [sg0] tag#5679 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 948.963858][ C0] sd 0:0:1:0: [sg0] tag#5679 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 948.973424][ C0] sd 0:0:1:0: [sg0] tag#5679 CDB[20]: ba [ 948.991390][ T5342] EXT4-fs (loop1): Quota format mount options ignored when QUOTA feature is enabled [ 949.000829][ T5342] EXT4-fs (loop1): unsupported descriptor size 0 07:14:39 executing program 4: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16009}]) 07:14:39 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00H\x00\x00\x00\x00\x00', 0xfffffffffffffffe) [ 949.041231][ T5342] loop1: detected capacity change from 0 to 4 [ 949.052866][ T5342] EXT4-fs (loop1): Quota format mount options ignored when QUOTA feature is enabled [ 949.062300][ T5342] EXT4-fs (loop1): unsupported descriptor size 0 [ 949.188812][ T5377] loop4: detected capacity change from 0 to 16 07:14:39 executing program 3: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000, 0x0, 0xffffffff00000000}]) 07:14:39 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x100, 0x0}) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x28000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_config_ext={0x5, 0x8}, 0x4000, 0x0, 0x9, 0x7, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000001440)) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r1, 0xd000943e, 0x0) clone(0x40808000, 0x0, 0x0, 0x0, 0x0) r2 = gettid() tkill(r2, 0x1e) r3 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0, 0x12, r3, 0x0) ptrace$cont(0x18, 0x0, 0x0, 0x1) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ptrace$cont(0x7, 0x0, 0x0, 0x10001) openat$full(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x2, 0x80, 0x4, 0x4, 0xe0, 0xb, 0x0, 0x0, 0x8000, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x8004, 0x2, @perf_bp={0x0}, 0x4000, 0x8000, 0xfffffff9, 0x7, 0x80000001, 0x8, 0x0, 0x0, 0xa, 0x0, 0x100000000}, r2, 0x8, 0xffffffffffffffff, 0x6ee4ca8bd5713173) 07:14:39 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00L\x00\x00\x00\x00\x00', 0xfffffffffffffffe) 07:14:39 executing program 1: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000180)='./file1\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="20000000360000001900000060008f000ff68f01000010000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}], 0x0, &(0x7f0000000140)={[{@jqfmt_vfsv0}]}) 07:14:39 executing program 4: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x1600c}]) 07:14:39 executing program 0: syz_mount_image$vfat(&(0x7f0000000180), &(0x7f0000000100)='./file0\x00', 0x8000, 0x0, &(0x7f0000000200), 0x0, &(0x7f0000000200)=ANY=[@ANYRES16, @ANYBLOB="4fa863e1a692f691b7fec9ee7bcae721ac877d689aa5726c1c8a200fd529bfa3887c72699a76235753c67cd0417c5b2aafe553ec4b9205d3efb0dac8f3743dc5fe51e8401abd793d049bf96d0dced7f910de924721d8ae17d1e3b23dd9af432bc80d97e293b3843ddbfdbac6d4c4c2838a15715e311b5ac27bca1caeb74f0339783f1c39816abe74862bd47233ea4b87e07a5bd9a6684e64bf8423b73dc694050000008c78672a94588dece926a8f8e13a8eed8b768734c6160911e469bbfc817245cafa61760965214175d3e654101b92a681f639ce081606aa6f9a244ea09be6db958c3ae999d042d82cfd82d6d68398", @ANYRESHEX, @ANYRES64, @ANYRES64]) chdir(&(0x7f0000000140)='./bus\x00') r0 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6900) r1 = creat(&(0x7f0000000080)='./file0\x00', 0x1) ftruncate(r1, 0x40) lseek(r0, 0x1200, 0x0) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, 0x0, 0x0) fcntl$getown(0xffffffffffffffff, 0x9) r2 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, r2, 0x0, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @private2}, 0x1c) sendfile(r0, r2, 0x0, 0x108d1521) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_FEATURES_SET(r3, 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHGPRL(0xffffffffffffffff, 0x89f7, &(0x7f0000000040)={'ip6_vti0\x00', 0x0}) sendmsg$ETHTOOL_MSG_LINKINFO_GET(0xffffffffffffffff, 0x0, 0x0) sendfile(r0, r2, 0x0, 0x8400fffffffa) close(0xffffffffffffffff) 07:14:39 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00h\x00\x00\x00\x00\x00', 0xfffffffffffffffe) [ 949.464734][ C1] sd 0:0:1:0: [sg0] tag#5666 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 949.475118][ C1] sd 0:0:1:0: [sg0] tag#5666 CDB: opcode=0xe5 (vendor) [ 949.482013][ C1] sd 0:0:1:0: [sg0] tag#5666 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 949.491549][ C1] sd 0:0:1:0: [sg0] tag#5666 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 949.501128][ C1] sd 0:0:1:0: [sg0] tag#5666 CDB[20]: ba 07:14:39 executing program 0: syz_mount_image$vfat(&(0x7f00000002c0), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f736617e43c00088020000200000004f8000020004000000000000000000001", 0x25}, {0x0, 0x0, 0x200000000011000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6900) ftruncate(r0, 0x800) lseek(r0, 0x1200, 0x0) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, r1, 0x0, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @private2}, 0x1c) sendfile(r0, r1, 0x0, 0x108d1521) r2 = socket$nl_generic(0x10, 0x3, 0x10) accept$packet(r1, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000240)=0x14) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_FEATURES_SET(r2, 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHGPRL(0xffffffffffffffff, 0x89f7, &(0x7f00000001c0)={'ip6tnl0\x00', 0x0}) sendmsg$ETHTOOL_MSG_LINKINFO_GET(0xffffffffffffffff, 0x0, 0x0) sendfile(r0, r1, 0x0, 0x8400fffffffa) close(0xffffffffffffffff) [ 949.516894][ T5394] loop1: detected capacity change from 0 to 4 [ 949.526269][ T5396] loop3: detected capacity change from 0 to 16 [ 949.552019][ T5394] EXT4-fs (loop1): Quota format mount options ignored when QUOTA feature is enabled 07:14:39 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00l\x00\x00\x00\x00\x00', 0xfffffffffffffffe) [ 949.561485][ T5394] EXT4-fs (loop1): unsupported descriptor size 0 07:14:39 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00t\x00\x00\x00\x00\x00', 0xfffffffffffffffe) 07:14:39 executing program 1: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000180)='./file1\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="20000000360000001900000060008f000ff68f01000011000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}], 0x0, &(0x7f0000000140)={[{@jqfmt_vfsv0}]}) 07:14:39 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00z\x00\x00\x00\x00\x00', 0xfffffffffffffffe) [ 949.633666][ T5431] loop4: detected capacity change from 0 to 16 07:14:39 executing program 3: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000, 0x0, 0xffffffffff600000}]) [ 949.687345][ T5442] loop1: detected capacity change from 0 to 4 [ 949.723088][ T5442] EXT4-fs (loop1): Quota format mount options ignored when QUOTA feature is enabled [ 949.732502][ T5442] EXT4-fs (loop1): unsupported descriptor size 0 07:14:39 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x100, 0x0}) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x28000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_config_ext={0x5, 0x8}, 0x4000, 0x0, 0x9, 0x7, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000001440)) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r1, 0xd000943e, 0x0) clone(0x40808000, 0x0, 0x0, 0x0, 0x0) r2 = gettid() tkill(r2, 0x1e) r3 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x10, r3, 0x0) ptrace$cont(0x18, 0x0, 0x0, 0x1) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ptrace$cont(0x7, 0x0, 0x0, 0x10001) openat$full(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x2, 0x80, 0x4, 0x4, 0xe0, 0xb, 0x0, 0x0, 0x8000, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x8004, 0x2, @perf_bp={0x0}, 0x4000, 0x8000, 0xfffffff9, 0x7, 0x80000001, 0x8, 0x0, 0x0, 0xa, 0x0, 0x100000000}, r2, 0x8, 0xffffffffffffffff, 0x6ee4ca8bd5713173) 07:14:39 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x03\x00\x00\x00\x00', 0xfffffffffffffffe) 07:14:39 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x05\x00\x00\x00\x00', 0xfffffffffffffffe) [ 949.798830][ T5442] loop1: detected capacity change from 0 to 4 [ 949.813709][ C1] sd 0:0:1:0: [sg0] tag#5654 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 949.816387][ T5464] loop3: detected capacity change from 0 to 16 [ 949.824091][ C1] sd 0:0:1:0: [sg0] tag#5654 CDB: opcode=0xe5 (vendor) [ 949.831612][ T5442] EXT4-fs (loop1): Quota format mount options ignored when QUOTA feature is enabled [ 949.837089][ C1] sd 0:0:1:0: [sg0] tag#5654 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 949.837110][ C1] sd 0:0:1:0: [sg0] tag#5654 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 949.846466][ T5442] EXT4-fs (loop1): unsupported descriptor size 0 [ 949.855989][ C1] sd 0:0:1:0: [sg0] tag#5654 CDB[20]: ba 07:14:40 executing program 4: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x1600d}]) 07:14:40 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x06\x00\x00\x00\x00', 0xfffffffffffffffe) 07:14:40 executing program 1: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000180)='./file1\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="20000000360000001900000060008f000ff68f01000012000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}], 0x0, &(0x7f0000000140)={[{@jqfmt_vfsv0}]}) [ 950.053921][ T5499] loop1: detected capacity change from 0 to 4 [ 950.077211][ T5499] EXT4-fs (loop1): Quota format mount options ignored when QUOTA feature is enabled [ 950.086626][ T5499] EXT4-fs (loop1): unsupported descriptor size 0 [ 950.136159][ T5499] loop1: detected capacity change from 0 to 4 [ 950.146365][ T5512] loop4: detected capacity change from 0 to 16 [ 950.160496][ T5499] EXT4-fs (loop1): Quota format mount options ignored when QUOTA feature is enabled [ 950.170114][ T5499] EXT4-fs (loop1): unsupported descriptor size 0 07:14:40 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\a\x00\x00\x00\x00', 0xfffffffffffffffe) 07:14:40 executing program 3: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000, 0x0, 0xfffffffffffffdef}]) 07:14:40 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x100, 0x0}) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x28000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_config_ext={0x5, 0x8}, 0x4000, 0x0, 0x9, 0x7, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000001440)) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r1, 0xd000943e, 0x0) clone(0x40808000, 0x0, 0x0, 0x0, 0x0) r2 = gettid() tkill(r2, 0x1e) r3 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x10, r3, 0x0) ptrace$cont(0x18, 0x0, 0x0, 0x1) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ptrace$cont(0x7, 0x0, 0x0, 0x10001) openat$full(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x2, 0x80, 0x4, 0x4, 0xe0, 0xb, 0x0, 0x0, 0x8000, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x8004, 0x2, @perf_bp={0x0}, 0x4000, 0x8000, 0xfffffff9, 0x7, 0x80000001, 0x8, 0x0, 0x0, 0xa, 0x0, 0x100000000}, r2, 0x8, 0xffffffffffffffff, 0x6ee4ca8bd5713173) 07:14:40 executing program 1: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000180)='./file1\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="20000000360000001900000060008f000ff68f01000022000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}], 0x0, &(0x7f0000000140)={[{@jqfmt_vfsv0}]}) 07:14:40 executing program 4: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16010}]) [ 950.464641][ T5534] loop1: detected capacity change from 0 to 4 [ 950.469663][ C1] sd 0:0:1:0: [sg0] tag#5657 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 950.481098][ C1] sd 0:0:1:0: [sg0] tag#5657 CDB: opcode=0xe5 (vendor) [ 950.485541][ T5534] EXT4-fs (loop1): Quota format mount options ignored when QUOTA feature is enabled [ 950.487981][ C1] sd 0:0:1:0: [sg0] tag#5657 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 950.497337][ T5534] EXT4-fs (loop1): unsupported descriptor size 0 07:14:40 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\t\x00\x00\x00\x00', 0xfffffffffffffffe) [ 950.506858][ C1] sd 0:0:1:0: [sg0] tag#5657 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 950.522710][ C1] sd 0:0:1:0: [sg0] tag#5657 CDB[20]: ba [ 950.533664][ T5537] loop3: detected capacity change from 0 to 16 07:14:40 executing program 0: syz_mount_image$vfat(&(0x7f00000002c0), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f736617e43c00088020000200000004f8000020004000000000000000000001", 0x25}, {0x0, 0x0, 0x200000000011000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6900) ftruncate(r0, 0x800) lseek(r0, 0x1200, 0x0) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x268000, 0x0) sendfile(0xffffffffffffffff, r1, 0x0, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @private2}, 0x1c) sendfile(r0, r1, 0x0, 0x108d1521) r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_FEATURES_SET(r2, 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHGPRL(0xffffffffffffffff, 0x89f7, &(0x7f00000001c0)={'ip6tnl0\x00', 0x0}) ioctl$sock_ipv6_tunnel_SIOCGETPRL(r0, 0x89f4, &(0x7f0000000400)={'syztnl2\x00', &(0x7f0000000380)={'sit0\x00', 0x0, 0x2f, 0x9, 0x6, 0x7250, 0x0, @ipv4={'\x00', '\xff\xff', @remote}, @empty, 0x20, 0x7, 0xfffffff8, 0x4}}) sendmsg$ETHTOOL_MSG_STRSET_GET(0xffffffffffffffff, &(0x7f0000000640)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000600)={&(0x7f0000000500)={0xc4, 0x0, 0x4, 0x70bd2b, 0x25dfdbfc, {}, [@ETHTOOL_A_STRSET_COUNTS_ONLY={0x4}, @ETHTOOL_A_STRSET_STRINGSETS={0x74, 0x2, 0x0, 0x1, [{0x14, 0x1, 0x0, 0x1, [@ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x8}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x8}]}, {0x14, 0x1, 0x0, 0x1, [@ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x3}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x1}]}, {0x14, 0x1, 0x0, 0x1, [@ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x6}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x7}]}, {0x34, 0x1, 0x0, 0x1, [@ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x5}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x3}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x7}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x6}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x6}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x3}]}]}, @ETHTOOL_A_STRSET_HEADER={0x4}, @ETHTOOL_A_STRSET_HEADER={0x14, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}]}, @ETHTOOL_A_STRSET_COUNTS_ONLY={0x4}, @ETHTOOL_A_STRSET_HEADER={0x1c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_FLAGS={0x8}]}]}, 0xc4}, 0x1, 0x0, 0x0, 0x81}, 0x51) sendmsg$ETHTOOL_MSG_LINKINFO_GET(0xffffffffffffffff, 0x0, 0x0) sendfile(r0, r1, 0x0, 0x8400fffffffa) close(0xffffffffffffffff) 07:14:40 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\n\x00\x00\x00\x00', 0xfffffffffffffffe) 07:14:40 executing program 0: syz_mount_image$vfat(&(0x7f00000002c0), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f736617e43c00088020000200000004f8000020004000000000000000000001", 0x25}, {0x0, 0x0, 0x200000000011000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6900) ftruncate(r0, 0x800) lsetxattr(&(0x7f0000000080)='./bus/file0\x00', &(0x7f0000000140)=@known='user.syz\x00', &(0x7f0000000180)='vfat\x00', 0x5, 0x1) lseek(r0, 0x8, 0x1) fallocate(r0, 0x44, 0x92, 0x7) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, r1, 0x0, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @private2}, 0x1c) sendfile(r0, r1, 0x0, 0x108d1521) r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_FEATURES_SET(r2, 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHGPRL(r1, 0x89f7, &(0x7f00000001c0)={'ip6tnl0\x00', 0x0}) sendmsg$ETHTOOL_MSG_LINKINFO_GET(0xffffffffffffffff, 0x0, 0x0) sendfile(r0, r1, 0x0, 0x8400fffffffa) close(0xffffffffffffffff) 07:14:40 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\v\x00\x00\x00\x00', 0xfffffffffffffffe) 07:14:40 executing program 3: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000, 0x0, 0xffffffffffffffef}]) [ 950.746610][ T5534] loop1: detected capacity change from 0 to 4 [ 950.782366][ T5534] EXT4-fs (loop1): Quota format mount options ignored when QUOTA feature is enabled 07:14:40 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x100, 0x0}) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x28000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_config_ext={0x5, 0x8}, 0x4000, 0x0, 0x9, 0x7, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000001440)) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r1, 0xd000943e, 0x0) clone(0x40808000, 0x0, 0x0, 0x0, 0x0) r2 = gettid() tkill(r2, 0x1e) r3 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x10, r3, 0x0) ptrace$cont(0x18, 0x0, 0x0, 0x1) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ptrace$cont(0x7, 0x0, 0x0, 0x10001) openat$full(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x2, 0x80, 0x4, 0x4, 0xe0, 0xb, 0x0, 0x0, 0x8000, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x8004, 0x2, @perf_bp={0x0}, 0x4000, 0x8000, 0xfffffff9, 0x7, 0x80000001, 0x8, 0x0, 0x0, 0xa, 0x0, 0x100000000}, r2, 0x8, 0xffffffffffffffff, 0x6ee4ca8bd5713173) 07:14:40 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\f\x00\x00\x00\x00', 0xfffffffffffffffe) [ 950.791789][ T5534] EXT4-fs (loop1): unsupported descriptor size 0 07:14:41 executing program 0: r0 = syz_mount_image$vfat(&(0x7f00000002c0), &(0x7f0000000100)='./file0\x00', 0x800000000000000, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f736617e43c00088020000200000004f8000020004000000000000000000001", 0x25}, {0x0, 0x0, 0x200000000011000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r1 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6900) ftruncate(r1, 0x800) lsetxattr$trusted_overlay_redirect(&(0x7f0000000340)='./file0\x00', &(0x7f0000000380), &(0x7f00000003c0)='./file0\x00', 0x8, 0x2) execve(&(0x7f0000000080)='./bus\x00', &(0x7f0000000500)=[&(0x7f0000000240)='!o\\,\xca;\xac\x00\x82?\x03\xd2\xad\xff\xc3\xdc\xa2/.\x910\xa1\xd2xu\x9a`\x88V\xcc\x0euE2f\xd4\r\xe6\xba/\x16\x9a\xc9J\xfa\xa5\xbdG\xb3\xe8\xbc\xd5G5\x052\x88-\x18R!*\x89\xb0\xa5\f\x83\x05\xc5\x83_\x04\x00\x00\x00\xf3\xbb\xa9l\xbcg\xb0\xd0I\xa0C\x81\x85\x90\xa9\xc2\xb7/R\x9b\x9a\xa1I-\x98Y\xab1', &(0x7f0000000180)='\x00', &(0x7f0000000540)='#-\x00%\x1d!\xd1\xc8oO\xbch$\x18\xb5\xd6C\xe4k,\xf5\'Q\xdaQU\xb7\xbb\xdc\x87\x7f*pg\xda\xe5\x89-\x1b:>j\x14\xa3\xa6\x8b\x80\xfb\xc7\xf5\x01hH\xfbh\xb5#\v\xc3\xdf', &(0x7f0000000580)='\x00\x00\x00\x00\x00\x00RUP\n\xa2\xba\xc4\x10O\x97\x8dM\xc8\xba\x1f\xa3\xfe\xc9\xfc\x18\x98\xb2_|\x94`\xabF\xdbTy\xbc0\x12A=rZ[\xabd\xeb\xa6/\x9c\x0e`Q-\r\xbd\xedAykk\xf1`\x89j\xb6\xcbi\xf8\t:;\x19\x10KA\xa6\xdeIz\xdfV\x1b\xf4\x87\xffH5\xfa\xd2l\xe8\xfc\x9e{\xf1\x10\xf2\xfc\x15>\x86y/\xcc\xbb\x90\x0e{4\xe8\x98%\xe1}nR_x\xa6\xa6\xb0g^\xc1\xa8\xe2\x81\x86=\xfa\xe6+Ez\xb8\xa4\a^J\xbam\x86\xda^\xf2\xae\x9f^!Bx\"W\xb7\xa6\xa5\xbe\xdd\xa8\x00\xbf\xdc\x02\xa2', &(0x7f00000004c0)='&(\x00'], &(0x7f0000000340)) r2 = open(&(0x7f0000000000)='./bus\x00', 0x121282, 0x0) ioctl$FS_IOC_SETFLAGS(0xffffffffffffffff, 0x40086602, &(0x7f00000000c0)=0x100) sendfile(0xffffffffffffffff, r0, 0x0, 0xfffffffffffffff7) r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) bind$inet6(r3, &(0x7f0000000300)={0xa, 0x4e24, 0x107, @remote}, 0x1c) sendfile(r1, r2, 0x0, 0x108d1521) r4 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(0x0, r1) sendmsg$ETHTOOL_MSG_FEATURES_SET(r4, 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHGPRL(0xffffffffffffffff, 0x89f7, &(0x7f00000001c0)={'ip6tnl0\x00', 0x0}) sendmsg$ETHTOOL_MSG_LINKINFO_GET(0xffffffffffffffff, 0x0, 0x0) sendfile(r1, r2, 0x0, 0x8400fffffffa) close(0xffffffffffffffff) [ 950.847909][ C1] sd 0:0:1:0: [sg0] tag#5658 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 950.858294][ C1] sd 0:0:1:0: [sg0] tag#5658 CDB: opcode=0xe5 (vendor) [ 950.865161][ C1] sd 0:0:1:0: [sg0] tag#5658 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 950.874741][ C1] sd 0:0:1:0: [sg0] tag#5658 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 950.884310][ C1] sd 0:0:1:0: [sg0] tag#5658 CDB[20]: ba 07:14:41 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\r\x00\x00\x00\x00', 0xfffffffffffffffe) [ 950.898873][ T5596] loop3: detected capacity change from 0 to 16 07:14:41 executing program 1: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000180)='./file1\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="20000000360000001900000060008f000ff68f01000025000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}], 0x0, &(0x7f0000000140)={[{@jqfmt_vfsv0}]}) [ 951.017713][ T5620] loop1: detected capacity change from 0 to 4 [ 951.050109][ T5620] EXT4-fs (loop1): Quota format mount options ignored when QUOTA feature is enabled [ 951.059540][ T5620] EXT4-fs (loop1): unsupported descriptor size 0 [ 951.079011][ T5630] loop4: detected capacity change from 0 to 16 [ 951.104209][ T5620] loop1: detected capacity change from 0 to 4 [ 951.113128][ T5620] EXT4-fs (loop1): Quota format mount options ignored when QUOTA feature is enabled [ 951.122546][ T5620] EXT4-fs (loop1): unsupported descriptor size 0 07:14:41 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x0e\x00\x00\x00\x00', 0xfffffffffffffffe) 07:14:41 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x100, 0x0}) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x28000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_config_ext={0x5, 0x8}, 0x4000, 0x0, 0x9, 0x7, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000001440)) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r1, 0xd000943e, 0x0) clone(0x40808000, 0x0, 0x0, 0x0, 0x0) r2 = gettid() tkill(r2, 0x1e) r3 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, 0xffffffffffffffff, 0x0) ptrace$cont(0x18, 0x0, 0x0, 0x1) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ptrace$cont(0x7, 0x0, 0x0, 0x10001) openat$full(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x2, 0x80, 0x4, 0x4, 0xe0, 0xb, 0x0, 0x0, 0x8000, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x8004, 0x2, @perf_bp={0x0}, 0x4000, 0x8000, 0xfffffff9, 0x7, 0x80000001, 0x8, 0x0, 0x0, 0xa, 0x0, 0x100000000}, r2, 0x8, 0xffffffffffffffff, 0x6ee4ca8bd5713173) 07:14:41 executing program 0: syz_mount_image$vfat(&(0x7f00000002c0), &(0x7f0000000100)='./file1\x00', 0x0, 0x0, &(0x7f0000000200), 0x72000, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000080)='./file2\x00', 0x18) fcntl$setstatus(r0, 0x4, 0x6900) ftruncate(r0, 0x800) lseek(r0, 0x0, 0x0) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x141, 0x80) sendfile(0xffffffffffffffff, r1, 0x0, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x7ffffffe, @private2, 0x200001}, 0x1c) sendfile(r0, r1, 0x0, 0x108d1521) r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_FEATURES_SET(r2, 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHGPRL(0xffffffffffffffff, 0x89f7, &(0x7f00000001c0)={'ip6tnl0\x00', 0x0}) fcntl$dupfd(r2, 0x406, r2) sendmsg$ETHTOOL_MSG_LINKINFO_GET(0xffffffffffffffff, 0x0, 0x4004040) ioctl$FS_IOC_FIEMAP(0xffffffffffffffff, 0xc020660b, &(0x7f0000000580)=ANY=[]) sendfile(r0, r1, 0x0, 0x8400fffffffa) close(0xffffffffffffffff) 07:14:41 executing program 4: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x17000}]) 07:14:41 executing program 3: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000, 0x0, 0xfffffffffffffff2}]) 07:14:41 executing program 1: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000180)='./file1\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="20000000360000001900000060008f000ff68f01000028000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}], 0x0, &(0x7f0000000140)={[{@jqfmt_vfsv0}]}) [ 951.223256][ T5657] loop1: detected capacity change from 0 to 4 [ 951.226485][ C0] sd 0:0:1:0: [sg0] tag#5659 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 951.229824][ T5659] loop3: detected capacity change from 0 to 16 [ 951.239692][ C0] sd 0:0:1:0: [sg0] tag#5659 CDB: opcode=0xe5 (vendor) [ 951.249241][ T5657] EXT4-fs (loop1): Quota format mount options ignored when QUOTA feature is enabled [ 951.252812][ C0] sd 0:0:1:0: [sg0] tag#5659 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c 07:14:41 executing program 0: syz_mount_image$vfat(&(0x7f00000002c0), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="601c6d6b646f736617e43c00088020000200000004f8000020004000000000000000000001", 0x25}, {0x0, 0x0, 0x200000000011000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6900) ftruncate(r0, 0x800) lseek(r0, 0x1200, 0x0) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, r1, 0x0, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @private2}, 0x1c) sendfile(r0, r1, 0x0, 0x108d1521) r2 = socket$nl_generic(0x10, 0x3, 0x10) getsockopt$inet_buf(0xffffffffffffffff, 0x0, 0x2e, &(0x7f0000001300)=""/4079, &(0x7f0000000080)=0xfef) dup3(0xffffffffffffffff, r0, 0x80000) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_FEATURES_SET(r2, 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHGPRL(0xffffffffffffffff, 0x89f7, &(0x7f00000001c0)={'ip6tnl0\x00', 0x0}) sendmsg$ETHTOOL_MSG_LINKINFO_GET(0xffffffffffffffff, 0x0, 0x0) sendfile(r0, r1, 0x0, 0x8400fffffffa) close(0xffffffffffffffff) [ 951.252834][ C0] sd 0:0:1:0: [sg0] tag#5659 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 951.262345][ T5657] EXT4-fs (loop1): unsupported descriptor size 0 [ 951.271819][ C0] sd 0:0:1:0: [sg0] tag#5659 CDB[20]: ba 07:14:41 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x0f\x00\x00\x00\x00', 0xfffffffffffffffe) 07:14:41 executing program 1: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000180)='./file1\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="20000000360000001900000060008f000ff68f0100002e000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}], 0x0, &(0x7f0000000140)={[{@jqfmt_vfsv0}]}) 07:14:41 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x11\x00\x00\x00\x00', 0xfffffffffffffffe) [ 951.343902][ T5657] loop1: detected capacity change from 0 to 4 [ 951.368167][ T5657] EXT4-fs (loop1): Quota format mount options ignored when QUOTA feature is enabled [ 951.377645][ T5657] EXT4-fs (loop1): unsupported descriptor size 0 07:14:41 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x100, 0x0}) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x28000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_config_ext={0x5, 0x8}, 0x4000, 0x0, 0x9, 0x7, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000001440)) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r1, 0xd000943e, 0x0) clone(0x40808000, 0x0, 0x0, 0x0, 0x0) r2 = gettid() tkill(r2, 0x1e) r3 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, 0xffffffffffffffff, 0x0) ptrace$cont(0x18, 0x0, 0x0, 0x1) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ptrace$cont(0x7, 0x0, 0x0, 0x10001) openat$full(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x2, 0x80, 0x4, 0x4, 0xe0, 0xb, 0x0, 0x0, 0x8000, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x8004, 0x2, @perf_bp={0x0}, 0x4000, 0x8000, 0xfffffff9, 0x7, 0x80000001, 0x8, 0x0, 0x0, 0xa, 0x0, 0x100000000}, r2, 0x8, 0xffffffffffffffff, 0x6ee4ca8bd5713173) 07:14:41 executing program 3: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000, 0x0, 0xffffffffffffffff}]) [ 951.446149][ C1] sd 0:0:1:0: [sg0] tag#5632 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 951.456516][ C1] sd 0:0:1:0: [sg0] tag#5632 CDB: opcode=0xe5 (vendor) [ 951.463380][ C1] sd 0:0:1:0: [sg0] tag#5632 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 951.472388][ T5691] loop1: detected capacity change from 0 to 4 [ 951.472933][ C1] sd 0:0:1:0: [sg0] tag#5632 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 951.488480][ C1] sd 0:0:1:0: [sg0] tag#5632 CDB[20]: ba 07:14:41 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x12\x00\x00\x00\x00', 0xfffffffffffffffe) [ 951.509451][ T5691] EXT4-fs (loop1): Quota format mount options ignored when QUOTA feature is enabled [ 951.518910][ T5691] EXT4-fs (loop1): unsupported descriptor size 0 07:14:41 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x100, 0x0}) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x28000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_config_ext={0x5, 0x8}, 0x4000, 0x0, 0x9, 0x7, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000001440)) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r1, 0xd000943e, 0x0) clone(0x40808000, 0x0, 0x0, 0x0, 0x0) r2 = gettid() tkill(r2, 0x1e) r3 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, 0xffffffffffffffff, 0x0) ptrace$cont(0x18, 0x0, 0x0, 0x1) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ptrace$cont(0x7, 0x0, 0x0, 0x10001) openat$full(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x2, 0x80, 0x4, 0x4, 0xe0, 0xb, 0x0, 0x0, 0x8000, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x8004, 0x2, @perf_bp={0x0}, 0x4000, 0x8000, 0xfffffff9, 0x7, 0x80000001, 0x8, 0x0, 0x0, 0xa, 0x0, 0x100000000}, r2, 0x8, 0xffffffffffffffff, 0x6ee4ca8bd5713173) [ 951.595489][ T5691] loop1: detected capacity change from 0 to 4 [ 951.606503][ T5691] EXT4-fs (loop1): Quota format mount options ignored when QUOTA feature is enabled [ 951.615932][ T5691] EXT4-fs (loop1): unsupported descriptor size 0 [ 951.623795][ C0] sd 0:0:1:0: [sg0] tag#5665 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 951.634161][ C0] sd 0:0:1:0: [sg0] tag#5665 CDB: opcode=0xe5 (vendor) 07:14:41 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00H\x00\x00\x00\x00', 0xfffffffffffffffe) [ 951.641001][ C0] sd 0:0:1:0: [sg0] tag#5665 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 951.650556][ C0] sd 0:0:1:0: [sg0] tag#5665 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 951.656168][ T5726] loop4: detected capacity change from 0 to 16 [ 951.660125][ C0] sd 0:0:1:0: [sg0] tag#5665 CDB[20]: ba [ 951.670453][ T5724] loop3: detected capacity change from 0 to 16 [ 951.750521][ T5726] attempt to access beyond end of device [ 951.750521][ T5726] loop4: rw=34817, want=192, limit=16 07:14:42 executing program 4: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x10099b8}]) 07:14:42 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00L\x00\x00\x00\x00', 0xfffffffffffffffe) 07:14:42 executing program 1: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000180)='./file1\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="20000000360000001900000060008f000ff68f0100002f000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}], 0x0, &(0x7f0000000140)={[{@jqfmt_vfsv0}]}) [ 951.900519][ T5761] loop1: detected capacity change from 0 to 4 [ 951.913023][ T5761] EXT4-fs (loop1): Quota format mount options ignored when QUOTA feature is enabled [ 951.922430][ T5761] EXT4-fs (loop1): unsupported descriptor size 0 [ 951.956792][ T5773] loop4: detected capacity change from 0 to 16 [ 951.972658][ T5761] loop1: detected capacity change from 0 to 4 [ 951.980798][ T5761] EXT4-fs (loop1): Quota format mount options ignored when QUOTA feature is enabled [ 951.990204][ T5761] EXT4-fs (loop1): unsupported descriptor size 0 07:14:42 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x100, 0x0}) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x28000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_config_ext={0x5, 0x8}, 0x4000, 0x0, 0x9, 0x7, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000001440)) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r1, 0xd000943e, 0x0) clone(0x40808000, 0x0, 0x0, 0x0, 0x0) r2 = gettid() tkill(r2, 0x1e) r3 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r3, 0x0) ptrace$cont(0xffffffffffffffff, 0x0, 0x0, 0x1) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ptrace$cont(0x7, 0x0, 0x0, 0x10001) openat$full(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x2, 0x80, 0x4, 0x4, 0xe0, 0xb, 0x0, 0x0, 0x8000, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x8004, 0x2, @perf_bp={0x0}, 0x4000, 0x8000, 0xfffffff9, 0x7, 0x80000001, 0x8, 0x0, 0x0, 0xa, 0x0, 0x100000000}, r2, 0x8, 0xffffffffffffffff, 0x6ee4ca8bd5713173) 07:14:42 executing program 3: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000}]) 07:14:42 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00h\x00\x00\x00\x00', 0xfffffffffffffffe) 07:14:42 executing program 1: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000180)='./file1\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="20000000360000001900000060008f000ff68f01000030000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}], 0x0, &(0x7f0000000140)={[{@jqfmt_vfsv0}]}) 07:14:42 executing program 0: syz_mount_image$vfat(&(0x7f00000002c0), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f736617e43c00088020000200000004f8000020004000000000000000000001", 0x25}, {0x0, 0x0, 0x200000000011000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6900) ftruncate(r0, 0x800) lseek(r0, 0x1200, 0x0) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, r1, 0x0, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @private2}, 0x1c) sendfile(r0, r1, 0x0, 0x108d1521) r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_FEATURES_SET(r2, 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHGPRL(r1, 0x89f7, &(0x7f00000001c0)={'ip6tnl0\x00', 0x0}) sendmsg$ETHTOOL_MSG_LINKINFO_GET(0xffffffffffffffff, 0x0, 0x0) r3 = socket$inet(0x2, 0x1, 0x3) sendto$inet(r3, 0x0, 0x0, 0x24000884, &(0x7f0000000240)={0x2, 0x0, @loopback}, 0x10) sendfile(r1, r3, 0x0, 0x8400fffffffc) close(0xffffffffffffffff) 07:14:42 executing program 4: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x8800000}]) [ 952.315198][ T5796] loop1: detected capacity change from 0 to 4 [ 952.318088][ T5798] loop3: detected capacity change from 0 to 16 [ 952.336602][ T5796] EXT4-fs (loop1): Quota format mount options ignored when QUOTA feature is enabled [ 952.346054][ T5796] EXT4-fs (loop1): unsupported descriptor size 0 [ 952.359741][ T5798] attempt to access beyond end of device 07:14:42 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00l\x00\x00\x00\x00', 0xfffffffffffffffe) [ 952.359741][ T5798] loop3: rw=34817, want=184, limit=16 [ 952.375110][ T5813] loop4: detected capacity change from 0 to 16 [ 952.395266][ T5796] loop1: detected capacity change from 0 to 4 07:14:42 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x100, 0x0}) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x28000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_config_ext={0x5, 0x8}, 0x4000, 0x0, 0x9, 0x7, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000001440)) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r1, 0xd000943e, 0x0) clone(0x40808000, 0x0, 0x0, 0x0, 0x0) r2 = gettid() tkill(r2, 0x1e) r3 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r3, 0x0) ptrace$cont(0xffffffffffffffff, 0x0, 0x0, 0x1) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ptrace$cont(0x7, 0x0, 0x0, 0x10001) openat$full(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x2, 0x80, 0x4, 0x4, 0xe0, 0xb, 0x0, 0x0, 0x8000, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x8004, 0x2, @perf_bp={0x0}, 0x4000, 0x8000, 0xfffffff9, 0x7, 0x80000001, 0x8, 0x0, 0x0, 0xa, 0x0, 0x100000000}, r2, 0x8, 0xffffffffffffffff, 0x6ee4ca8bd5713173) [ 952.407863][ T5796] EXT4-fs (loop1): Quota format mount options ignored when QUOTA feature is enabled [ 952.417362][ T5796] EXT4-fs (loop1): unsupported descriptor size 0 07:14:42 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00t\x00\x00\x00\x00', 0xfffffffffffffffe) 07:14:42 executing program 1: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000180)='./file1\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="20000000360000001900000060008f000ff68f01000031000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}], 0x0, &(0x7f0000000140)={[{@jqfmt_vfsv0}]}) 07:14:42 executing program 3: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000, 0x0, 0x0, 0x2}]) 07:14:42 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x100, 0x0}) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x28000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_config_ext={0x5, 0x8}, 0x4000, 0x0, 0x9, 0x7, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000001440)) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r1, 0xd000943e, 0x0) clone(0x40808000, 0x0, 0x0, 0x0, 0x0) r2 = gettid() tkill(r2, 0x1e) r3 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r3, 0x0) ptrace$cont(0xffffffffffffffff, 0x0, 0x0, 0x1) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ptrace$cont(0x7, 0x0, 0x0, 0x10001) openat$full(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x2, 0x80, 0x4, 0x4, 0xe0, 0xb, 0x0, 0x0, 0x8000, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x8004, 0x2, @perf_bp={0x0}, 0x4000, 0x8000, 0xfffffff9, 0x7, 0x80000001, 0x8, 0x0, 0x0, 0xa, 0x0, 0x100000000}, r2, 0x8, 0xffffffffffffffff, 0x6ee4ca8bd5713173) [ 952.523719][ T5850] loop1: detected capacity change from 0 to 4 [ 952.534660][ T5850] EXT4-fs (loop1): Quota format mount options ignored when QUOTA feature is enabled [ 952.544069][ T5850] EXT4-fs (loop1): unsupported descriptor size 0 07:14:42 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00z\x00\x00\x00\x00', 0xfffffffffffffffe) [ 952.576715][ T5864] loop3: detected capacity change from 0 to 16 [ 952.588441][ T5850] loop1: detected capacity change from 0 to 4 [ 952.615612][ T5850] EXT4-fs (loop1): Quota format mount options ignored when QUOTA feature is enabled [ 952.625147][ T5850] EXT4-fs (loop1): unsupported descriptor size 0 07:14:42 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\xff\xff\xfe\x00\x00\x00', 0xfffffffffffffffe) [ 952.665071][ T5864] attempt to access beyond end of device [ 952.665071][ T5864] loop3: rw=34817, want=184, limit=16 07:14:42 executing program 1: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000180)='./file1\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="20000000360000001900000060008f000ff68f01000048000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}], 0x0, &(0x7f0000000140)={[{@jqfmt_vfsv0}]}) 07:14:42 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\x01\x00\x00', 0xfffffffffffffffe) [ 952.825396][ T5903] loop1: detected capacity change from 0 to 4 [ 952.846346][ T5903] EXT4-fs (loop1): Quota format mount options ignored when QUOTA feature is enabled [ 952.855778][ T5903] EXT4-fs (loop1): unsupported descriptor size 0 [ 952.901231][ T5903] loop1: detected capacity change from 0 to 4 [ 952.910214][ T5903] EXT4-fs (loop1): Quota format mount options ignored when QUOTA feature is enabled [ 952.919630][ T5903] EXT4-fs (loop1): unsupported descriptor size 0 07:14:43 executing program 3: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000, 0x0, 0x0, 0x3}]) 07:14:43 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x100, 0x0}) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x28000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_config_ext={0x5, 0x8}, 0x4000, 0x0, 0x9, 0x7, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000001440)) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r1, 0xd000943e, 0x0) clone(0x40808000, 0x0, 0x0, 0x0, 0x0) r2 = gettid() tkill(r2, 0x1e) r3 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r3, 0x0) ptrace$cont(0x18, 0x0, 0x0, 0x0) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ptrace$cont(0x7, 0x0, 0x0, 0x10001) openat$full(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x2, 0x80, 0x4, 0x4, 0xe0, 0xb, 0x0, 0x0, 0x8000, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x8004, 0x2, @perf_bp={0x0}, 0x4000, 0x8000, 0xfffffff9, 0x7, 0x80000001, 0x8, 0x0, 0x0, 0xa, 0x0, 0x100000000}, r2, 0x8, 0xffffffffffffffff, 0x6ee4ca8bd5713173) 07:14:43 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\x02\x00\x00', 0xfffffffffffffffe) 07:14:43 executing program 4: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x20016002}]) 07:14:43 executing program 0: syz_mount_image$vfat(&(0x7f00000002c0), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f736617e43c00088020000200000004f8000020004000000000000000000001", 0x25, 0x4}, {0x0, 0x0, 0x200000000011000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6900) ftruncate(r0, 0x800) lseek(r0, 0x1200, 0x0) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, r1, 0x0, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @private2}, 0x1c) sendfile(r0, r1, 0x0, 0x108d1521) r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_FEATURES_SET(r2, 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHGPRL(0xffffffffffffffff, 0x89f7, &(0x7f00000001c0)={'ip6tnl0\x00', 0x0}) sendmsg$ETHTOOL_MSG_LINKINFO_GET(0xffffffffffffffff, 0x0, 0x0) sendfile(r0, r1, 0x0, 0x8400fffffffa) close(0xffffffffffffffff) 07:14:43 executing program 1: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000180)='./file1\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="20000000360000001900000060008f000ff68f0100004c000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}], 0x0, &(0x7f0000000140)={[{@jqfmt_vfsv0}]}) [ 953.248522][ T5928] loop3: detected capacity change from 0 to 16 [ 953.275050][ T5932] loop1: detected capacity change from 0 to 4 07:14:43 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\x03\x00\x00', 0xfffffffffffffffe) [ 953.297305][ T5932] EXT4-fs (loop1): Quota format mount options ignored when QUOTA feature is enabled [ 953.306792][ T5932] EXT4-fs (loop1): unsupported descriptor size 0 07:14:43 executing program 3: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000, 0x0, 0x0, 0x4}]) 07:14:43 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\x04\x00\x00', 0xfffffffffffffffe) [ 953.355061][ T5954] loop4: detected capacity change from 0 to 16 [ 953.392647][ T5932] loop1: detected capacity change from 0 to 4 [ 953.411923][ T5932] EXT4-fs (loop1): Quota format mount options ignored when QUOTA feature is enabled [ 953.421392][ T5932] EXT4-fs (loop1): unsupported descriptor size 0 07:14:43 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\x05\x00\x00', 0xfffffffffffffffe) 07:14:43 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x100, 0x0}) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x28000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_config_ext={0x5, 0x8}, 0x4000, 0x0, 0x9, 0x7, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000001440)) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r1, 0xd000943e, 0x0) clone(0x40808000, 0x0, 0x0, 0x0, 0x0) r2 = gettid() tkill(r2, 0x1e) r3 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r3, 0x0) ptrace$cont(0x18, 0x0, 0x0, 0x0) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ptrace$cont(0x7, 0x0, 0x0, 0x10001) openat$full(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x2, 0x80, 0x4, 0x4, 0xe0, 0xb, 0x0, 0x0, 0x8000, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x8004, 0x2, @perf_bp={0x0}, 0x4000, 0x8000, 0xfffffff9, 0x7, 0x80000001, 0x8, 0x0, 0x0, 0xa, 0x0, 0x100000000}, r2, 0x8, 0xffffffffffffffff, 0x6ee4ca8bd5713173) [ 953.465040][ T5968] loop3: detected capacity change from 0 to 16 07:14:43 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\x06\x00\x00', 0xfffffffffffffffe) [ 953.529288][ T5968] attempt to access beyond end of device [ 953.529288][ T5968] loop3: rw=34817, want=184, limit=16 [ 953.555955][ C1] scsi_io_completion_action: 4 callbacks suppressed [ 953.555998][ C1] sd 0:0:1:0: [sg0] tag#5652 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s 07:14:43 executing program 1: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000180)='./file1\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="20000000360000001900000060008f000ff68f01000060000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}], 0x0, &(0x7f0000000140)={[{@jqfmt_vfsv0}]}) 07:14:43 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\a\x00\x00', 0xfffffffffffffffe) [ 953.572943][ C1] sd 0:0:1:0: [sg0] tag#5652 CDB: opcode=0xe5 (vendor) [ 953.579794][ C1] sd 0:0:1:0: [sg0] tag#5652 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 953.589348][ C1] sd 0:0:1:0: [sg0] tag#5652 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 953.598924][ C1] sd 0:0:1:0: [sg0] tag#5652 CDB[20]: ba 07:14:43 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\b\x00\x00', 0xfffffffffffffffe) [ 953.785257][ T6016] loop1: detected capacity change from 0 to 4 [ 953.796862][ T6016] EXT4-fs (loop1): Quota format mount options ignored when QUOTA feature is enabled [ 953.806275][ T6016] EXT4-fs (loop1): unsupported descriptor size 0 [ 953.844099][ T6016] loop1: detected capacity change from 0 to 4 [ 953.858444][ T6016] EXT4-fs (loop1): Quota format mount options ignored when QUOTA feature is enabled [ 953.867977][ T6016] EXT4-fs (loop1): unsupported descriptor size 0 07:14:44 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\t\x00\x00', 0xfffffffffffffffe) 07:14:44 executing program 0: syz_mount_image$vfat(&(0x7f00000002c0), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f736617e43c00088020000200000004f8000020004000000000000000000001", 0x25}, {0x0, 0x0, 0x200000000011000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6900) ftruncate(r0, 0x800) lseek(r0, 0x1200, 0x0) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, r1, 0x0, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @private2}, 0x1c) sendfile(r0, r1, 0x0, 0x108d1521) r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_FEATURES_SET(r2, 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHGPRL(0xffffffffffffffff, 0x89f7, &(0x7f00000001c0)={'ip6tnl0\x00', 0x0}) sendmsg$ETHTOOL_MSG_LINKINFO_GET(0xffffffffffffffff, 0x0, 0x0) sendmsg$ETHTOOL_MSG_CHANNELS_GET(0xffffffffffffffff, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000400)={&(0x7f00000000c0)={0x2c, 0x0, 0x1, 0x0, 0x0, {0x1a}, [@HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'xfrm0\x00'}]}]}, 0x2c}}, 0x0) sendmsg$ETHTOOL_MSG_COALESCE_SET(0xffffffffffffffff, &(0x7f0000000280)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000240)={&(0x7f0000000180)={0x3c, 0x0, 0x8, 0x70bd2a, 0x25dfdbfd, {}, [@ETHTOOL_A_COALESCE_RX_MAX_FRAMES_IRQ={0x8, 0x5, 0xfffffffe}, @ETHTOOL_A_COALESCE_RX_MAX_FRAMES_IRQ={0x8, 0x5, 0x4}, @ETHTOOL_A_COALESCE_TX_USECS={0x8, 0x6, 0xede}, @ETHTOOL_A_COALESCE_USE_ADAPTIVE_TX={0x5}, @ETHTOOL_A_COALESCE_STATS_BLOCK_USECS={0x8, 0xa, 0x10}]}, 0x3c}}, 0x4000004) sendfile(r0, r1, 0x0, 0x8400fffffffa) close(0xffffffffffffffff) 07:14:44 executing program 3: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000, 0x0, 0x0, 0x5}]) 07:14:44 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x100, 0x0}) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x28000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_config_ext={0x5, 0x8}, 0x4000, 0x0, 0x9, 0x7, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000001440)) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r1, 0xd000943e, 0x0) clone(0x40808000, 0x0, 0x0, 0x0, 0x0) r2 = gettid() tkill(r2, 0x1e) r3 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r3, 0x0) ptrace$cont(0x18, 0x0, 0x0, 0x0) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ptrace$cont(0x7, 0x0, 0x0, 0x10001) openat$full(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x2, 0x80, 0x4, 0x4, 0xe0, 0xb, 0x0, 0x0, 0x8000, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x8004, 0x2, @perf_bp={0x0}, 0x4000, 0x8000, 0xfffffff9, 0x7, 0x80000001, 0x8, 0x0, 0x0, 0xa, 0x0, 0x100000000}, r2, 0x8, 0xffffffffffffffff, 0x6ee4ca8bd5713173) 07:14:44 executing program 1: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000180)='./file1\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="20000000360000001900000060008f000ff68f01000068000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}], 0x0, &(0x7f0000000140)={[{@jqfmt_vfsv0}]}) 07:14:44 executing program 4: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x7ffff000}]) 07:14:44 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\n\x00\x00', 0xfffffffffffffffe) [ 954.239825][ T6047] loop1: detected capacity change from 0 to 4 [ 954.250046][ T6047] EXT4-fs (loop1): Quota format mount options ignored when QUOTA feature is enabled [ 954.259520][ T6047] EXT4-fs (loop1): unsupported descriptor size 0 [ 954.265856][ C0] sd 0:0:1:0: [sg0] tag#5657 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 954.276266][ C0] sd 0:0:1:0: [sg0] tag#5657 CDB: opcode=0xe5 (vendor) 07:14:44 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\v\x00\x00', 0xfffffffffffffffe) 07:14:44 executing program 1: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000180)='./file1\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="20000000360000001900000060008f000ff68f0100006c000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}], 0x0, &(0x7f0000000140)={[{@jqfmt_vfsv0}]}) [ 954.283141][ C0] sd 0:0:1:0: [sg0] tag#5657 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 954.292732][ C0] sd 0:0:1:0: [sg0] tag#5657 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 954.302290][ C0] sd 0:0:1:0: [sg0] tag#5657 CDB[20]: ba [ 954.305133][ T6054] loop3: detected capacity change from 0 to 16 07:14:44 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\f\x00\x00', 0xfffffffffffffffe) 07:14:44 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x100, 0x0}) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x28000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_config_ext={0x5, 0x8}, 0x4000, 0x0, 0x9, 0x7, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000001440)) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r1, 0xd000943e, 0x0) clone(0x40808000, 0x0, 0x0, 0x0, 0x0) r2 = gettid() tkill(r2, 0x1e) r3 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r3, 0x0) ptrace$cont(0x18, 0x0, 0x0, 0x1) preadv(0xffffffffffffffff, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ptrace$cont(0x7, 0x0, 0x0, 0x10001) openat$full(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x2, 0x80, 0x4, 0x4, 0xe0, 0xb, 0x0, 0x0, 0x8000, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x8004, 0x2, @perf_bp={0x0}, 0x4000, 0x8000, 0xfffffff9, 0x7, 0x80000001, 0x8, 0x0, 0x0, 0xa, 0x0, 0x100000000}, r2, 0x8, 0xffffffffffffffff, 0x6ee4ca8bd5713173) [ 954.397677][ T6078] loop1: detected capacity change from 0 to 4 [ 954.415670][ T6079] loop4: detected capacity change from 0 to 16 [ 954.428880][ C0] sd 0:0:1:0: [sg0] tag#5659 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 954.439257][ C0] sd 0:0:1:0: [sg0] tag#5659 CDB: opcode=0xe5 (vendor) 07:14:44 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\r\x00\x00', 0xfffffffffffffffe) [ 954.439924][ T6078] EXT4-fs (loop1): Quota format mount options ignored when QUOTA feature is enabled [ 954.446126][ C0] sd 0:0:1:0: [sg0] tag#5659 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 954.446146][ C0] sd 0:0:1:0: [sg0] tag#5659 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 954.455509][ T6078] EXT4-fs (loop1): unsupported descriptor size 0 [ 954.465034][ C0] sd 0:0:1:0: [sg0] tag#5659 CDB[20]: ba 07:14:44 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\x0e\x00\x00', 0xfffffffffffffffe) [ 954.647020][ T6078] loop1: detected capacity change from 0 to 4 [ 954.675414][ T6078] EXT4-fs (loop1): Quota format mount options ignored when QUOTA feature is enabled [ 954.684827][ T6078] EXT4-fs (loop1): unsupported descriptor size 0 07:14:45 executing program 0: chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000180)='./file1\x00', 0x17) fcntl$setstatus(r0, 0x4, 0x6900) ftruncate(r0, 0x800) symlink(&(0x7f0000000100)='./file0\x00', &(0x7f0000000140)='./file1\x00') lseek(r0, 0x11fd, 0x2) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, 0x0, 0xffffffffffffff30) r1 = open(&(0x7f00000000c0)='./file1\x00', 0x4000, 0x80) sendfile(0xffffffffffffffff, r1, 0x0, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @private2}, 0x1c) sendfile(r0, r1, 0x0, 0x108d1521) r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_FEATURES_SET(r2, 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHGPRL(r1, 0x89f7, &(0x7f00000001c0)={'ip6tnl0\x00', 0x0}) sendmsg$ETHTOOL_MSG_LINKINFO_GET(0xffffffffffffffff, 0x0, 0x0) sendfile(r2, r2, 0x0, 0x6) sendfile(r0, r1, 0x0, 0x8400fffffffa) close(0xffffffffffffffff) open(&(0x7f0000000080)='./bus\x00', 0xa800, 0x100) 07:14:45 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\x0f\x00\x00', 0xfffffffffffffffe) 07:14:45 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x100, 0x0}) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x28000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_config_ext={0x5, 0x8}, 0x4000, 0x0, 0x9, 0x7, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000001440)) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r1, 0xd000943e, 0x0) clone(0x40808000, 0x0, 0x0, 0x0, 0x0) r2 = gettid() tkill(r2, 0x1e) r3 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r3, 0x0) ptrace$cont(0x18, 0x0, 0x0, 0x1) preadv(0xffffffffffffffff, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ptrace$cont(0x7, 0x0, 0x0, 0x10001) openat$full(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x2, 0x80, 0x4, 0x4, 0xe0, 0xb, 0x0, 0x0, 0x8000, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x8004, 0x2, @perf_bp={0x0}, 0x4000, 0x8000, 0xfffffff9, 0x7, 0x80000001, 0x8, 0x0, 0x0, 0xa, 0x0, 0x100000000}, r2, 0x8, 0xffffffffffffffff, 0x6ee4ca8bd5713173) 07:14:45 executing program 3: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000, 0x0, 0x0, 0x6}]) 07:14:45 executing program 4: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0xffffffff000}]) 07:14:45 executing program 1: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000180)='./file1\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="20000000360000001900000060008f000ff68f01000074000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}], 0x0, &(0x7f0000000140)={[{@jqfmt_vfsv0}]}) [ 955.230915][ C1] sd 0:0:1:0: [sg0] tag#5668 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 955.238059][ T6131] loop3: detected capacity change from 0 to 16 [ 955.241290][ C1] sd 0:0:1:0: [sg0] tag#5668 CDB: opcode=0xe5 (vendor) [ 955.249212][ T6132] loop1: detected capacity change from 0 to 4 [ 955.254284][ C1] sd 0:0:1:0: [sg0] tag#5668 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 955.254304][ C1] sd 0:0:1:0: [sg0] tag#5668 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d 07:14:45 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\x10\x00\x00', 0xfffffffffffffffe) [ 955.266544][ T6132] EXT4-fs (loop1): Quota format mount options ignored when QUOTA feature is enabled [ 955.269892][ C1] sd 0:0:1:0: [sg0] tag#5668 CDB[20]: ba [ 955.279427][ T6132] EXT4-fs (loop1): unsupported descriptor size 0 07:14:45 executing program 0: syz_mount_image$vfat(&(0x7f00000002c0), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f736617e43c00088020000200000004f8000020004000000000000000000001", 0x25}, {0x0, 0x0, 0x200000000011000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6900) ftruncate(r0, 0x800) lseek(r0, 0x1200, 0x0) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, r1, 0x0, 0x0) bind$inet6(r1, &(0x7f0000000000)={0xa, 0x0, 0x0, @private2}, 0x1c) sendfile(r0, r1, 0x0, 0x108d1521) r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_FEATURES_SET(r2, 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHGPRL(0xffffffffffffffff, 0x89f7, &(0x7f00000001c0)={'ip6tnl0\x00', 0x0}) sendmsg$ETHTOOL_MSG_LINKINFO_GET(0xffffffffffffffff, 0x0, 0x0) sendfile(r0, r1, 0x0, 0x8400fffffffa) close(0xffffffffffffffff) [ 955.332261][ T6131] attempt to access beyond end of device [ 955.332261][ T6131] loop3: rw=34817, want=184, limit=16 [ 955.357336][ T6147] loop4: detected capacity change from 0 to 16 07:14:45 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\x11\x00\x00', 0xfffffffffffffffe) 07:14:45 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x100, 0x0}) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x28000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_config_ext={0x5, 0x8}, 0x4000, 0x0, 0x9, 0x7, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000001440)) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r1, 0xd000943e, 0x0) clone(0x40808000, 0x0, 0x0, 0x0, 0x0) r2 = gettid() tkill(r2, 0x1e) r3 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r3, 0x0) ptrace$cont(0x18, 0x0, 0x0, 0x1) preadv(0xffffffffffffffff, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ptrace$cont(0x7, 0x0, 0x0, 0x10001) openat$full(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x2, 0x80, 0x4, 0x4, 0xe0, 0xb, 0x0, 0x0, 0x8000, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x8004, 0x2, @perf_bp={0x0}, 0x4000, 0x8000, 0xfffffff9, 0x7, 0x80000001, 0x8, 0x0, 0x0, 0xa, 0x0, 0x100000000}, r2, 0x8, 0xffffffffffffffff, 0x6ee4ca8bd5713173) 07:14:45 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\x12\x00\x00', 0xfffffffffffffffe) [ 955.473390][ C1] sd 0:0:1:0: [sg0] tag#5680 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 955.483787][ C1] sd 0:0:1:0: [sg0] tag#5680 CDB: opcode=0xe5 (vendor) [ 955.490642][ C1] sd 0:0:1:0: [sg0] tag#5680 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 955.491165][ T6132] loop1: detected capacity change from 0 to 4 [ 955.500201][ C1] sd 0:0:1:0: [sg0] tag#5680 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 955.500221][ C1] sd 0:0:1:0: [sg0] tag#5680 CDB[20]: ba 07:14:45 executing program 1: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000180)='./file1\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="20000000360000001900000060008f000ff68f0100007a000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}], 0x0, &(0x7f0000000140)={[{@jqfmt_vfsv0}]}) [ 955.516808][ T6132] EXT4-fs (loop1): Quota format mount options ignored when QUOTA feature is enabled [ 955.531021][ T6132] EXT4-fs (loop1): unsupported descriptor size 0 07:14:45 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00H\x00\x00', 0xfffffffffffffffe) 07:14:45 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x100, 0x0}) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x28000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_config_ext={0x5, 0x8}, 0x4000, 0x0, 0x9, 0x7, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000001440)) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r1, 0xd000943e, 0x0) clone(0x40808000, 0x0, 0x0, 0x0, 0x0) r2 = gettid() tkill(r2, 0x1e) r3 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r3, 0x0) ptrace$cont(0x18, 0x0, 0x0, 0x1) preadv(r3, 0x0, 0x0, 0xd9f, 0x0) ptrace$cont(0x7, 0x0, 0x0, 0x10001) openat$full(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x2, 0x80, 0x4, 0x4, 0xe0, 0xb, 0x0, 0x0, 0x8000, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x8004, 0x2, @perf_bp={0x0}, 0x4000, 0x8000, 0xfffffff9, 0x7, 0x80000001, 0x8, 0x0, 0x0, 0xa, 0x0, 0x100000000}, r2, 0x8, 0xffffffffffffffff, 0x6ee4ca8bd5713173) [ 955.603473][ T6192] loop1: detected capacity change from 0 to 4 [ 955.609543][ C0] sd 0:0:1:0: [sg0] tag#5643 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 955.609566][ C0] sd 0:0:1:0: [sg0] tag#5643 CDB: opcode=0xe5 (vendor) [ 955.609583][ C0] sd 0:0:1:0: [sg0] tag#5643 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 955.636288][ C0] sd 0:0:1:0: [sg0] tag#5643 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 955.645968][ C0] sd 0:0:1:0: [sg0] tag#5643 CDB[20]: ba 07:14:45 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00L\x00\x00', 0xfffffffffffffffe) [ 955.652375][ T6192] EXT4-fs (loop1): Quota format mount options ignored when QUOTA feature is enabled [ 955.661815][ T6192] EXT4-fs (loop1): unsupported descriptor size 0 07:14:45 executing program 3: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000, 0x0, 0x0, 0x7}]) 07:14:45 executing program 4: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0xffffffffffffffff}]) 07:14:45 executing program 1: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000180)='./file1\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="20000000360000001900000060008f000ff68f010000fe000000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}], 0x0, &(0x7f0000000140)={[{@jqfmt_vfsv0}]}) 07:14:45 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00h\x00\x00', 0xfffffffffffffffe) [ 955.770293][ T6215] loop1: detected capacity change from 0 to 4 [ 955.802419][ T6222] loop3: detected capacity change from 0 to 16 [ 955.805907][ T6215] EXT4-fs (loop1): Quota format mount options ignored when QUOTA feature is enabled [ 955.817969][ T6215] EXT4-fs (loop1): unsupported descriptor size 0 [ 955.855034][ T6215] loop1: detected capacity change from 0 to 4 [ 955.866360][ T6215] EXT4-fs (loop1): Quota format mount options ignored when QUOTA feature is enabled [ 955.873282][ T6235] loop4: detected capacity change from 0 to 16 [ 955.875793][ T6215] EXT4-fs (loop1): unsupported descriptor size 0 07:14:46 executing program 0: syz_mount_image$vfat(&(0x7f00000002c0), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f736617e43c00088020000200000004f8000020004000000000000000000001", 0x25}, {0x0, 0x0, 0x200000000011000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6900) ftruncate(r0, 0x800) lseek(r0, 0x1200, 0x0) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, 0x0, 0x0) r1 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x1) sendfile(0xffffffffffffffff, r1, 0x0, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @private2}, 0x1c) sendfile(r0, r1, 0x0, 0x108d1521) r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_FEATURES_SET(r2, 0x0, 0x0) r3 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000140)='rdma.current\x00', 0x0, 0x0) sendmsg$IPCTNL_MSG_EXP_GET(r3, &(0x7f0000000280)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000240)={&(0x7f0000000300)={0xf0, 0x1, 0x2, 0x101, 0x0, 0x0, {0x2, 0x0, 0x7}, [@CTA_EXPECT_TUPLE={0xdc, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @ipv4={'\x00', '\xff\xff', @empty}}, {0x14, 0x4, @private0}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x88}}, @CTA_TUPLE_ZONE={0x6}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @private1={0xfc, 0x1, '\x00', 0x1}}, {0x14, 0x4, @private2}}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @empty}, {0x14, 0x4, @mcast2}}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @remote}, {0x14, 0x4, @private2}}}, @CTA_TUPLE_ZONE={0x6}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x21}}]}]}, 0xf0}, 0x1, 0x0, 0x0, 0x24000000}, 0x40004090) ioctl$sock_ipv6_tunnel_SIOCCHGPRL(0xffffffffffffffff, 0x89f7, &(0x7f00000001c0)={'ip6tnl0\x00', 0x0}) sendmsg$ETHTOOL_MSG_LINKINFO_GET(0xffffffffffffffff, 0x0, 0x0) sendfile(r0, r1, 0x0, 0x8400fffffffa) close(0xffffffffffffffff) 07:14:46 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x100, 0x0}) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x28000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_config_ext={0x5, 0x8}, 0x4000, 0x0, 0x9, 0x7, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000001440)) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r1, 0xd000943e, 0x0) clone(0x40808000, 0x0, 0x0, 0x0, 0x0) r2 = gettid() tkill(r2, 0x1e) r3 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r3, 0x0) ptrace$cont(0x18, 0x0, 0x0, 0x1) preadv(r3, 0x0, 0x0, 0xd9f, 0x0) ptrace$cont(0x7, 0x0, 0x0, 0x10001) openat$full(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x2, 0x80, 0x4, 0x4, 0xe0, 0xb, 0x0, 0x0, 0x8000, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x8004, 0x2, @perf_bp={0x0}, 0x4000, 0x8000, 0xfffffff9, 0x7, 0x80000001, 0x8, 0x0, 0x0, 0xa, 0x0, 0x100000000}, r2, 0x8, 0xffffffffffffffff, 0x6ee4ca8bd5713173) 07:14:46 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00l\x00\x00', 0xfffffffffffffffe) 07:14:46 executing program 3: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000, 0x0, 0x0, 0x8}]) 07:14:46 executing program 1: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000180)='./file1\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="20000000360000001900000060008f000ff68f01000004020000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}], 0x0, &(0x7f0000000140)={[{@jqfmt_vfsv0}]}) 07:14:46 executing program 4: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16002, 0x2}]) [ 956.289874][ T6259] loop3: detected capacity change from 0 to 16 [ 956.307933][ T6262] loop1: detected capacity change from 0 to 4 [ 956.317244][ T6259] attempt to access beyond end of device [ 956.317244][ T6259] loop3: rw=34817, want=184, limit=16 [ 956.328954][ C0] sd 0:0:1:0: [sg0] tag#5678 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s 07:14:46 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00t\x00\x00', 0xfffffffffffffffe) 07:14:46 executing program 0: syz_mount_image$vfat(&(0x7f00000002c0), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f736617e43c00088020000200000004f8000020004000000000000000000001", 0x25}, {0x0, 0x0, 0x200000000011000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6900) ftruncate(r0, 0x800) lseek(r0, 0x1200, 0x0) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x1d4) sendfile(0xffffffffffffffff, r1, 0x0, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @private2}, 0x1c) sendfile(r0, r1, 0x0, 0x108d1521) r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_FEATURES_SET(r2, 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHGPRL(0xffffffffffffffff, 0x89f7, &(0x7f00000001c0)={'ip6tnl0\x00', 0x0}) sendmsg$ETHTOOL_MSG_LINKINFO_GET(0xffffffffffffffff, 0x0, 0x0) sendfile(r0, r1, 0x0, 0x8400fffffffa) close(0xffffffffffffffff) mmap(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x1000000, 0x12, r1, 0xabd22000) [ 956.339306][ C0] sd 0:0:1:0: [sg0] tag#5678 CDB: opcode=0xe5 (vendor) [ 956.346156][ C0] sd 0:0:1:0: [sg0] tag#5678 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 956.355703][ C0] sd 0:0:1:0: [sg0] tag#5678 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 956.365272][ C0] sd 0:0:1:0: [sg0] tag#5678 CDB[20]: ba [ 956.373293][ T6277] loop4: detected capacity change from 0 to 16 07:14:46 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00z\x00\x00', 0xfffffffffffffffe) 07:14:46 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x100, 0x0}) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x28000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_config_ext={0x5, 0x8}, 0x4000, 0x0, 0x9, 0x7, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000001440)) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r1, 0xd000943e, 0x0) clone(0x40808000, 0x0, 0x0, 0x0, 0x0) r2 = gettid() tkill(r2, 0x1e) r3 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r3, 0x0) ptrace$cont(0x18, 0x0, 0x0, 0x1) preadv(r3, 0x0, 0x0, 0xd9f, 0x0) ptrace$cont(0x7, 0x0, 0x0, 0x10001) openat$full(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x2, 0x80, 0x4, 0x4, 0xe0, 0xb, 0x0, 0x0, 0x8000, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x8004, 0x2, @perf_bp={0x0}, 0x4000, 0x8000, 0xfffffff9, 0x7, 0x80000001, 0x8, 0x0, 0x0, 0xa, 0x0, 0x100000000}, r2, 0x8, 0xffffffffffffffff, 0x6ee4ca8bd5713173) [ 956.436750][ T6262] EXT4-fs (loop1): Quota format mount options ignored when QUOTA feature is enabled [ 956.446169][ T6262] EXT4-fs (loop1): unsupported descriptor size 0 07:14:46 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\xff\xff\xff\xfe\x00\x00', 0xfffffffffffffffe) 07:14:46 executing program 3: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000, 0x0, 0x0, 0x9}]) [ 956.512921][ C0] sd 0:0:1:0: [sg0] tag#5660 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 956.523320][ C0] sd 0:0:1:0: [sg0] tag#5660 CDB: opcode=0xe5 (vendor) [ 956.530185][ C0] sd 0:0:1:0: [sg0] tag#5660 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 956.539756][ C0] sd 0:0:1:0: [sg0] tag#5660 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 956.549314][ C0] sd 0:0:1:0: [sg0] tag#5660 CDB[20]: ba [ 956.572602][ T6262] loop1: detected capacity change from 0 to 4 [ 956.586092][ T6262] EXT4-fs (loop1): Quota format mount options ignored when QUOTA feature is enabled [ 956.595513][ T6262] EXT4-fs (loop1): unsupported descriptor size 0 [ 956.615313][ T6320] loop3: detected capacity change from 0 to 16 07:14:46 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\xfe\xff\xff\x00\x00', 0xfffffffffffffffe) 07:14:46 executing program 1: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000180)='./file1\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="20000000360000001900000060008f000ff68f01000000030000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}], 0x0, &(0x7f0000000140)={[{@jqfmt_vfsv0}]}) 07:14:46 executing program 3: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000, 0x0, 0x0, 0xa}]) 07:14:46 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x100, 0x0}) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x28000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_config_ext={0x5, 0x8}, 0x4000, 0x0, 0x9, 0x7, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000001440)) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r1, 0xd000943e, 0x0) clone(0x40808000, 0x0, 0x0, 0x0, 0x0) r2 = gettid() tkill(r2, 0x1e) r3 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r3, 0x0) ptrace$cont(0x18, 0x0, 0x0, 0x1) preadv(r3, &(0x7f0000000280), 0x18, 0x0, 0x0) ptrace$cont(0x7, 0x0, 0x0, 0x10001) openat$full(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x2, 0x80, 0x4, 0x4, 0xe0, 0xb, 0x0, 0x0, 0x8000, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x8004, 0x2, @perf_bp={0x0}, 0x4000, 0x8000, 0xfffffff9, 0x7, 0x80000001, 0x8, 0x0, 0x0, 0xa, 0x0, 0x100000000}, r2, 0x8, 0xffffffffffffffff, 0x6ee4ca8bd5713173) 07:14:46 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\xfe\xff\xff\xff\x00\x00', 0xfffffffffffffffe) [ 956.742242][ T6337] loop1: detected capacity change from 0 to 4 [ 956.761493][ T6337] EXT4-fs (loop1): Quota format mount options ignored when QUOTA feature is enabled [ 956.770882][ T6337] EXT4-fs (loop1): unsupported descriptor size 0 [ 956.818552][ T6347] loop3: detected capacity change from 0 to 16 [ 956.825796][ C1] sd 0:0:1:0: [sg0] tag#5670 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 956.837177][ C1] sd 0:0:1:0: [sg0] tag#5670 CDB: opcode=0xe5 (vendor) [ 956.844046][ C1] sd 0:0:1:0: [sg0] tag#5670 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 956.854736][ C1] sd 0:0:1:0: [sg0] tag#5670 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d 07:14:47 executing program 4: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16002, 0x3}]) 07:14:47 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x9f\x94p\x9f~w', 0xfffffffffffffffe) [ 956.864295][ C1] sd 0:0:1:0: [sg0] tag#5670 CDB[20]: ba [ 956.872021][ T6347] attempt to access beyond end of device [ 956.872021][ T6347] loop3: rw=34817, want=184, limit=16 [ 956.914108][ T6337] loop1: detected capacity change from 0 to 4 [ 956.925660][ T6337] EXT4-fs (loop1): Quota format mount options ignored when QUOTA feature is enabled [ 956.935258][ T6337] EXT4-fs (loop1): unsupported descriptor size 0 [ 957.022275][ T6383] loop4: detected capacity change from 0 to 16 07:14:47 executing program 0: syz_mount_image$vfat(&(0x7f00000002c0), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000140)=[{&(0x7f0000010000)="601c6d6b646f736617e43c00088020000200000004f8000020004000000000000000000001", 0x25, 0x2}, {0x0, 0x0, 0x200000000011000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6900) ftruncate(0xffffffffffffffff, 0x35) lseek(r0, 0x1200, 0x4) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, r1, 0x0, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @private2}, 0x1c) r2 = socket$packet(0x11, 0x3, 0x300) sendfile(r2, 0xffffffffffffffff, 0x0, 0x100108d1523) r3 = socket$nl_generic(0x10, 0x3, 0x10) open(&(0x7f0000000080)='./bus\x00', 0x8001, 0x150) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_FEATURES_SET(r3, 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHGPRL(0xffffffffffffffff, 0x89f7, &(0x7f00000001c0)={'sit0\x00', 0x0}) sendmsg$ETHTOOL_MSG_LINKINFO_GET(0xffffffffffffffff, 0x0, 0x0) sendfile(r0, r1, 0x0, 0x8400fffffffa) close(0xffffffffffffffff) 07:14:47 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\x00\xff\xff', 0xfffffffffffffffe) 07:14:47 executing program 3: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000, 0x0, 0x0, 0xb}]) 07:14:47 executing program 1: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000180)='./file1\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="20000000360000001900000060008f000ff68f01000002040000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}], 0x0, &(0x7f0000000140)={[{@jqfmt_vfsv0}]}) 07:14:47 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x100, 0x0}) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x28000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_config_ext={0x5, 0x8}, 0x4000, 0x0, 0x9, 0x7, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000001440)) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r1, 0xd000943e, 0x0) clone(0x40808000, 0x0, 0x0, 0x0, 0x0) r2 = gettid() tkill(r2, 0x1e) r3 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r3, 0x0) ptrace$cont(0x18, 0x0, 0x0, 0x1) preadv(r3, &(0x7f0000000280), 0x18, 0x0, 0x0) ptrace$cont(0x7, 0x0, 0x0, 0x10001) openat$full(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x2, 0x80, 0x4, 0x4, 0xe0, 0xb, 0x0, 0x0, 0x8000, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x8004, 0x2, @perf_bp={0x0}, 0x4000, 0x8000, 0xfffffff9, 0x7, 0x80000001, 0x8, 0x0, 0x0, 0xa, 0x0, 0x100000000}, r2, 0x8, 0xffffffffffffffff, 0x6ee4ca8bd5713173) 07:14:47 executing program 4: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16002, 0x4}]) [ 957.406143][ T6406] loop3: detected capacity change from 0 to 16 [ 957.408280][ T6405] loop1: detected capacity change from 0 to 4 [ 957.418677][ C1] sd 0:0:1:0: [sg0] tag#5673 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 957.429022][ C1] sd 0:0:1:0: [sg0] tag#5673 CDB: opcode=0xe5 (vendor) [ 957.435900][ C1] sd 0:0:1:0: [sg0] tag#5673 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 957.445459][ C1] sd 0:0:1:0: [sg0] tag#5673 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d 07:14:47 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\x00\x00\x00', 0xfffffffffffffffe) 07:14:47 executing program 0: syz_mount_image$vfat(&(0x7f00000002c0), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f736617e43c00088020000200000004f8000020004000000000000000000001", 0x25}, {0x0, 0x0, 0x200000000011000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6900) ftruncate(r0, 0x800) ioctl$BTRFS_IOC_WAIT_SYNC(r0, 0x40089416, 0x0) ioctl$PTP_PIN_SETFUNC(0xffffffffffffffff, 0x40603d07, &(0x7f0000000140)={'\x00', 0x0, 0x2, 0x81}) lseek(r0, 0x1200, 0x0) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, r1, 0x0, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @private2}, 0x1c) sendfile(r0, r1, 0x0, 0x108d1521) r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_FEATURES_SET(r2, 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHGPRL(0xffffffffffffffff, 0x89f7, &(0x7f00000001c0)={'ip6tnl0\x00', 0x0}) sendmsg$ETHTOOL_MSG_LINKINFO_GET(0xffffffffffffffff, 0x0, 0x0) sendfile(r0, r1, 0x0, 0x8400fffffffa) close(0xffffffffffffffff) [ 957.455015][ C1] sd 0:0:1:0: [sg0] tag#5673 CDB[20]: ba [ 957.458334][ T6412] loop4: detected capacity change from 0 to 16 [ 957.473758][ T6405] EXT4-fs (loop1): Quota format mount options ignored when QUOTA feature is enabled [ 957.483161][ T6405] EXT4-fs (loop1): unsupported descriptor size 0 07:14:47 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x100, 0x0}) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x28000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_config_ext={0x5, 0x8}, 0x4000, 0x0, 0x9, 0x7, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000001440)) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r1, 0xd000943e, 0x0) clone(0x40808000, 0x0, 0x0, 0x0, 0x0) r2 = gettid() tkill(r2, 0x1e) r3 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r3, 0x0) ptrace$cont(0x18, 0x0, 0x0, 0x1) preadv(r3, &(0x7f0000000280), 0x18, 0x0, 0x0) ptrace$cont(0x7, 0x0, 0x0, 0x10001) openat$full(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x2, 0x80, 0x4, 0x4, 0xe0, 0xb, 0x0, 0x0, 0x8000, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x8004, 0x2, @perf_bp={0x0}, 0x4000, 0x8000, 0xfffffff9, 0x7, 0x80000001, 0x8, 0x0, 0x0, 0xa, 0x0, 0x100000000}, r2, 0x8, 0xffffffffffffffff, 0x6ee4ca8bd5713173) 07:14:47 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\x00\x00\x00', 0xfffffffffffffffe) 07:14:47 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\x00\x00\x00', 0xfffffffffffffffe) 07:14:47 executing program 1: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000180)='./file1\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="20000000360000001900000060008f000ff68f01000006040000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}], 0x0, &(0x7f0000000140)={[{@jqfmt_vfsv0}]}) 07:14:47 executing program 3: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000, 0x0, 0x0, 0xc}]) 07:14:47 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\x00\x00\x00', 0xfffffffffffffffe) [ 957.622707][ T6444] loop1: detected capacity change from 0 to 4 [ 957.656702][ T6444] EXT4-fs (loop1): Quota format mount options ignored when QUOTA feature is enabled [ 957.666240][ T6444] EXT4-fs (loop1): unsupported descriptor size 0 07:14:47 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\x00\x00\x00', 0xfffffffffffffffe) [ 957.709972][ T6463] loop3: detected capacity change from 0 to 16 [ 957.744704][ T6444] loop1: detected capacity change from 0 to 4 07:14:48 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x100, 0x0}) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x28000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_config_ext={0x5, 0x8}, 0x4000, 0x0, 0x9, 0x7, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000001440)) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r1, 0xd000943e, 0x0) clone(0x40808000, 0x0, 0x0, 0x0, 0x0) r2 = gettid() tkill(r2, 0x1e) r3 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r3, 0x0) ptrace$cont(0x18, 0x0, 0x0, 0x1) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ptrace$cont(0xffffffffffffffff, 0x0, 0x0, 0x10001) openat$full(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x2, 0x80, 0x4, 0x4, 0xe0, 0xb, 0x0, 0x0, 0x8000, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x8004, 0x2, @perf_bp={0x0}, 0x4000, 0x8000, 0xfffffff9, 0x7, 0x80000001, 0x8, 0x0, 0x0, 0xa, 0x0, 0x100000000}, r2, 0x8, 0xffffffffffffffff, 0x6ee4ca8bd5713173) 07:14:48 executing program 4: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16002, 0x5}]) 07:14:48 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\x00\x00\x00', 0xfffffffffffffffe) [ 957.790798][ T6444] EXT4-fs (loop1): Quota format mount options ignored when QUOTA feature is enabled [ 957.800243][ T6444] EXT4-fs (loop1): unsupported descriptor size 0 [ 957.809603][ T6463] attempt to access beyond end of device [ 957.809603][ T6463] loop3: rw=34817, want=184, limit=16 07:14:48 executing program 1: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000180)='./file1\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="20000000360000001900000060008f000ff68f01000000050000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}], 0x0, &(0x7f0000000140)={[{@jqfmt_vfsv0}]}) [ 957.925092][ T6495] loop1: detected capacity change from 0 to 4 [ 957.940321][ T6495] EXT4-fs (loop1): Quota format mount options ignored when QUOTA feature is enabled [ 957.949785][ T6495] EXT4-fs (loop1): unsupported descriptor size 0 [ 957.975773][ T6504] loop4: detected capacity change from 0 to 16 [ 957.997564][ T6495] loop1: detected capacity change from 0 to 4 [ 958.007363][ T6495] EXT4-fs (loop1): Quota format mount options ignored when QUOTA feature is enabled [ 958.016791][ T6495] EXT4-fs (loop1): unsupported descriptor size 0 07:14:48 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\x00\x00\x00', 0xfffffffffffffffe) 07:14:48 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x100, 0x0}) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x28000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_config_ext={0x5, 0x8}, 0x4000, 0x0, 0x9, 0x7, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000001440)) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r1, 0xd000943e, 0x0) clone(0x40808000, 0x0, 0x0, 0x0, 0x0) r2 = gettid() tkill(r2, 0x1e) r3 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r3, 0x0) ptrace$cont(0x18, 0x0, 0x0, 0x1) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ptrace$cont(0xffffffffffffffff, 0x0, 0x0, 0x10001) openat$full(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x2, 0x80, 0x4, 0x4, 0xe0, 0xb, 0x0, 0x0, 0x8000, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x8004, 0x2, @perf_bp={0x0}, 0x4000, 0x8000, 0xfffffff9, 0x7, 0x80000001, 0x8, 0x0, 0x0, 0xa, 0x0, 0x100000000}, r2, 0x8, 0xffffffffffffffff, 0x6ee4ca8bd5713173) 07:14:48 executing program 3: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000, 0x0, 0x0, 0xd}]) 07:14:48 executing program 1: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000180)='./file1\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="20000000360000001900000060008f000ff68f0100000a050000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}], 0x0, &(0x7f0000000140)={[{@jqfmt_vfsv0}]}) 07:14:48 executing program 0: syz_mount_image$vfat(&(0x7f00000002c0), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f736617e43c00088020000200000004f8000020004000000000000000000001", 0x25}, {0x0, 0x0, 0x200000000011000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6900) getsockopt$inet_buf(0xffffffffffffffff, 0x0, 0x50, &(0x7f0000001280)=""/4068, &(0x7f0000000040)=0xfe4) write$binfmt_script(0xffffffffffffffff, &(0x7f0000000300)=ANY=[@ANYBLOB="2321202e2f62757320766661740020285de32a2c2420ea23405c2c5bd35b26293a0afb757df311da3d95f493ee67bd96634642e767396005c9f3b1044f8f716c616708e832567564647f8fce14ed652078af610752c658c5fb74765a847f68c25552cbd2b7959cf29c77c6b86da6dcc380e220306b8fdf133084bea9c15d54abb56e3453c3107c3643ad4f92890f0a17f5988876fcf85e122a6fb3f98d31d5b514ad702a836460d5da02d1081e76a824c84c74a70843b8e86a49bee0842b86a555a4acaf81c05d4f822a46628b3da49c4a88b656924b1cbcf5a96dc546f601d5534d19b8c995f3c87dde5931bef337800b6d"], 0xf2) ftruncate(r0, 0x800) lseek(r0, 0x400000000000, 0x0) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x12080, 0x0) sendfile(0xffffffffffffffff, r1, 0x0, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @private2}, 0x1c) sendfile(r0, r1, 0x0, 0x108d1521) r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_FEATURES_SET(r2, 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHGPRL(0xffffffffffffffff, 0x89f7, &(0x7f00000001c0)={'ip6tnl0\x00', 0x0}) sendmsg$ETHTOOL_MSG_LINKINFO_GET(0xffffffffffffffff, 0x0, 0x0) sendfile(r0, r1, 0x0, 0x8400fffffffa) close(0xffffffffffffffff) 07:14:48 executing program 4: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16002, 0x6}]) [ 958.515818][ T6528] loop3: detected capacity change from 0 to 16 [ 958.527274][ T6533] loop1: detected capacity change from 0 to 4 [ 958.555092][ T6533] EXT4-fs (loop1): Quota format mount options ignored when QUOTA feature is enabled 07:14:48 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\x00\x00\x00', 0xfffffffffffffffe) [ 958.564540][ T6533] EXT4-fs (loop1): unsupported descriptor size 0 07:14:48 executing program 0: syz_mount_image$vfat(&(0x7f00000002c0), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f736617e43c00088020000200000004f8000020004000000000000000000001", 0x25}, {0x0, 0x0, 0x200000000011000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6900) ftruncate(r0, 0x800) lseek(r0, 0x1200, 0x0) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, r1, 0x0, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @private2}, 0x1c) sendfile(r0, r1, 0x0, 0x108d1521) r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) ioctl$FITRIM(r0, 0xc0185879, &(0x7f0000000080)={0x3f, 0x10001, 0xfffffffffffffffb}) sendmsg$ETHTOOL_MSG_FEATURES_SET(r2, 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHGPRL(0xffffffffffffffff, 0x89f7, &(0x7f00000001c0)={'ip6tnl0\x00', 0x0}) sendmsg$ETHTOOL_MSG_LINKINFO_GET(0xffffffffffffffff, 0x0, 0x0) sendfile(r0, r1, 0x0, 0x8400fffffffa) close(0xffffffffffffffff) 07:14:48 executing program 3: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000, 0x0, 0x0, 0xe}]) [ 958.593570][ T6547] loop4: detected capacity change from 0 to 16 [ 958.608073][ T6533] loop1: detected capacity change from 0 to 4 [ 958.628209][ T6533] EXT4-fs (loop1): Quota format mount options ignored when QUOTA feature is enabled [ 958.637629][ T6533] EXT4-fs (loop1): unsupported descriptor size 0 07:14:48 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\x00\x00\x00', 0xfffffffffffffffe) 07:14:48 executing program 1: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000180)='./file1\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="20000000360000001900000060008f000ff68f0100000b050000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}], 0x0, &(0x7f0000000140)={[{@jqfmt_vfsv0}]}) [ 958.688217][ T6569] loop3: detected capacity change from 0 to 16 [ 958.746790][ T6569] attempt to access beyond end of device [ 958.746790][ T6569] loop3: rw=34817, want=184, limit=16 07:14:49 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\x00\x00\x00', 0xfffffffffffffffe) 07:14:49 executing program 1: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000180)='./file1\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="20000000360000001900000060008f000ff68f01000000060000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}], 0x0, &(0x7f0000000140)={[{@jqfmt_vfsv0}]}) 07:14:49 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x100, 0x0}) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x28000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_config_ext={0x5, 0x8}, 0x4000, 0x0, 0x9, 0x7, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000001440)) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r1, 0xd000943e, 0x0) clone(0x40808000, 0x0, 0x0, 0x0, 0x0) r2 = gettid() tkill(r2, 0x1e) r3 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r3, 0x0) ptrace$cont(0x18, 0x0, 0x0, 0x1) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ptrace$cont(0xffffffffffffffff, 0x0, 0x0, 0x10001) openat$full(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x2, 0x80, 0x4, 0x4, 0xe0, 0xb, 0x0, 0x0, 0x8000, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x8004, 0x2, @perf_bp={0x0}, 0x4000, 0x8000, 0xfffffff9, 0x7, 0x80000001, 0x8, 0x0, 0x0, 0xa, 0x0, 0x100000000}, r2, 0x8, 0xffffffffffffffff, 0x6ee4ca8bd5713173) 07:14:49 executing program 3: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000, 0x0, 0x0, 0xf}]) [ 958.823623][ T6588] loop1: detected capacity change from 0 to 4 [ 958.842862][ T6588] EXT4-fs (loop1): Quota format mount options ignored when QUOTA feature is enabled [ 958.852453][ T6588] EXT4-fs (loop1): unsupported descriptor size 0 07:14:49 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\x00\x00\x00', 0xfffffffffffffffe) [ 958.943958][ C0] scsi_io_completion_action: 3 callbacks suppressed [ 958.944000][ C0] sd 0:0:1:0: [sg0] tag#5658 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 958.954751][ T6609] loop1: detected capacity change from 0 to 4 [ 958.961043][ C0] sd 0:0:1:0: [sg0] tag#5658 CDB: opcode=0xe5 (vendor) [ 958.961063][ C0] sd 0:0:1:0: [sg0] tag#5658 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 958.971482][ T6610] loop3: detected capacity change from 0 to 16 07:14:49 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\x00\x00\x00', 0xfffffffffffffffe) [ 958.974004][ C0] sd 0:0:1:0: [sg0] tag#5658 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 958.974039][ C0] sd 0:0:1:0: [sg0] tag#5658 CDB[20]: ba [ 958.989732][ T6609] EXT4-fs (loop1): Quota format mount options ignored when QUOTA feature is enabled [ 959.014345][ T6609] EXT4-fs (loop1): unsupported descriptor size 0 [ 959.095163][ T6609] loop1: detected capacity change from 0 to 4 [ 959.104375][ T6609] EXT4-fs (loop1): Quota format mount options ignored when QUOTA feature is enabled [ 959.113782][ T6609] EXT4-fs (loop1): unsupported descriptor size 0 07:14:49 executing program 4: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16002, 0x8}]) 07:14:49 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\x00\x00\x00', 0xfffffffffffffffe) [ 959.349247][ T6648] loop4: detected capacity change from 0 to 16 07:14:49 executing program 3: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000, 0x0, 0x0, 0x10}]) 07:14:49 executing program 1: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000180)='./file1\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="20000000360000001900000060008f000ff68f01000004060000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}], 0x0, &(0x7f0000000140)={[{@jqfmt_vfsv0}]}) 07:14:49 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x100, 0x0}) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x28000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_config_ext={0x5, 0x8}, 0x4000, 0x0, 0x9, 0x7, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000001440)) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r1, 0xd000943e, 0x0) clone(0x40808000, 0x0, 0x0, 0x0, 0x0) r2 = gettid() tkill(r2, 0x1e) r3 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r3, 0x0) ptrace$cont(0x18, 0x0, 0x0, 0x1) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ptrace$cont(0x7, 0x0, 0x0, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x2, 0x80, 0x4, 0x4, 0xe0, 0xb, 0x0, 0x0, 0x8000, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x8004, 0x2, @perf_bp={0x0}, 0x4000, 0x8000, 0xfffffff9, 0x7, 0x80000001, 0x8, 0x0, 0x0, 0xa, 0x0, 0x100000000}, r2, 0x8, 0xffffffffffffffff, 0x6ee4ca8bd5713173) 07:14:49 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\x00\x00\x00', 0xfffffffffffffffe) 07:14:49 executing program 4: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16002, 0x9}]) 07:14:49 executing program 0: syz_mount_image$vfat(&(0x7f00000002c0), &(0x7f0000000100)='./file0\x00', 0x0, 0x0, &(0x7f0000000200), 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000700)='./file0/file0\x00', 0x82) fcntl$setstatus(r0, 0x4, 0x6900) ftruncate(r0, 0x800) lseek(r0, 0x1200, 0x0) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) flock(r0, 0xe) sendfile(0xffffffffffffffff, r1, 0x0, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @private2}, 0x1c) sendfile(r0, r1, 0x0, 0x108d1521) r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) preadv(0xffffffffffffffff, &(0x7f0000000240)=[{&(0x7f0000000080)=""/1, 0x1}, {&(0x7f0000000300)=""/152, 0x98}, {&(0x7f00000003c0)=""/209, 0xd1}, {&(0x7f0000000140)=""/128, 0x80}, {&(0x7f00000004c0)=""/160, 0xa0}, {&(0x7f0000000580)=""/187, 0xbb}, {&(0x7f0000000640)=""/146, 0x92}], 0x7, 0x3f, 0x8) sendmsg$ETHTOOL_MSG_FEATURES_SET(r2, 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHGPRL(0xffffffffffffffff, 0x89f7, &(0x7f00000001c0)={'ip6tnl0\x00', 0x0}) sendmsg$ETHTOOL_MSG_LINKINFO_GET(0xffffffffffffffff, 0x0, 0x0) sendfile(r0, r1, 0x0, 0x8400fffffffa) close(0xffffffffffffffff) [ 959.570308][ T6660] loop3: detected capacity change from 0 to 16 [ 959.584737][ C1] sd 0:0:1:0: [sg0] tag#5666 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 959.595098][ C1] sd 0:0:1:0: [sg0] tag#5666 CDB: opcode=0xe5 (vendor) [ 959.601991][ C1] sd 0:0:1:0: [sg0] tag#5666 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c 07:14:49 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\x00\x00\x00', 0xfffffffffffffffe) 07:14:49 executing program 0: syz_mount_image$vfat(&(0x7f00000002c0), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f736617e43c00088020000200000004f8000020004000000000000000000001", 0x25}, {0x0, 0x0, 0x200000000011000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6900) ftruncate(r0, 0x800) lseek(r0, 0x1200, 0x0) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, r1, 0x0, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @private2}, 0x1c) sendfile(r0, r1, 0x0, 0x108d1521) r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_FEATURES_SET(r2, 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHGPRL(0xffffffffffffffff, 0x89f7, &(0x7f0000000080)={'ip6_vti0\x00', 0x0}) sendmsg$ETHTOOL_MSG_LINKINFO_GET(0xffffffffffffffff, 0x0, 0x0) sendfile(r0, r1, 0x0, 0x8400fffffffa) close(0xffffffffffffffff) [ 959.611543][ C1] sd 0:0:1:0: [sg0] tag#5666 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 959.621080][ C1] sd 0:0:1:0: [sg0] tag#5666 CDB[20]: ba [ 959.630540][ T6664] loop1: detected capacity change from 0 to 4 [ 959.636814][ T6660] attempt to access beyond end of device [ 959.636814][ T6660] loop3: rw=34817, want=184, limit=16 07:14:49 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\x00\x00\x00', 0xfffffffffffffffe) [ 959.703946][ T6692] loop4: detected capacity change from 0 to 16 [ 959.726382][ T6664] EXT4-fs (loop1): Quota format mount options ignored when QUOTA feature is enabled [ 959.735901][ T6664] EXT4-fs (loop1): unsupported descriptor size 0 07:14:49 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\x00\x00\x00', 0xfffffffffffffffe) 07:14:50 executing program 3: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000, 0x0, 0x0, 0x11}]) 07:14:50 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x100, 0x0}) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x28000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_config_ext={0x5, 0x8}, 0x4000, 0x0, 0x9, 0x7, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000001440)) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r1, 0xd000943e, 0x0) clone(0x40808000, 0x0, 0x0, 0x0, 0x0) r2 = gettid() tkill(r2, 0x1e) r3 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r3, 0x0) ptrace$cont(0x18, 0x0, 0x0, 0x1) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ptrace$cont(0x7, 0x0, 0x0, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x2, 0x80, 0x4, 0x4, 0xe0, 0xb, 0x0, 0x0, 0x8000, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x8004, 0x2, @perf_bp={0x0}, 0x4000, 0x8000, 0xfffffff9, 0x7, 0x80000001, 0x8, 0x0, 0x0, 0xa, 0x0, 0x100000000}, r2, 0x8, 0xffffffffffffffff, 0x6ee4ca8bd5713173) 07:14:50 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\x00\x00\x00', 0xfffffffffffffffe) [ 959.804481][ T6664] loop1: detected capacity change from 0 to 4 [ 959.824004][ T6664] EXT4-fs (loop1): Quota format mount options ignored when QUOTA feature is enabled [ 959.833462][ T6664] EXT4-fs (loop1): unsupported descriptor size 0 [ 959.885448][ T6719] loop3: detected capacity change from 0 to 16 [ 959.893265][ C1] sd 0:0:1:0: [sg0] tag#5632 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 959.903623][ C1] sd 0:0:1:0: [sg0] tag#5632 CDB: opcode=0xe5 (vendor) [ 959.910478][ C1] sd 0:0:1:0: [sg0] tag#5632 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 959.920028][ C1] sd 0:0:1:0: [sg0] tag#5632 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 959.929570][ C1] sd 0:0:1:0: [sg0] tag#5632 CDB[20]: ba 07:14:50 executing program 1: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000180)='./file1\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="20000000360000001900000060008f000ff68f01000000070000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}], 0x0, &(0x7f0000000140)={[{@jqfmt_vfsv0}]}) 07:14:50 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\x00\x00\x00', 0xfffffffffffffffe) 07:14:50 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x100, 0x0}) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x28000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_config_ext={0x5, 0x8}, 0x4000, 0x0, 0x9, 0x7, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000001440)) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r1, 0xd000943e, 0x0) clone(0x40808000, 0x0, 0x0, 0x0, 0x0) r2 = gettid() tkill(r2, 0x1e) r3 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r3, 0x0) ptrace$cont(0x18, 0x0, 0x0, 0x1) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ptrace$cont(0x7, 0x0, 0x0, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x2, 0x80, 0x4, 0x4, 0xe0, 0xb, 0x0, 0x0, 0x8000, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x8004, 0x2, @perf_bp={0x0}, 0x4000, 0x8000, 0xfffffff9, 0x7, 0x80000001, 0x8, 0x0, 0x0, 0xa, 0x0, 0x100000000}, r2, 0x8, 0xffffffffffffffff, 0x6ee4ca8bd5713173) [ 960.018817][ T6741] loop1: detected capacity change from 0 to 4 [ 960.040726][ T6741] EXT4-fs (loop1): Quota format mount options ignored when QUOTA feature is enabled [ 960.050223][ T6741] EXT4-fs (loop1): unsupported descriptor size 0 07:14:50 executing program 4: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16002, 0xc}]) 07:14:50 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\x00\x00\x00', 0xfffffffffffffffe) 07:14:50 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\x00\x00\x00', 0xfffffffffffffffe) [ 960.071318][ C1] sd 0:0:1:0: [sg0] tag#5650 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 960.081715][ C1] sd 0:0:1:0: [sg0] tag#5650 CDB: opcode=0xe5 (vendor) [ 960.088568][ C1] sd 0:0:1:0: [sg0] tag#5650 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 960.098122][ C1] sd 0:0:1:0: [sg0] tag#5650 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 960.107865][ C1] sd 0:0:1:0: [sg0] tag#5650 CDB[20]: ba [ 960.135072][ T6741] loop1: detected capacity change from 0 to 4 [ 960.156047][ T6741] EXT4-fs (loop1): Quota format mount options ignored when QUOTA feature is enabled [ 960.165505][ T6741] EXT4-fs (loop1): unsupported descriptor size 0 [ 960.187794][ T6763] loop4: detected capacity change from 0 to 16 07:14:50 executing program 0: syz_mount_image$vfat(&(0x7f00000002c0), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f736617e43c00088020000200000004f8000020004000000000000000000001", 0x25}, {0x0, 0x0, 0x200000000011000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6900) ftruncate(r0, 0x800) lseek(r0, 0x1200, 0x0) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, r1, 0x0, 0x0) sendfile(r0, r1, 0x0, 0x108d1521) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r2, 0x1b7b2000) sendmsg$ETHTOOL_MSG_FEATURES_SET(0xffffffffffffffff, 0x0, 0x4004040) ioctl$sock_ipv6_tunnel_SIOCCHGPRL(0xffffffffffffffff, 0x89f7, &(0x7f00000001c0)={'ip6tnl0\x00', 0x0}) sendmsg$ETHTOOL_MSG_LINKINFO_GET(0xffffffffffffffff, 0x0, 0x0) sendfile(r0, r1, 0x0, 0x8400fffffffa) close(0xffffffffffffffff) 07:14:50 executing program 3: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000, 0x0, 0x0, 0x12}]) 07:14:50 executing program 1: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000180)='./file1\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="20000000360000001900000060008f000ff68f01000000090000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}], 0x0, &(0x7f0000000140)={[{@jqfmt_vfsv0}]}) 07:14:50 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\x00\x00\x00', 0xfffffffffffffffe) 07:14:50 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x100, 0x0}) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x28000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_config_ext={0x5, 0x8}, 0x4000, 0x0, 0x9, 0x7, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000001440)) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r1, 0xd000943e, 0x0) clone(0x40808000, 0x0, 0x0, 0x0, 0x0) r2 = gettid() tkill(r2, 0x1e) r3 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r3, 0x0) ptrace$cont(0x18, 0x0, 0x0, 0x1) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ptrace$cont(0x7, 0x0, 0x0, 0x10001) openat$full(0xffffffffffffff9c, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x2, 0x80, 0x4, 0x4, 0xe0, 0xb, 0x0, 0x0, 0x8000, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x8004, 0x2, @perf_bp={0x0}, 0x4000, 0x8000, 0xfffffff9, 0x7, 0x80000001, 0x8, 0x0, 0x0, 0xa, 0x0, 0x100000000}, r2, 0x8, 0xffffffffffffffff, 0x6ee4ca8bd5713173) 07:14:50 executing program 4: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16002, 0x10}]) 07:14:50 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\x00\x00\x00', 0xfffffffffffffffe) [ 960.719335][ T6798] loop1: detected capacity change from 0 to 4 [ 960.721159][ T6797] loop3: detected capacity change from 0 to 16 [ 960.736795][ T6798] EXT4-fs (loop1): Quota format mount options ignored when QUOTA feature is enabled [ 960.739811][ C0] sd 0:0:1:0: [sg0] tag#5682 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 960.746229][ T6798] EXT4-fs (loop1): unsupported descriptor size 0 [ 960.756519][ C0] sd 0:0:1:0: [sg0] tag#5682 CDB: opcode=0xe5 (vendor) [ 960.769667][ C0] sd 0:0:1:0: [sg0] tag#5682 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 960.779226][ C0] sd 0:0:1:0: [sg0] tag#5682 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 960.788779][ C0] sd 0:0:1:0: [sg0] tag#5682 CDB[20]: ba [ 960.798748][ T6797] attempt to access beyond end of device [ 960.798748][ T6797] loop3: rw=34817, want=184, limit=16 [ 960.812515][ T6812] loop4: detected capacity change from 0 to 16 07:14:51 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\x00\x00\x00', 0xfffffffffffffffe) [ 960.838621][ T6798] loop1: detected capacity change from 0 to 4 [ 960.877159][ T6798] EXT4-fs (loop1): Quota format mount options ignored when QUOTA feature is enabled 07:14:51 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00w~\x9fp', 0xfffffffffffffffe) [ 960.886613][ T6798] EXT4-fs (loop1): unsupported descriptor size 0 07:14:51 executing program 3: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000, 0x0, 0x0, 0x13}]) 07:14:51 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x100, 0x0}) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x28000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_config_ext={0x5, 0x8}, 0x4000, 0x0, 0x9, 0x7, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000001440)) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r1, 0xd000943e, 0x0) clone(0x40808000, 0x0, 0x0, 0x0, 0x0) r2 = gettid() tkill(r2, 0x1e) r3 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r3, 0x0) ptrace$cont(0x18, 0x0, 0x0, 0x1) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ptrace$cont(0x7, 0x0, 0x0, 0x10001) openat$full(0xffffffffffffff9c, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x2, 0x80, 0x4, 0x4, 0xe0, 0xb, 0x0, 0x0, 0x8000, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x8004, 0x2, @perf_bp={0x0}, 0x4000, 0x8000, 0xfffffff9, 0x7, 0x80000001, 0x8, 0x0, 0x0, 0xa, 0x0, 0x100000000}, r2, 0x8, 0xffffffffffffffff, 0x6ee4ca8bd5713173) 07:14:51 executing program 1: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000180)='./file1\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="20000000360000001900000060008f000ff68f010000000a0000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}], 0x0, &(0x7f0000000140)={[{@jqfmt_vfsv0}]}) [ 961.013000][ T6845] loop1: detected capacity change from 0 to 4 [ 961.029850][ T6844] loop3: detected capacity change from 0 to 16 [ 961.030300][ T6845] EXT4-fs (loop1): Quota format mount options ignored when QUOTA feature is enabled [ 961.045494][ T6845] EXT4-fs (loop1): unsupported descriptor size 0 [ 961.058119][ C1] sd 0:0:1:0: [sg0] tag#5668 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 961.068497][ C1] sd 0:0:1:0: [sg0] tag#5668 CDB: opcode=0xe5 (vendor) [ 961.075377][ C1] sd 0:0:1:0: [sg0] tag#5668 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 961.085018][ C1] sd 0:0:1:0: [sg0] tag#5668 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 961.094598][ C1] sd 0:0:1:0: [sg0] tag#5668 CDB[20]: ba [ 961.154534][ T6845] loop1: detected capacity change from 0 to 4 [ 961.167058][ T6845] EXT4-fs (loop1): Quota format mount options ignored when QUOTA feature is enabled [ 961.176486][ T6845] EXT4-fs (loop1): unsupported descriptor size 0 07:14:51 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\x00\xff\xff', 0xfffffffffffffffe) 07:14:51 executing program 4: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16002, 0x12}]) 07:14:51 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x100, 0x0}) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x28000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_config_ext={0x5, 0x8}, 0x4000, 0x0, 0x9, 0x7, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000001440)) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r1, 0xd000943e, 0x0) clone(0x40808000, 0x0, 0x0, 0x0, 0x0) r2 = gettid() tkill(r2, 0x1e) r3 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r3, 0x0) ptrace$cont(0x18, 0x0, 0x0, 0x1) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ptrace$cont(0x7, 0x0, 0x0, 0x10001) openat$full(0xffffffffffffff9c, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x2, 0x80, 0x4, 0x4, 0xe0, 0xb, 0x0, 0x0, 0x8000, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x8004, 0x2, @perf_bp={0x0}, 0x4000, 0x8000, 0xfffffff9, 0x7, 0x80000001, 0x8, 0x0, 0x0, 0xa, 0x0, 0x100000000}, r2, 0x8, 0xffffffffffffffff, 0x6ee4ca8bd5713173) 07:14:51 executing program 3: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000, 0x0, 0x0, 0x14}]) 07:14:51 executing program 1: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000180)='./file1\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="20000000360000001900000060008f000ff68f010000050a0000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}], 0x0, &(0x7f0000000140)={[{@jqfmt_vfsv0}]}) 07:14:51 executing program 0: syz_mount_image$vfat(&(0x7f00000002c0), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000640)="601c6d6b646f736617e43c00088020000200000004f8700020004000000000000000000001a00d9e5ea7cf284094b4504cd5bb51cd2fbdec0f0a64addc4d01fb684a70ed56eaa3", 0x47}, {0x0, 0x0, 0x200000000011000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000080)='./bus\x00', 0x108) fcntl$setstatus(r0, 0x4, 0x6900) ftruncate(r0, 0x800) lseek(r0, 0x1200, 0x0) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, 0x0, 0x0) r1 = open(&(0x7f0000000600)='./bus\x00', 0x0, 0x0) pipe(&(0x7f00000000c0)) sendfile(0xffffffffffffffff, r1, 0x0, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @private2}, 0x1c) sendfile(r0, r1, 0x0, 0x108d1521) r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_FEATURES_SET(r2, 0x0, 0x4814) ioctl$sock_ipv6_tunnel_SIOCCHGPRL(0xffffffffffffffff, 0x89f7, &(0x7f00000001c0)={'ip6tnl0\x00', 0x0}) sendmsg$ETHTOOL_MSG_LINKINFO_GET(0xffffffffffffffff, 0x0, 0x0) syz_mount_image$tmpfs(&(0x7f0000000140), &(0x7f0000000180)='./bus\x00', 0x9, 0x4, &(0x7f0000000580)=[{&(0x7f0000000240)="90a6848ed7b2a6a9feb1bf2de7b8a81b04fecbc528f12e4c1064df27b2725d10c20d854977af436880bf077bb2176d88aab0443119d2b539729bdbd95fe9ab65e70b929b5333a74f7007ba5c1bd276917fd1bd1dfab3488a963f014ce8623349e7225bc0177030", 0x67, 0xd298}, {&(0x7f0000000300)="3c8af9e6d9ff6aad3b2c78d87ae000b9b2d7d17b7609e2f796af8ba9a162fc13e43465f280678f912c65bcec79518a37ddb5914fce12a26092cc1017157880e2dd561577f3efa9771fbf45dc4abb0072fd99dbe3ccb76ecdd0ccc7e971ce8f063ca0d37db14c71acb4ac8e5c032008a488cf875a82600f3be74c454b4ae553e2b3887e0f28ca5ee4c3c28ffdfd2f3be23ebf95b8a170e65f5328d773298690c4fab53a83f7f592571c916cf236d5a6ae3313ebc06d1d251b70c82525937508eac1c879eafe888cd544572fc24b36d305d011f3a5180c823c", 0xd8, 0x3}, {&(0x7f0000000400)="cb6b3ef4970bee52c997d8fe90c80894e3699bf1a1fbb518bbed01a45418d1cd8eeebd97b6d0f7dc34363d010be6614bfffe7fad8bb21a3003b5e38482c85702d21c49b9b54e1f5fe9161fd4564576fba9bd8f11f03aac95c89fd0870894760e9c3273aaa036b856927e9ba2fe3a24c2866b64088d48a9fe619611849f00ad0693b3d047cd576e156bfe3bb5d11eb0ec9959fc22d98bc43ed0143cff8ab51de21ea71e2923caf848a09f4f404b4ef07e0eadb05da37361825635458d7b9ab418a76c", 0xc2, 0x8}, {&(0x7f0000000500)="50c204bb87a25384cd96a2d5ba7182968f9f33d95e6dc2c420da8838f0685f1b9033edaa12f7840e59b50a19e5b085a4fac365a5d8905060ea3b51caee07ff8a955b93b91280c2475942f09b41099f11f77f91a7accd0760a9928d1fee0c1af8e3a074", 0x63, 0x4}], 0x214804, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x8600fffffffa) close(0xffffffffffffffff) [ 961.565346][ T6877] loop3: detected capacity change from 0 to 16 [ 961.596065][ T6883] loop1: detected capacity change from 0 to 4 [ 961.598947][ C1] sd 0:0:1:0: [sg0] tag#5658 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s 07:14:51 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x02\x00\x00\x00\x00', 0xfffffffffffffffe) [ 961.612685][ C1] sd 0:0:1:0: [sg0] tag#5658 CDB: opcode=0xe5 (vendor) [ 961.619555][ C1] sd 0:0:1:0: [sg0] tag#5658 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 961.629200][ C1] sd 0:0:1:0: [sg0] tag#5658 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 961.638754][ C1] sd 0:0:1:0: [sg0] tag#5658 CDB[20]: ba [ 961.650819][ T6877] attempt to access beyond end of device [ 961.650819][ T6877] loop3: rw=34817, want=184, limit=16 [ 961.662432][ T6883] EXT4-fs (loop1): Quota format mount options ignored when QUOTA feature is enabled [ 961.671857][ T6883] EXT4-fs (loop1): unsupported descriptor size 0 07:14:51 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x03\x00\x00\x00\x00', 0xfffffffffffffffe) 07:14:51 executing program 3: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000, 0x0, 0x0, 0x15}]) 07:14:51 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x100, 0x0}) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x28000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_config_ext={0x5, 0x8}, 0x4000, 0x0, 0x9, 0x7, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000001440)) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r1, 0xd000943e, 0x0) clone(0x40808000, 0x0, 0x0, 0x0, 0x0) r2 = gettid() tkill(r2, 0x1e) r3 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r3, 0x0) ptrace$cont(0x18, 0x0, 0x0, 0x1) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ptrace$cont(0x7, 0x0, 0x0, 0x10001) openat$full(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) perf_event_open(0x0, r2, 0x8, 0xffffffffffffffff, 0x6ee4ca8bd5713173) [ 961.710780][ T6883] loop1: detected capacity change from 0 to 4 [ 961.731364][ T6883] EXT4-fs (loop1): Quota format mount options ignored when QUOTA feature is enabled [ 961.740948][ T6883] EXT4-fs (loop1): unsupported descriptor size 0 07:14:52 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x04\x00\x00\x00\x00', 0xfffffffffffffffe) 07:14:52 executing program 1: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000180)='./file1\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="20000000360000001900000060008f000ff68f010000000b0000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}], 0x0, &(0x7f0000000140)={[{@jqfmt_vfsv0}]}) [ 961.812737][ T6896] loop4: detected capacity change from 0 to 16 [ 961.846007][ C1] sd 0:0:1:0: [sg0] tag#5672 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s 07:14:52 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x05\x00\x00\x00\x00', 0xfffffffffffffffe) [ 961.856382][ C1] sd 0:0:1:0: [sg0] tag#5672 CDB: opcode=0xe5 (vendor) [ 961.863246][ C1] sd 0:0:1:0: [sg0] tag#5672 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 961.872814][ C1] sd 0:0:1:0: [sg0] tag#5672 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 961.882407][ C1] sd 0:0:1:0: [sg0] tag#5672 CDB[20]: ba [ 961.906171][ T6935] loop3: detected capacity change from 0 to 16 [ 961.936292][ T6937] loop1: detected capacity change from 0 to 4 [ 961.964018][ T6937] EXT4-fs (loop1): Quota format mount options ignored when QUOTA feature is enabled [ 961.973572][ T6937] EXT4-fs (loop1): unsupported descriptor size 0 [ 962.029706][ T6937] loop1: detected capacity change from 0 to 4 [ 962.045100][ T6937] EXT4-fs (loop1): Quota format mount options ignored when QUOTA feature is enabled [ 962.054553][ T6937] EXT4-fs (loop1): unsupported descriptor size 0 07:14:52 executing program 4: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16002, 0x16}]) 07:14:52 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x06\x00\x00\x00\x00', 0xfffffffffffffffe) 07:14:52 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x100, 0x0}) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x28000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_config_ext={0x5, 0x8}, 0x4000, 0x0, 0x9, 0x7, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000001440)) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r1, 0xd000943e, 0x0) clone(0x40808000, 0x0, 0x0, 0x0, 0x0) r2 = gettid() tkill(r2, 0x1e) r3 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r3, 0x0) ptrace$cont(0x18, 0x0, 0x0, 0x1) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ptrace$cont(0x7, 0x0, 0x0, 0x10001) openat$full(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) perf_event_open(0x0, r2, 0x8, 0xffffffffffffffff, 0x6ee4ca8bd5713173) 07:14:52 executing program 3: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000, 0x0, 0x0, 0x16}]) [ 962.167740][ T6973] loop3: detected capacity change from 0 to 16 [ 962.168713][ C0] sd 0:0:1:0: [sg0] tag#5676 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 962.184271][ C0] sd 0:0:1:0: [sg0] tag#5676 CDB: opcode=0xe5 (vendor) [ 962.191111][ C0] sd 0:0:1:0: [sg0] tag#5676 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 962.200709][ C0] sd 0:0:1:0: [sg0] tag#5676 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 962.210256][ C0] sd 0:0:1:0: [sg0] tag#5676 CDB[20]: ba [ 962.261498][ T6973] attempt to access beyond end of device [ 962.261498][ T6973] loop3: rw=34817, want=184, limit=16 [ 962.365094][ T6995] loop4: detected capacity change from 0 to 16 07:14:52 executing program 0: syz_mount_image$vfat(&(0x7f00000002c0), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f736617e43c00088020000200000004f8000020004000000000000000000001", 0x25}, {0x0, 0x0, 0x200000000011000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6900) ftruncate(r0, 0x800) lseek(r0, 0x1200, 0x0) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) r2 = syz_open_dev$vcsu(&(0x7f0000000080), 0x3, 0x606000) unlinkat(r2, &(0x7f0000000140)='./bus\x00', 0x0) sendfile(0xffffffffffffffff, r1, 0x0, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @private2}, 0x1c) sendfile(r0, r1, 0x0, 0x108d1521) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_FEATURES_SET(r3, 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHGPRL(0xffffffffffffffff, 0x89f7, &(0x7f00000001c0)={'ip6tnl0\x00', 0x0}) sendmsg$ETHTOOL_MSG_LINKINFO_GET(0xffffffffffffffff, 0x0, 0x0) sendfile(r0, r1, 0x0, 0x8400fffffffa) close(0xffffffffffffffff) 07:14:52 executing program 1: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000180)='./file1\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="20000000360000001900000060008f000ff68f010000050b0000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}], 0x0, &(0x7f0000000140)={[{@jqfmt_vfsv0}]}) 07:14:52 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\a\x00\x00\x00\x00', 0xfffffffffffffffe) 07:14:52 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x100, 0x0}) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x28000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_config_ext={0x5, 0x8}, 0x4000, 0x0, 0x9, 0x7, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000001440)) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r1, 0xd000943e, 0x0) clone(0x40808000, 0x0, 0x0, 0x0, 0x0) r2 = gettid() tkill(r2, 0x1e) r3 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r3, 0x0) ptrace$cont(0x18, 0x0, 0x0, 0x1) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ptrace$cont(0x7, 0x0, 0x0, 0x10001) openat$full(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) perf_event_open(0x0, r2, 0x8, 0xffffffffffffffff, 0x6ee4ca8bd5713173) 07:14:52 executing program 3: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000, 0x0, 0x0, 0x17}]) [ 962.465475][ C1] sd 0:0:1:0: [sg0] tag#5646 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 962.475864][ C1] sd 0:0:1:0: [sg0] tag#5646 CDB: opcode=0xe5 (vendor) [ 962.477187][ T7014] loop3: detected capacity change from 0 to 16 [ 962.482766][ C1] sd 0:0:1:0: [sg0] tag#5646 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 962.482792][ C1] sd 0:0:1:0: [sg0] tag#5646 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 962.507984][ C1] sd 0:0:1:0: [sg0] tag#5646 CDB[20]: ba 07:14:52 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\b\x00\x00\x00\x00', 0xfffffffffffffffe) [ 962.508630][ T7015] loop1: detected capacity change from 0 to 4 [ 962.527246][ T7015] EXT4-fs (loop1): Quota format mount options ignored when QUOTA feature is enabled [ 962.536643][ T7015] EXT4-fs (loop1): unsupported descriptor size 0 07:14:52 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\t\x00\x00\x00\x00', 0xfffffffffffffffe) 07:14:52 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x100, 0x0}) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x28000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_config_ext={0x5, 0x8}, 0x4000, 0x0, 0x9, 0x7, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000001440)) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r1, 0xd000943e, 0x0) clone(0x40808000, 0x0, 0x0, 0x0, 0x0) r2 = gettid() tkill(r2, 0x1e) r3 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r3, 0x0) ptrace$cont(0x18, 0x0, 0x0, 0x1) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ptrace$cont(0x7, 0x0, 0x0, 0x10001) openat$full(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x4, 0x4, 0xe0, 0xb, 0x0, 0x0, 0x8000, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x8004, 0x2, @perf_bp={0x0}, 0x4000, 0x8000, 0xfffffff9, 0x7, 0x80000001, 0x8, 0x0, 0x0, 0xa, 0x0, 0x100000000}, r2, 0x8, 0xffffffffffffffff, 0x6ee4ca8bd5713173) 07:14:52 executing program 4: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16002, 0x17}]) 07:14:52 executing program 3: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000, 0x0, 0x0, 0x18}]) 07:14:52 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\n\x00\x00\x00\x00', 0xfffffffffffffffe) [ 962.624539][ T7015] loop1: detected capacity change from 0 to 4 [ 962.644194][ T7015] EXT4-fs (loop1): Quota format mount options ignored when QUOTA feature is enabled [ 962.653715][ T7015] EXT4-fs (loop1): unsupported descriptor size 0 07:14:52 executing program 1: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000180)='./file1\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="20000000360000001900000060008f000ff68f010000000c0000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}], 0x0, &(0x7f0000000140)={[{@jqfmt_vfsv0}]}) [ 962.745772][ T7061] loop3: detected capacity change from 0 to 16 [ 962.777270][ T7072] loop1: detected capacity change from 0 to 4 [ 962.806427][ T7061] attempt to access beyond end of device [ 962.806427][ T7061] loop3: rw=34817, want=184, limit=16 [ 962.820916][ T7072] EXT4-fs (loop1): Quota format mount options ignored when QUOTA feature is enabled [ 962.830341][ T7072] EXT4-fs (loop1): unsupported descriptor size 0 [ 962.890407][ T7084] loop4: detected capacity change from 0 to 16 [ 962.903999][ T7072] loop1: detected capacity change from 0 to 4 [ 962.919082][ T7072] EXT4-fs (loop1): Quota format mount options ignored when QUOTA feature is enabled [ 962.928504][ T7072] EXT4-fs (loop1): unsupported descriptor size 0 07:14:53 executing program 0: syz_mount_image$vfat(&(0x7f00000002c0), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f736617e43c00088020000200000004f8000020004000000000000000000001", 0x25}, {0x0, 0x0, 0x200000000011000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6900) ftruncate(r0, 0x800) lseek(r0, 0x1200, 0x0) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, r1, 0x0, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @private2}, 0x1c) sendfile(r0, r1, 0x0, 0x108d1521) r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_FEATURES_SET(r2, 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHGPRL(0xffffffffffffffff, 0x89f7, &(0x7f00000001c0)={'ip6tnl0\x00', 0x0}) sendmsg$ETHTOOL_MSG_LINKINFO_GET(0xffffffffffffffff, 0x0, 0x0) sendfile(r0, r1, 0x0, 0x8400fffffffa) close(0xffffffffffffffff) r3 = open(&(0x7f0000000080)='./bus\x00', 0x100, 0x1aa) sendmsg$BATADV_CMD_GET_TRANSTABLE_LOCAL(r3, &(0x7f0000000280)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000240)={&(0x7f0000000180)={0x14, 0x0, 0x500, 0x70bd25, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x90}, 0x20044008) 07:14:53 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\v\x00\x00\x00\x00', 0xfffffffffffffffe) 07:14:53 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x100, 0x0}) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x28000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_config_ext={0x5, 0x8}, 0x4000, 0x0, 0x9, 0x7, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000001440)) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r1, 0xd000943e, 0x0) clone(0x40808000, 0x0, 0x0, 0x0, 0x0) r2 = gettid() tkill(r2, 0x1e) r3 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r3, 0x0) ptrace$cont(0x18, 0x0, 0x0, 0x1) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ptrace$cont(0x7, 0x0, 0x0, 0x10001) openat$full(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x4, 0x4, 0xe0, 0xb, 0x0, 0x0, 0x8000, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x8004, 0x2, @perf_bp={0x0}, 0x4000, 0x8000, 0xfffffff9, 0x7, 0x80000001, 0x8, 0x0, 0x0, 0xa, 0x0, 0x100000000}, r2, 0x8, 0xffffffffffffffff, 0x6ee4ca8bd5713173) 07:14:53 executing program 1: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000180)='./file1\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="20000000360000001900000060008f000ff68f010000000d0000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}], 0x0, &(0x7f0000000140)={[{@jqfmt_vfsv0}]}) 07:14:53 executing program 3: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000, 0x0, 0x0, 0x19}]) 07:14:53 executing program 4: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16002, 0x300}]) [ 963.435493][ T7103] loop4: detected capacity change from 0 to 16 [ 963.453687][ T7106] loop3: detected capacity change from 0 to 16 [ 963.460218][ T7108] loop1: detected capacity change from 0 to 4 07:14:53 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\f\x00\x00\x00\x00', 0xfffffffffffffffe) [ 963.483854][ T7108] EXT4-fs (loop1): Quota format mount options ignored when QUOTA feature is enabled [ 963.493271][ T7108] EXT4-fs (loop1): unsupported descriptor size 0 07:14:53 executing program 3: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000, 0x0, 0x0, 0x1a}]) 07:14:53 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\r\x00\x00\x00\x00', 0xfffffffffffffffe) [ 963.546389][ T7108] loop1: detected capacity change from 0 to 4 [ 963.560229][ T7108] EXT4-fs (loop1): Quota format mount options ignored when QUOTA feature is enabled [ 963.569705][ T7108] EXT4-fs (loop1): unsupported descriptor size 0 07:14:53 executing program 1: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000180)='./file1\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="20000000360000001900000060008f000ff68f010000000e0000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}], 0x0, &(0x7f0000000140)={[{@jqfmt_vfsv0}]}) 07:14:53 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x0e\x00\x00\x00\x00', 0xfffffffffffffffe) [ 963.670557][ T7153] loop3: detected capacity change from 0 to 16 [ 963.706445][ T7160] loop1: detected capacity change from 0 to 4 07:14:53 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x0f\x00\x00\x00\x00', 0xfffffffffffffffe) [ 963.723025][ T7160] EXT4-fs (loop1): Quota format mount options ignored when QUOTA feature is enabled [ 963.732448][ T7160] EXT4-fs (loop1): unsupported descriptor size 0 [ 963.740506][ T7153] attempt to access beyond end of device [ 963.740506][ T7153] loop3: rw=34817, want=184, limit=16 [ 963.794139][ T7160] loop1: detected capacity change from 0 to 4 [ 963.814383][ T7160] EXT4-fs (loop1): Quota format mount options ignored when QUOTA feature is enabled [ 963.823814][ T7160] EXT4-fs (loop1): unsupported descriptor size 0 07:14:54 executing program 0: r0 = syz_mount_image$vfat(&(0x7f00000002c0), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f736617e43c00088020000200000004f8000020004000000000000000000001", 0x25}, {0x0, 0x0, 0x200000000011000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r1 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6900) ftruncate(r1, 0x800) lseek(r1, 0x1200, 0x0) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, 0x0, 0x0) r2 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, r2, 0x0, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @private2}, 0x1c) openat$pidfd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) sendfile(r0, r2, 0x0, 0x108d1521) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_FEATURES_SET(r3, 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHGPRL(0xffffffffffffffff, 0x89f7, &(0x7f00000001c0)={'ip6tnl0\x00', 0x0}) sendmsg$ETHTOOL_MSG_LINKINFO_GET(0xffffffffffffffff, 0x0, 0x0) sendfile(r1, r2, 0x0, 0x8400fffffffa) close(0xffffffffffffffff) 07:14:54 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x100, 0x0}) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x28000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_config_ext={0x5, 0x8}, 0x4000, 0x0, 0x9, 0x7, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000001440)) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r1, 0xd000943e, 0x0) clone(0x40808000, 0x0, 0x0, 0x0, 0x0) r2 = gettid() tkill(r2, 0x1e) r3 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r3, 0x0) ptrace$cont(0x18, 0x0, 0x0, 0x1) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ptrace$cont(0x7, 0x0, 0x0, 0x10001) openat$full(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x0, 0x80, 0x4, 0x4, 0xe0, 0xb, 0x0, 0x0, 0x8000, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x8004, 0x2, @perf_bp={0x0}, 0x4000, 0x8000, 0xfffffff9, 0x7, 0x80000001, 0x8, 0x0, 0x0, 0xa, 0x0, 0x100000000}, r2, 0x8, 0xffffffffffffffff, 0x6ee4ca8bd5713173) 07:14:54 executing program 4: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16002, 0x408}]) 07:14:54 executing program 1: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000180)='./file1\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="20000000360000001900000060008f000ff68f010000000f0000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}], 0x0, &(0x7f0000000140)={[{@jqfmt_vfsv0}]}) 07:14:54 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x10\x00\x00\x00\x00', 0xfffffffffffffffe) 07:14:54 executing program 3: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000, 0x0, 0x0, 0x1b}]) [ 964.447235][ T7198] loop1: detected capacity change from 0 to 4 [ 964.456106][ T7200] loop3: detected capacity change from 0 to 16 [ 964.460876][ T7198] EXT4-fs (loop1): Quota format mount options ignored when QUOTA feature is enabled [ 964.464004][ C1] scsi_io_completion_action: 2 callbacks suppressed [ 964.464027][ C1] sd 0:0:1:0: [sg0] tag#5691 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 964.471708][ T7198] EXT4-fs (loop1): unsupported descriptor size 0 07:14:54 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x11\x00\x00\x00\x00', 0xfffffffffffffffe) 07:14:54 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x12\x00\x00\x00\x00', 0xfffffffffffffffe) [ 964.494935][ C1] sd 0:0:1:0: [sg0] tag#5691 CDB: opcode=0xe5 (vendor) [ 964.501803][ C1] sd 0:0:1:0: [sg0] tag#5691 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 964.511385][ C1] sd 0:0:1:0: [sg0] tag#5691 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 964.520924][ C1] sd 0:0:1:0: [sg0] tag#5691 CDB[20]: ba 07:14:54 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x100, 0x0}) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x28000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_config_ext={0x5, 0x8}, 0x4000, 0x0, 0x9, 0x7, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000001440)) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r1, 0xd000943e, 0x0) clone(0x40808000, 0x0, 0x0, 0x0, 0x0) r2 = gettid() tkill(r2, 0x1e) r3 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r3, 0x0) ptrace$cont(0x18, 0x0, 0x0, 0x1) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ptrace$cont(0x7, 0x0, 0x0, 0x10001) openat$full(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x2, 0x80, 0x0, 0x4, 0xe0, 0xb, 0x0, 0x0, 0x8000, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x8004, 0x2, @perf_bp={0x0}, 0x4000, 0x8000, 0xfffffff9, 0x7, 0x80000001, 0x8, 0x0, 0x0, 0xa, 0x0, 0x100000000}, r2, 0x8, 0xffffffffffffffff, 0x6ee4ca8bd5713173) 07:14:54 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00H\x00\x00\x00\x00', 0xfffffffffffffffe) [ 964.585199][ T7228] loop4: detected capacity change from 0 to 16 [ 964.633403][ C0] sd 0:0:1:0: [sg0] tag#5652 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 964.636281][ T7198] loop1: detected capacity change from 0 to 4 [ 964.643782][ C0] sd 0:0:1:0: [sg0] tag#5652 CDB: opcode=0xe5 (vendor) [ 964.643803][ C0] sd 0:0:1:0: [sg0] tag#5652 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 964.654236][ T7198] EXT4-fs (loop1): Quota format mount options ignored when QUOTA feature is enabled 07:14:54 executing program 3: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000, 0x0, 0x0, 0x1c}]) 07:14:54 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00L\x00\x00\x00\x00', 0xfffffffffffffffe) [ 964.656725][ C0] sd 0:0:1:0: [sg0] tag#5652 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 964.656742][ C0] sd 0:0:1:0: [sg0] tag#5652 CDB[20]: ba [ 964.690978][ T7198] EXT4-fs (loop1): unsupported descriptor size 0 [ 964.801582][ T7264] loop3: detected capacity change from 0 to 16 [ 964.829402][ T7264] attempt to access beyond end of device [ 964.829402][ T7264] loop3: rw=34817, want=184, limit=16 07:14:55 executing program 0: syz_mount_image$vfat(&(0x7f00000002c0), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f736617e43c00088020000200000004f8000020004000000000000000000001", 0x25}, {0x0, 0x0, 0x200000000011000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6900) ftruncate(r0, 0x800) lseek(r0, 0x1200, 0x0) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) r2 = socket$inet(0x2, 0xa, 0x0) sendto$inet(r2, 0x0, 0x0, 0x24000884, &(0x7f0000000240)={0x2, 0x0, @loopback}, 0x10) sendfile(0xffffffffffffffff, r2, 0x0, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @private2}, 0x1c) sendfile(0xffffffffffffffff, r1, 0x0, 0x108d1521) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_FEATURES_SET(r3, 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHGPRL(0xffffffffffffffff, 0x89f7, &(0x7f00000001c0)={'ip6tnl0\x00', 0x0}) sendmsg$ETHTOOL_MSG_LINKINFO_GET(0xffffffffffffffff, 0x0, 0x0) sendfile(r0, r1, 0x0, 0x8400fffffffa) close(0xffffffffffffffff) 07:14:55 executing program 1: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000180)='./file1\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="20000000360000001900000060008f000ff68f01000020100000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}], 0x0, &(0x7f0000000140)={[{@jqfmt_vfsv0}]}) 07:14:55 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x100, 0x0}) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x28000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_config_ext={0x5, 0x8}, 0x4000, 0x0, 0x9, 0x7, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000001440)) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r1, 0xd000943e, 0x0) clone(0x40808000, 0x0, 0x0, 0x0, 0x0) r2 = gettid() tkill(r2, 0x1e) r3 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r3, 0x0) ptrace$cont(0x18, 0x0, 0x0, 0x1) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ptrace$cont(0x7, 0x0, 0x0, 0x10001) openat$full(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x2, 0x80, 0x0, 0x4, 0xe0, 0xb, 0x0, 0x0, 0x8000, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x8004, 0x2, @perf_bp={0x0}, 0x4000, 0x8000, 0xfffffff9, 0x7, 0x80000001, 0x8, 0x0, 0x0, 0xa, 0x0, 0x100000000}, r2, 0x8, 0xffffffffffffffff, 0x6ee4ca8bd5713173) 07:14:55 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00h\x00\x00\x00\x00', 0xfffffffffffffffe) 07:14:55 executing program 3: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000, 0x0, 0x0, 0x1d}]) 07:14:55 executing program 4: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16002, 0x500}]) [ 965.297917][ T7288] loop1: detected capacity change from 0 to 4 [ 965.311542][ T7292] loop3: detected capacity change from 0 to 16 [ 965.311719][ C0] sd 0:0:1:0: [sg0] tag#5634 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 965.328033][ C0] sd 0:0:1:0: [sg0] tag#5634 CDB: opcode=0xe5 (vendor) [ 965.334875][ C0] sd 0:0:1:0: [sg0] tag#5634 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 965.344414][ C0] sd 0:0:1:0: [sg0] tag#5634 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 965.345196][ T7296] loop4: detected capacity change from 0 to 16 [ 965.353957][ C0] sd 0:0:1:0: [sg0] tag#5634 CDB[20]: ba [ 965.379176][ T7288] EXT4-fs (loop1): Quota format mount options ignored when QUOTA feature is enabled [ 965.388611][ T7288] EXT4-fs (loop1): unsupported descriptor size 0 07:14:55 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00l\x00\x00\x00\x00', 0xfffffffffffffffe) 07:14:55 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00t\x00\x00\x00\x00', 0xfffffffffffffffe) [ 965.434612][ T7288] loop1: detected capacity change from 0 to 4 [ 965.461221][ T7288] EXT4-fs (loop1): Quota format mount options ignored when QUOTA feature is enabled [ 965.470693][ T7288] EXT4-fs (loop1): unsupported descriptor size 0 07:14:55 executing program 1: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000180)='./file1\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="20000000360000001900000060008f000ff68f01000000110000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}], 0x0, &(0x7f0000000140)={[{@jqfmt_vfsv0}]}) 07:14:55 executing program 3: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000, 0x0, 0x0, 0x1e}]) 07:14:55 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00z\x00\x00\x00\x00', 0xfffffffffffffffe) 07:14:55 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x100, 0x0}) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x28000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_config_ext={0x5, 0x8}, 0x4000, 0x0, 0x9, 0x7, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000001440)) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r1, 0xd000943e, 0x0) clone(0x40808000, 0x0, 0x0, 0x0, 0x0) r2 = gettid() tkill(r2, 0x1e) r3 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r3, 0x0) ptrace$cont(0x18, 0x0, 0x0, 0x1) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ptrace$cont(0x7, 0x0, 0x0, 0x10001) openat$full(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x2, 0x80, 0x0, 0x4, 0xe0, 0xb, 0x0, 0x0, 0x8000, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x8004, 0x2, @perf_bp={0x0}, 0x4000, 0x8000, 0xfffffff9, 0x7, 0x80000001, 0x8, 0x0, 0x0, 0xa, 0x0, 0x100000000}, r2, 0x8, 0xffffffffffffffff, 0x6ee4ca8bd5713173) [ 965.580148][ T7333] loop1: detected capacity change from 0 to 4 [ 965.631086][ T7333] EXT4-fs (loop1): Quota format mount options ignored when QUOTA feature is enabled [ 965.640508][ T7333] EXT4-fs (loop1): unsupported descriptor size 0 [ 965.649888][ T7346] loop3: detected capacity change from 0 to 16 [ 965.669726][ C0] sd 0:0:1:0: [sg0] tag#5672 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 965.680104][ C0] sd 0:0:1:0: [sg0] tag#5672 CDB: opcode=0xe5 (vendor) [ 965.686972][ C0] sd 0:0:1:0: [sg0] tag#5672 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 965.696607][ C0] sd 0:0:1:0: [sg0] tag#5672 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 965.696852][ T7346] attempt to access beyond end of device [ 965.696852][ T7346] loop3: rw=34817, want=184, limit=16 [ 965.706181][ C0] sd 0:0:1:0: [sg0] tag#5672 CDB[20]: ba [ 965.774824][ T7333] loop1: detected capacity change from 0 to 4 [ 965.783373][ T7333] EXT4-fs (loop1): Quota format mount options ignored when QUOTA feature is enabled [ 965.792835][ T7333] EXT4-fs (loop1): unsupported descriptor size 0 07:14:56 executing program 3: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000, 0x0, 0x0, 0x22}]) 07:14:56 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x03\x00\x00\x00', 0xfffffffffffffffe) 07:14:56 executing program 4: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16002, 0x600}]) 07:14:56 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x100, 0x0}) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x28000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_config_ext={0x5, 0x8}, 0x4000, 0x0, 0x9, 0x7, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000001440)) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r1, 0xd000943e, 0x0) clone(0x40808000, 0x0, 0x0, 0x0, 0x0) r2 = gettid() tkill(r2, 0x1e) r3 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r3, 0x0) ptrace$cont(0x18, 0x0, 0x0, 0x1) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ptrace$cont(0x7, 0x0, 0x0, 0x10001) openat$full(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x2, 0x80, 0x4, 0x0, 0xe0, 0xb, 0x0, 0x0, 0x8000, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x8004, 0x2, @perf_bp={0x0}, 0x4000, 0x8000, 0xfffffff9, 0x7, 0x80000001, 0x8, 0x0, 0x0, 0xa, 0x0, 0x100000000}, r2, 0x8, 0xffffffffffffffff, 0x6ee4ca8bd5713173) 07:14:56 executing program 0: r0 = syz_mount_image$vfat(&(0x7f00000002c0), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f736617e43c00088020000200000004f8000020004000000000000000000001", 0x25}, {0x0, 0x0, 0x200000000011000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r1 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6900) ftruncate(r1, 0x800) lseek(r1, 0x1200, 0x0) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, 0x0, 0x0) r2 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, r2, 0x0, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @private2}, 0x1c) sendfile(r1, r2, 0x0, 0x108d1521) open(&(0x7f0000000140)='./bus\x00', 0x101000, 0xde) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_FEATURES_SET(r2, 0x0, 0x8044) ioctl$sock_ipv6_tunnel_SIOCCHGPRL(0xffffffffffffffff, 0x89f7, &(0x7f00000001c0)={'ip6tnl0\x00', 0x0}) sendmsg$ETHTOOL_MSG_LINKINFO_GET(0xffffffffffffffff, 0x0, 0x0) ftruncate(r0, 0xf0) sendfile(r1, r2, 0x0, 0x8400fffffffa) close(0xffffffffffffffff) 07:14:56 executing program 1: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000180)='./file1\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="20000000360000001900000060008f000ff68f01000000120000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}], 0x0, &(0x7f0000000140)={[{@jqfmt_vfsv0}]}) [ 966.242147][ T7380] loop3: detected capacity change from 0 to 16 [ 966.275574][ T7380] attempt to access beyond end of device [ 966.275574][ T7380] loop3: rw=34817, want=184, limit=16 [ 966.276510][ C1] sd 0:0:1:0: [sg0] tag#5683 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 966.296789][ C1] sd 0:0:1:0: [sg0] tag#5683 CDB: opcode=0xe5 (vendor) [ 966.303672][ C1] sd 0:0:1:0: [sg0] tag#5683 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 966.311642][ T7384] loop1: detected capacity change from 0 to 4 [ 966.313228][ C1] sd 0:0:1:0: [sg0] tag#5683 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 966.328805][ C1] sd 0:0:1:0: [sg0] tag#5683 CDB[20]: ba 07:14:56 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x05\x00\x00\x00', 0xfffffffffffffffe) [ 966.342269][ T7384] EXT4-fs (loop1): Quota format mount options ignored when QUOTA feature is enabled [ 966.351689][ T7384] EXT4-fs (loop1): unsupported descriptor size 0 [ 966.360265][ T7400] loop4: detected capacity change from 0 to 16 07:14:56 executing program 3: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000, 0x0, 0x0, 0xb0}]) 07:14:56 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x06\x00\x00\x00', 0xfffffffffffffffe) [ 966.452919][ T7384] loop1: detected capacity change from 0 to 4 [ 966.475102][ T7420] loop3: detected capacity change from 0 to 16 [ 966.490980][ T7384] EXT4-fs (loop1): Quota format mount options ignored when QUOTA feature is enabled [ 966.500374][ T7384] EXT4-fs (loop1): unsupported descriptor size 0 07:14:56 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x100, 0x0}) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x28000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_config_ext={0x5, 0x8}, 0x4000, 0x0, 0x9, 0x7, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000001440)) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r1, 0xd000943e, 0x0) clone(0x40808000, 0x0, 0x0, 0x0, 0x0) r2 = gettid() tkill(r2, 0x1e) r3 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r3, 0x0) ptrace$cont(0x18, 0x0, 0x0, 0x1) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ptrace$cont(0x7, 0x0, 0x0, 0x10001) openat$full(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x2, 0x80, 0x4, 0x0, 0xe0, 0xb, 0x0, 0x0, 0x8000, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x8004, 0x2, @perf_bp={0x0}, 0x4000, 0x8000, 0xfffffff9, 0x7, 0x80000001, 0x8, 0x0, 0x0, 0xa, 0x0, 0x100000000}, r2, 0x8, 0xffffffffffffffff, 0x6ee4ca8bd5713173) [ 966.539889][ T7420] attempt to access beyond end of device [ 966.539889][ T7420] loop3: rw=34817, want=184, limit=16 07:14:56 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\a\x00\x00\x00', 0xfffffffffffffffe) 07:14:56 executing program 1: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000180)='./file1\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="20000000360000001900000060008f000ff68f01000000200000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}], 0x0, &(0x7f0000000140)={[{@jqfmt_vfsv0}]}) [ 966.580864][ C0] sd 0:0:1:0: [sg0] tag#5685 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 966.591254][ C0] sd 0:0:1:0: [sg0] tag#5685 CDB: opcode=0xe5 (vendor) [ 966.598117][ C0] sd 0:0:1:0: [sg0] tag#5685 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 966.607692][ C0] sd 0:0:1:0: [sg0] tag#5685 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 966.617255][ C0] sd 0:0:1:0: [sg0] tag#5685 CDB[20]: ba 07:14:56 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\t\x00\x00\x00', 0xfffffffffffffffe) 07:14:56 executing program 3: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000, 0x0, 0x0, 0xef}]) [ 966.707744][ T7443] loop1: detected capacity change from 0 to 4 [ 966.724447][ T7443] EXT4-fs (loop1): Quota format mount options ignored when QUOTA feature is enabled [ 966.733874][ T7443] EXT4-fs (loop1): unsupported descriptor size 0 [ 966.780744][ T7465] loop3: detected capacity change from 0 to 16 [ 966.795954][ T7443] loop1: detected capacity change from 0 to 4 07:14:57 executing program 3: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000, 0x0, 0x0, 0xf2}]) 07:14:57 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x100, 0x0}) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x28000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_config_ext={0x5, 0x8}, 0x4000, 0x0, 0x9, 0x7, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000001440)) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r1, 0xd000943e, 0x0) clone(0x40808000, 0x0, 0x0, 0x0, 0x0) r2 = gettid() tkill(r2, 0x1e) r3 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r3, 0x0) ptrace$cont(0x18, 0x0, 0x0, 0x1) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ptrace$cont(0x7, 0x0, 0x0, 0x10001) openat$full(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x2, 0x80, 0x4, 0x0, 0xe0, 0xb, 0x0, 0x0, 0x8000, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x8004, 0x2, @perf_bp={0x0}, 0x4000, 0x8000, 0xfffffff9, 0x7, 0x80000001, 0x8, 0x0, 0x0, 0xa, 0x0, 0x100000000}, r2, 0x8, 0xffffffffffffffff, 0x6ee4ca8bd5713173) [ 966.846740][ T7443] EXT4-fs (loop1): Quota format mount options ignored when QUOTA feature is enabled [ 966.856183][ T7443] EXT4-fs (loop1): unsupported descriptor size 0 [ 966.909105][ C0] sd 0:0:1:0: [sg0] tag#5688 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 966.919447][ C0] sd 0:0:1:0: [sg0] tag#5688 CDB: opcode=0xe5 (vendor) [ 966.926301][ C0] sd 0:0:1:0: [sg0] tag#5688 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 966.935856][ C0] sd 0:0:1:0: [sg0] tag#5688 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 966.945430][ C0] sd 0:0:1:0: [sg0] tag#5688 CDB[20]: ba [ 967.017816][ T7486] loop3: detected capacity change from 0 to 16 [ 967.055829][ T7486] attempt to access beyond end of device [ 967.055829][ T7486] loop3: rw=34817, want=184, limit=16 07:14:57 executing program 0: syz_mount_image$vfat(&(0x7f00000002c0), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f736617e43c00088020000200000004f8000020004000000000000000000001", 0x25}, {0x0, 0x0, 0x200000000011000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6900) ftruncate(r0, 0x800) lseek(r0, 0x1200, 0x0) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) r2 = openat$random(0xffffffffffffff9c, &(0x7f0000000080), 0x80, 0x0) write(r2, &(0x7f0000000140)="dc1dbed38065e317e9f0a8428a7d5653d248c42d2fd894e37daabffcca850e68aafc0b3fc6304e42fddf168a5ce609758542fce538ae4f9bd49736c8476b254364233006", 0x44) sendfile(0xffffffffffffffff, r1, 0x0, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @private2}, 0x1c) sendfile(r0, r1, 0x0, 0x108d1521) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_FEATURES_SET(r3, 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHGPRL(0xffffffffffffffff, 0x89f7, &(0x7f00000001c0)={'ip6tnl0\x00', 0x0}) sendmsg$ETHTOOL_MSG_LINKINFO_GET(0xffffffffffffffff, 0x0, 0x0) sendfile(r0, r1, 0x0, 0x8400fffffffa) close(0xffffffffffffffff) 07:14:57 executing program 4: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16002, 0x804}]) 07:14:57 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\n\x00\x00\x00', 0xfffffffffffffffe) 07:14:57 executing program 1: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000180)='./file1\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="20000000360000001900000060008f000ff68f01000010200000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}], 0x0, &(0x7f0000000140)={[{@jqfmt_vfsv0}]}) 07:14:57 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x100, 0x0}) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x28000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_config_ext={0x5, 0x8}, 0x4000, 0x0, 0x9, 0x7, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000001440)) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r1, 0xd000943e, 0x0) clone(0x40808000, 0x0, 0x0, 0x0, 0x0) r2 = gettid() tkill(r2, 0x1e) r3 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r3, 0x0) ptrace$cont(0x18, 0x0, 0x0, 0x1) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ptrace$cont(0x7, 0x0, 0x0, 0x10001) openat$full(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x2, 0x80, 0x4, 0x4, 0x0, 0xb, 0x0, 0x0, 0x8000, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x8004, 0x2, @perf_bp={0x0}, 0x4000, 0x8000, 0xfffffff9, 0x7, 0x80000001, 0x8, 0x0, 0x0, 0xa, 0x0, 0x100000000}, r2, 0x8, 0xffffffffffffffff, 0x6ee4ca8bd5713173) 07:14:57 executing program 3: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000, 0x0, 0x0, 0xf7}]) 07:14:57 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\v\x00\x00\x00', 0xfffffffffffffffe) [ 967.277749][ C0] sd 0:0:1:0: [sg0] tag#5642 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 967.288117][ C0] sd 0:0:1:0: [sg0] tag#5642 CDB: opcode=0xe5 (vendor) [ 967.289749][ T7510] loop3: detected capacity change from 0 to 16 [ 967.294979][ C0] sd 0:0:1:0: [sg0] tag#5642 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 967.310664][ C0] sd 0:0:1:0: [sg0] tag#5642 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 967.320239][ C0] sd 0:0:1:0: [sg0] tag#5642 CDB[20]: ba [ 967.333707][ T7511] loop1: detected capacity change from 0 to 4 07:14:57 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\f\x00\x00\x00', 0xfffffffffffffffe) [ 967.387221][ T7527] loop4: detected capacity change from 0 to 16 [ 967.416382][ T7511] EXT4-fs (loop1): Quota format mount options ignored when QUOTA feature is enabled [ 967.425790][ T7511] EXT4-fs (loop1): unsupported descriptor size 0 07:14:57 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\r\x00\x00\x00', 0xfffffffffffffffe) 07:14:57 executing program 3: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000, 0x0, 0x0, 0xf8}]) 07:14:57 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x100, 0x0}) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x28000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_config_ext={0x5, 0x8}, 0x4000, 0x0, 0x9, 0x7, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000001440)) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r1, 0xd000943e, 0x0) clone(0x40808000, 0x0, 0x0, 0x0, 0x0) r2 = gettid() tkill(r2, 0x1e) r3 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r3, 0x0) ptrace$cont(0x18, 0x0, 0x0, 0x1) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ptrace$cont(0x7, 0x0, 0x0, 0x10001) openat$full(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x2, 0x80, 0x4, 0x4, 0x0, 0xb, 0x0, 0x0, 0x8000, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x8004, 0x2, @perf_bp={0x0}, 0x4000, 0x8000, 0xfffffff9, 0x7, 0x80000001, 0x8, 0x0, 0x0, 0xa, 0x0, 0x100000000}, r2, 0x8, 0xffffffffffffffff, 0x6ee4ca8bd5713173) [ 967.500693][ T7511] loop1: detected capacity change from 0 to 4 [ 967.529501][ T7511] EXT4-fs (loop1): Quota format mount options ignored when QUOTA feature is enabled [ 967.538933][ T7511] EXT4-fs (loop1): unsupported descriptor size 0 07:14:57 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x0e\x00\x00\x00', 0xfffffffffffffffe) [ 967.561598][ C1] sd 0:0:1:0: [sg0] tag#5684 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 967.571988][ C1] sd 0:0:1:0: [sg0] tag#5684 CDB: opcode=0xe5 (vendor) [ 967.578835][ C1] sd 0:0:1:0: [sg0] tag#5684 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 967.586619][ T7554] loop3: detected capacity change from 0 to 16 [ 967.588424][ C1] sd 0:0:1:0: [sg0] tag#5684 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 967.604089][ C1] sd 0:0:1:0: [sg0] tag#5684 CDB[20]: ba [ 967.647343][ T7554] attempt to access beyond end of device [ 967.647343][ T7554] loop3: rw=34817, want=184, limit=16 [ 967.748007][ T7166] attempt to access beyond end of device [ 967.748007][ T7166] loop4: rw=1, want=256, limit=16 07:14:58 executing program 0: syz_mount_image$vfat(&(0x7f00000002c0), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f736617e43c00088020000200000004f8000020004000000000000000000001", 0x25}, {0x0, 0x0, 0x200000000011000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000080)='./file0/../file0\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6900) ftruncate(r0, 0x800) lseek(r0, 0x1200, 0x0) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, r1, 0x0, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @private2}, 0x1c) sendfile(r0, r1, 0x0, 0x108d1521) r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_FEATURES_SET(r2, 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHGPRL(0xffffffffffffffff, 0x89f7, &(0x7f00000001c0)={'ip6tnl0\x00', 0x0}) sendmsg$ETHTOOL_MSG_LINKINFO_GET(0xffffffffffffffff, 0x0, 0x0) sendfile(r0, r1, 0x0, 0x8400fffffffa) close(0xffffffffffffffff) 07:14:58 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x0f\x00\x00\x00', 0xfffffffffffffffe) 07:14:58 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x100, 0x0}) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x28000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_config_ext={0x5, 0x8}, 0x4000, 0x0, 0x9, 0x7, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000001440)) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r1, 0xd000943e, 0x0) clone(0x40808000, 0x0, 0x0, 0x0, 0x0) r2 = gettid() tkill(r2, 0x1e) r3 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r3, 0x0) ptrace$cont(0x18, 0x0, 0x0, 0x1) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ptrace$cont(0x7, 0x0, 0x0, 0x10001) openat$full(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x2, 0x80, 0x4, 0x4, 0x0, 0xb, 0x0, 0x0, 0x8000, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x8004, 0x2, @perf_bp={0x0}, 0x4000, 0x8000, 0xfffffff9, 0x7, 0x80000001, 0x8, 0x0, 0x0, 0xa, 0x0, 0x100000000}, r2, 0x8, 0xffffffffffffffff, 0x6ee4ca8bd5713173) 07:14:58 executing program 1: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000180)='./file1\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="20000000360000001900000060008f000ff68f01000000220000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}], 0x0, &(0x7f0000000140)={[{@jqfmt_vfsv0}]}) 07:14:58 executing program 4: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16002, 0x900}]) 07:14:58 executing program 3: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000, 0x0, 0x0, 0x204}]) 07:14:58 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x11\x00\x00\x00', 0xfffffffffffffffe) [ 968.248958][ T7585] loop3: detected capacity change from 0 to 16 [ 968.255445][ C1] sd 0:0:1:0: [sg0] tag#5651 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 968.265801][ C1] sd 0:0:1:0: [sg0] tag#5651 CDB: opcode=0xe5 (vendor) [ 968.272696][ C1] sd 0:0:1:0: [sg0] tag#5651 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 968.282263][ C1] sd 0:0:1:0: [sg0] tag#5651 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 968.291824][ C1] sd 0:0:1:0: [sg0] tag#5651 CDB[20]: ba 07:14:58 executing program 0: syz_mount_image$vfat(&(0x7f00000002c0), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f736617e43c00088020000200000004f8000020004000000000000000000001", 0x25}, {0x0, 0x0, 0x200000000011000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6900) ftruncate(r0, 0x800) lseek(r0, 0x1200, 0x0) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x8) sendfile(0xffffffffffffffff, r1, 0x0, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @private2}, 0x1c) r2 = socket$inet(0x2, 0x1, 0x0) sendto$inet(r2, 0x0, 0x0, 0x24000884, &(0x7f0000000240)={0x2, 0x0, @loopback}, 0x10) sendfile(r0, r2, 0x0, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_FEATURES_SET(r3, 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHGPRL(0xffffffffffffffff, 0x89f7, &(0x7f00000001c0)={'ip6tnl0\x00', 0x0}) sendmsg$ETHTOOL_MSG_LINKINFO_GET(0xffffffffffffffff, 0x0, 0x0) sendfile(r0, r1, 0x0, 0x8400fffffffa) close(0xffffffffffffffff) [ 968.303299][ T7589] loop1: detected capacity change from 0 to 4 07:14:58 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x12\x00\x00\x00', 0xfffffffffffffffe) 07:14:58 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x100, 0x0}) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x28000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_config_ext={0x5, 0x8}, 0x4000, 0x0, 0x9, 0x7, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000001440)) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r1, 0xd000943e, 0x0) clone(0x40808000, 0x0, 0x0, 0x0, 0x0) r2 = gettid() tkill(r2, 0x1e) r3 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r3, 0x0) ptrace$cont(0x18, 0x0, 0x0, 0x1) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ptrace$cont(0x7, 0x0, 0x0, 0x10001) openat$full(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x2, 0x80, 0x4, 0x4, 0xe0, 0x0, 0x0, 0x0, 0x8000, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x8004, 0x2, @perf_bp={0x0}, 0x4000, 0x8000, 0xfffffff9, 0x7, 0x80000001, 0x8, 0x0, 0x0, 0xa, 0x0, 0x100000000}, r2, 0x8, 0xffffffffffffffff, 0x6ee4ca8bd5713173) [ 968.354971][ T7589] EXT4-fs (loop1): Quota format mount options ignored when QUOTA feature is enabled [ 968.364413][ T7589] EXT4-fs (loop1): unsupported descriptor size 0 [ 968.425328][ T7589] loop1: detected capacity change from 0 to 4 [ 968.437345][ T7589] EXT4-fs (loop1): Quota format mount options ignored when QUOTA feature is enabled [ 968.446761][ T7589] EXT4-fs (loop1): unsupported descriptor size 0 07:14:58 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00H\x00\x00\x00', 0xfffffffffffffffe) 07:14:58 executing program 3: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000, 0x0, 0x0, 0x300}]) [ 968.475925][ T7629] loop4: detected capacity change from 0 to 16 07:14:58 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x100, 0x0}) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x28000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_config_ext={0x5, 0x8}, 0x4000, 0x0, 0x9, 0x7, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000001440)) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r1, 0xd000943e, 0x0) clone(0x40808000, 0x0, 0x0, 0x0, 0x0) r2 = gettid() tkill(r2, 0x1e) r3 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r3, 0x0) ptrace$cont(0x18, 0x0, 0x0, 0x1) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ptrace$cont(0x7, 0x0, 0x0, 0x10001) openat$full(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x2, 0x80, 0x4, 0x4, 0xe0, 0x0, 0x0, 0x0, 0x8000, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x8004, 0x2, @perf_bp={0x0}, 0x4000, 0x8000, 0xfffffff9, 0x7, 0x80000001, 0x8, 0x0, 0x0, 0xa, 0x0, 0x100000000}, r2, 0x8, 0xffffffffffffffff, 0x6ee4ca8bd5713173) 07:14:58 executing program 1: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000180)='./file1\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="20000000360000001900000060008f000ff68f01000000250000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}], 0x0, &(0x7f0000000140)={[{@jqfmt_vfsv0}]}) 07:14:58 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00L\x00\x00\x00', 0xfffffffffffffffe) [ 968.572180][ T7648] loop3: detected capacity change from 0 to 16 [ 968.597629][ T7652] loop1: detected capacity change from 0 to 4 07:14:58 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00h\x00\x00\x00', 0xfffffffffffffffe) [ 968.637745][ T7648] attempt to access beyond end of device [ 968.637745][ T7648] loop3: rw=34817, want=184, limit=16 [ 968.649042][ T7652] EXT4-fs (loop1): Quota format mount options ignored when QUOTA feature is enabled [ 968.658485][ T7652] EXT4-fs (loop1): unsupported descriptor size 0 [ 968.750188][ T7652] loop1: detected capacity change from 0 to 4 [ 968.769303][ T7652] EXT4-fs (loop1): Quota format mount options ignored when QUOTA feature is enabled [ 968.778723][ T7652] EXT4-fs (loop1): unsupported descriptor size 0 07:14:59 executing program 4: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16002, 0xc00}]) 07:14:59 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00l\x00\x00\x00', 0xfffffffffffffffe) 07:14:59 executing program 3: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000, 0x0, 0x0, 0x402}]) [ 968.884052][ T7694] loop3: detected capacity change from 0 to 16 [ 968.913196][ T7694] attempt to access beyond end of device [ 968.913196][ T7694] loop3: rw=34817, want=184, limit=16 [ 968.969573][ T7709] loop4: detected capacity change from 0 to 16 07:14:59 executing program 0: syz_mount_image$vfat(&(0x7f00000002c0), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f736617e43c00088020000200000004f8000020004000000000000000000001", 0x25}, {0x0, 0x0, 0x200000000011000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000180)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6900) ftruncate(r0, 0x800) lseek(r0, 0x1200, 0x0) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, r1, 0x0, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @private2}, 0x1c) sendfile(r0, r1, 0x0, 0x108d1521) r2 = openat$null(0xffffffffffffff9c, &(0x7f0000000080), 0xc0, 0x0) ioctl$sock_inet_tcp_SIOCINQ(r2, 0x541b, &(0x7f0000000140)) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_FEATURES_SET(r3, 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHGPRL(0xffffffffffffffff, 0x89f7, &(0x7f00000001c0)={'ip6tnl0\x00', 0x0}) sendmsg$ETHTOOL_MSG_LINKINFO_GET(0xffffffffffffffff, 0x0, 0x0) sendfile(r0, r1, 0x0, 0x8400fffffffa) close(0xffffffffffffffff) 07:14:59 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x100, 0x0}) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x28000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_config_ext={0x5, 0x8}, 0x4000, 0x0, 0x9, 0x7, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000001440)) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r1, 0xd000943e, 0x0) clone(0x40808000, 0x0, 0x0, 0x0, 0x0) r2 = gettid() tkill(r2, 0x1e) r3 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r3, 0x0) ptrace$cont(0x18, 0x0, 0x0, 0x1) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ptrace$cont(0x7, 0x0, 0x0, 0x10001) openat$full(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x2, 0x80, 0x4, 0x4, 0xe0, 0x0, 0x0, 0x0, 0x8000, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x8004, 0x2, @perf_bp={0x0}, 0x4000, 0x8000, 0xfffffff9, 0x7, 0x80000001, 0x8, 0x0, 0x0, 0xa, 0x0, 0x100000000}, r2, 0x8, 0xffffffffffffffff, 0x6ee4ca8bd5713173) 07:14:59 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00t\x00\x00\x00', 0xfffffffffffffffe) 07:14:59 executing program 1: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000180)='./file1\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="20000000360000001900000060008f000ff68f01000000280000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}], 0x0, &(0x7f0000000140)={[{@jqfmt_vfsv0}]}) 07:14:59 executing program 3: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000, 0x0, 0x0, 0x406}]) 07:14:59 executing program 4: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16002, 0x1200}]) 07:14:59 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00z\x00\x00\x00', 0xfffffffffffffffe) [ 969.266065][ T7727] loop1: detected capacity change from 0 to 4 [ 969.273082][ T7730] loop3: detected capacity change from 0 to 16 [ 969.291338][ T7727] EXT4-fs (loop1): Quota format mount options ignored when QUOTA feature is enabled [ 969.300727][ T7727] EXT4-fs (loop1): unsupported descriptor size 0 [ 969.336023][ T7730] attempt to access beyond end of device [ 969.336023][ T7730] loop3: rw=34817, want=184, limit=16 [ 969.358034][ T7751] loop4: detected capacity change from 0 to 16 [ 969.369639][ T7727] loop1: detected capacity change from 0 to 4 07:14:59 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x100, 0x0}) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x28000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_config_ext={0x5, 0x8}, 0x4000, 0x0, 0x9, 0x7, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000001440)) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r1, 0xd000943e, 0x0) clone(0x40808000, 0x0, 0x0, 0x0, 0x0) r2 = gettid() tkill(r2, 0x1e) r3 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r3, 0x0) ptrace$cont(0x18, 0x0, 0x0, 0x1) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ptrace$cont(0x7, 0x0, 0x0, 0x10001) openat$full(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x2, 0x80, 0x4, 0x4, 0xe0, 0xb, 0x0, 0x0, 0x0, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x8004, 0x2, @perf_bp={0x0}, 0x4000, 0x8000, 0xfffffff9, 0x7, 0x80000001, 0x8, 0x0, 0x0, 0xa, 0x0, 0x100000000}, r2, 0x8, 0xffffffffffffffff, 0x6ee4ca8bd5713173) [ 969.404027][ T7727] EXT4-fs (loop1): Quota format mount options ignored when QUOTA feature is enabled [ 969.413511][ T7727] EXT4-fs (loop1): unsupported descriptor size 0 07:14:59 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\xff\xff\xfe\x00\x00', 0xfffffffffffffffe) 07:14:59 executing program 3: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000, 0x0, 0x0, 0x500}]) 07:14:59 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\x00\x01\x00', 0xfffffffffffffffe) 07:14:59 executing program 1: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000180)='./file1\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="20000000360000001900000060008f000ff68f010000002e0000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}], 0x0, &(0x7f0000000140)={[{@jqfmt_vfsv0}]}) [ 969.470865][ T7751] attempt to access beyond end of device [ 969.470865][ T7751] loop4: rw=2049, want=200, limit=16 [ 969.522298][ T7782] loop1: detected capacity change from 0 to 4 [ 969.531468][ T7781] loop3: detected capacity change from 0 to 16 [ 969.532391][ T7782] EXT4-fs (loop1): Quota format mount options ignored when QUOTA feature is enabled [ 969.547051][ T7782] EXT4-fs (loop1): unsupported descriptor size 0 [ 969.580556][ T7781] attempt to access beyond end of device [ 969.580556][ T7781] loop3: rw=34817, want=184, limit=16 [ 969.625801][ T7782] loop1: detected capacity change from 0 to 4 [ 969.634471][ T7782] EXT4-fs (loop1): Quota format mount options ignored when QUOTA feature is enabled [ 969.643995][ T7782] EXT4-fs (loop1): unsupported descriptor size 0 07:15:00 executing program 1: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000180)='./file1\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="20000000360000001900000060008f000ff68f010000002f0000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}], 0x0, &(0x7f0000000140)={[{@jqfmt_vfsv0}]}) 07:15:00 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\x00\x02\x00', 0xfffffffffffffffe) 07:15:00 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x100, 0x0}) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x28000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_config_ext={0x5, 0x8}, 0x4000, 0x0, 0x9, 0x7, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000001440)) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r1, 0xd000943e, 0x0) clone(0x40808000, 0x0, 0x0, 0x0, 0x0) r2 = gettid() tkill(r2, 0x1e) r3 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r3, 0x0) ptrace$cont(0x18, 0x0, 0x0, 0x1) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ptrace$cont(0x7, 0x0, 0x0, 0x10001) openat$full(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x2, 0x80, 0x4, 0x4, 0xe0, 0xb, 0x0, 0x0, 0x0, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x8004, 0x2, @perf_bp={0x0}, 0x4000, 0x8000, 0xfffffff9, 0x7, 0x80000001, 0x8, 0x0, 0x0, 0xa, 0x0, 0x100000000}, r2, 0x8, 0xffffffffffffffff, 0x6ee4ca8bd5713173) 07:15:00 executing program 4: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16002, 0x1600}]) 07:15:00 executing program 0: syz_mount_image$vfat(&(0x7f00000002c0), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f736617e43c00088020000200000004f8000020004000000000000000000001", 0x25}, {0x0, 0x0, 0x200000000011000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6900) ftruncate(r0, 0x800) lseek(0xffffffffffffffff, 0x1200, 0x0) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x82) sendfile(0xffffffffffffffff, r1, 0x0, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @loopback, 0xbfffffff}, 0x1c) sendfile(r0, r1, 0x0, 0x108d1521) r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_FEATURES_SET(r2, 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHGPRL(0xffffffffffffffff, 0x89f7, &(0x7f00000001c0)={'ip6tnl0\x00', 0x0}) sendmsg$ETHTOOL_MSG_LINKINFO_GET(0xffffffffffffffff, 0x0, 0x0) accept$inet(r1, &(0x7f0000000080)={0x2, 0x0, @remote}, &(0x7f0000000140)=0x10) setsockopt$IP_VS_SO_SET_ZERO(r1, 0x0, 0x48f, &(0x7f0000000240)={0x3c, @loopback, 0x4e20, 0x0, 'fo\x00', 0xc, 0x4, 0x4f}, 0x2c) sendfile(r0, r1, 0x0, 0x8400fffffffa) close(0xffffffffffffffff) 07:15:00 executing program 3: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000, 0x0, 0x0, 0x600}]) [ 970.248610][ T7817] loop3: detected capacity change from 0 to 16 [ 970.256662][ T7821] loop1: detected capacity change from 0 to 4 [ 970.257308][ C0] scsi_io_completion_action: 3 callbacks suppressed [ 970.257330][ C0] sd 0:0:1:0: [sg0] tag#5672 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 970.279649][ C0] sd 0:0:1:0: [sg0] tag#5672 CDB: opcode=0xe5 (vendor) [ 970.285995][ T7821] EXT4-fs (loop1): Quota format mount options ignored when QUOTA feature is enabled 07:15:00 executing program 0: syz_mount_image$vfat(&(0x7f00000002c0), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f736617e43c00088020000200000004f8000020004000000000000000000001", 0x25}, {0x0, 0x0, 0x200000000011000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6900) ftruncate(r0, 0x800) lseek(r0, 0x1200, 0x0) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x204480, 0x0) sendfile(0xffffffffffffffff, r1, 0x0, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @private2}, 0x1c) sendfile(r0, r1, 0x0, 0x108d1521) r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_FEATURES_SET(r2, 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHGPRL(0xffffffffffffffff, 0x89f7, &(0x7f00000001c0)={'ip6tnl0\x00', 0x0}) sendmsg$ETHTOOL_MSG_LINKINFO_GET(0xffffffffffffffff, 0x0, 0x0) sendfile(r0, r1, 0x0, 0x8400fffffffa) close(0xffffffffffffffff) r3 = openat(0xffffffffffffffff, &(0x7f0000000080)='./file0\x00', 0x702, 0x2a) sendto$inet6(r3, &(0x7f0000000140)="829f2055534712f9a44c41deaf5d3218d989d7630fb488a57d88e122c7f4736710a1e2ffc2f9c582a6571d94945db1ccc8456567847649b391dd44282483afcaf7e486", 0x43, 0x20004004, &(0x7f0000000240)={0xa, 0x4e23, 0x80, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x9b5}, 0x1c) 07:15:00 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\x00\x03\x00', 0xfffffffffffffffe) [ 970.286541][ C0] sd 0:0:1:0: [sg0] tag#5672 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 970.295879][ T7821] EXT4-fs (loop1): unsupported descriptor size 0 [ 970.305401][ C0] sd 0:0:1:0: [sg0] tag#5672 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 970.321237][ C0] sd 0:0:1:0: [sg0] tag#5672 CDB[20]: ba 07:15:00 executing program 0: r0 = syz_mount_image$vfat(&(0x7f00000002c0), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f736617e43c00088020000200000004f8000020004000000000000000000001", 0x25}, {0x0, 0x0, 0x200000000011000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r1 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6900) ftruncate(r0, 0x800) lseek(r1, 0x1200, 0x0) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, 0x0, 0x0) r2 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, r2, 0x0, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1, 0x8dab}, 0x1c) sendfile(r1, r2, 0x0, 0x108d1521) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_FEATURES_SET(r3, 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHGPRL(0xffffffffffffffff, 0x89f7, &(0x7f00000001c0)={'ip6tnl0\x00', 0x0}) io_uring_register$IORING_UNREGISTER_PERSONALITY(0xffffffffffffffff, 0xa, 0x0, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000080)=@IORING_OP_WRITE_FIXED={0x5, 0x6, 0x0, @fd_index=0x2, 0x10001, 0x100000001, 0x6, 0xf, 0x1}, 0x2) sendmsg$ETHTOOL_MSG_LINKINFO_GET(0xffffffffffffffff, 0x0, 0x0) sendfile(r1, r2, 0x0, 0x8400fffffffa) close(0xffffffffffffffff) 07:15:00 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\x00\x04\x00', 0xfffffffffffffffe) 07:15:00 executing program 0: syz_mount_image$vfat(&(0x7f00000002c0), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f736617e43c00088020000200000004f8000020004000000000000000000001", 0x25}, {0x0, 0x0, 0x200000000011000}], 0x12c700a, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6900) ftruncate(r0, 0x800) lseek(r0, 0x1200, 0x0) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, r1, 0x0, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @private2}, 0x1c) sendfile(r0, r1, 0x0, 0x108d1521) r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_FEATURES_SET(r2, 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHGPRL(0xffffffffffffffff, 0x89f7, &(0x7f00000001c0)={'ip6tnl0\x00', 0x0}) sendmsg$ETHTOOL_MSG_LINKINFO_GET(0xffffffffffffffff, 0x0, 0x0) sendfile(r0, r1, 0x0, 0x8400fffffffa) close(0xffffffffffffffff) 07:15:00 executing program 3: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000, 0x0, 0x0, 0x604}]) [ 970.425555][ T7821] loop1: detected capacity change from 0 to 4 [ 970.449227][ T7821] EXT4-fs (loop1): Quota format mount options ignored when QUOTA feature is enabled [ 970.458689][ T7821] EXT4-fs (loop1): unsupported descriptor size 0 07:15:00 executing program 1: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000180)='./file1\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="20000000360000001900000060008f000ff68f01000000300000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}], 0x0, &(0x7f0000000140)={[{@jqfmt_vfsv0}]}) 07:15:00 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\x00\x05\x00', 0xfffffffffffffffe) 07:15:00 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x100, 0x0}) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x28000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_config_ext={0x5, 0x8}, 0x4000, 0x0, 0x9, 0x7, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000001440)) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r1, 0xd000943e, 0x0) clone(0x40808000, 0x0, 0x0, 0x0, 0x0) r2 = gettid() tkill(r2, 0x1e) r3 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r3, 0x0) ptrace$cont(0x18, 0x0, 0x0, 0x1) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ptrace$cont(0x7, 0x0, 0x0, 0x10001) openat$full(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x2, 0x80, 0x4, 0x4, 0xe0, 0xb, 0x0, 0x0, 0x0, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x8004, 0x2, @perf_bp={0x0}, 0x4000, 0x8000, 0xfffffff9, 0x7, 0x80000001, 0x8, 0x0, 0x0, 0xa, 0x0, 0x100000000}, r2, 0x8, 0xffffffffffffffff, 0x6ee4ca8bd5713173) [ 970.517765][ T7871] loop3: detected capacity change from 0 to 16 [ 970.566549][ T7871] attempt to access beyond end of device [ 970.566549][ T7871] loop3: rw=34817, want=184, limit=16 [ 970.588602][ T7887] loop1: detected capacity change from 0 to 4 [ 970.594869][ C0] sd 0:0:1:0: [sg0] tag#5654 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 970.598991][ T7887] EXT4-fs (loop1): Quota format mount options ignored when QUOTA feature is enabled [ 970.605234][ C0] sd 0:0:1:0: [sg0] tag#5654 CDB: opcode=0xe5 (vendor) [ 970.614619][ T7887] EXT4-fs (loop1): unsupported descriptor size 0 [ 970.621649][ C0] sd 0:0:1:0: [sg0] tag#5654 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 970.637602][ C0] sd 0:0:1:0: [sg0] tag#5654 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 970.647160][ C0] sd 0:0:1:0: [sg0] tag#5654 CDB[20]: ba [ 970.657625][ T7892] loop4: detected capacity change from 0 to 16 [ 970.675746][ T7892] attempt to access beyond end of device [ 970.675746][ T7892] loop4: rw=2049, want=200, limit=16 [ 970.720121][ T7887] loop1: detected capacity change from 0 to 4 [ 970.735003][ T7887] EXT4-fs (loop1): Quota format mount options ignored when QUOTA feature is enabled [ 970.744430][ T7887] EXT4-fs (loop1): unsupported descriptor size 0 07:15:01 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x100, 0x0}) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x28000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_config_ext={0x5, 0x8}, 0x4000, 0x0, 0x9, 0x7, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000001440)) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r1, 0xd000943e, 0x0) clone(0x40808000, 0x0, 0x0, 0x0, 0x0) r2 = gettid() tkill(r2, 0x1e) r3 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r3, 0x0) ptrace$cont(0x18, 0x0, 0x0, 0x1) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ptrace$cont(0x7, 0x0, 0x0, 0x10001) openat$full(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x2, 0x80, 0x4, 0x4, 0xe0, 0xb, 0x0, 0x0, 0x8000, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x8004, 0x2, @perf_bp={0x0}, 0x4000, 0x8000, 0xfffffff9, 0x7, 0x80000001, 0x8, 0x0, 0x0, 0xa, 0x0, 0x100000000}, r2, 0x8, 0xffffffffffffffff, 0x6ee4ca8bd5713173) 07:15:01 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xfffffffffffffffe) 07:15:01 executing program 3: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000, 0x0, 0x0, 0x700}]) 07:15:01 executing program 4: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16002, 0x1700}]) 07:15:01 executing program 1: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000180)='./file1\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="20000000360000001900000060008f000ff68f01000000310000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}], 0x0, &(0x7f0000000140)={[{@jqfmt_vfsv0}]}) [ 970.838442][ T7921] loop3: detected capacity change from 0 to 16 [ 970.860747][ C1] sd 0:0:1:0: [sg0] tag#5665 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 970.863707][ T7924] loop1: detected capacity change from 0 to 4 [ 970.871150][ C1] sd 0:0:1:0: [sg0] tag#5665 CDB: opcode=0xe5 (vendor) 07:15:01 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\x00\a\x00', 0xfffffffffffffffe) [ 970.884048][ C1] sd 0:0:1:0: [sg0] tag#5665 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 970.893634][ C1] sd 0:0:1:0: [sg0] tag#5665 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 970.896577][ T7924] EXT4-fs (loop1): Quota format mount options ignored when QUOTA feature is enabled [ 970.903667][ C1] sd 0:0:1:0: [sg0] tag#5665 CDB[20]: ba [ 970.913024][ T7924] EXT4-fs (loop1): unsupported descriptor size 0 [ 970.930674][ T7921] attempt to access beyond end of device [ 970.930674][ T7921] loop3: rw=34817, want=184, limit=16 07:15:01 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\x00\b\x00', 0xfffffffffffffffe) [ 971.050264][ T7924] loop1: detected capacity change from 0 to 4 [ 971.072191][ T7924] EXT4-fs (loop1): Quota format mount options ignored when QUOTA feature is enabled [ 971.077183][ T7962] loop4: detected capacity change from 0 to 16 [ 971.081634][ T7924] EXT4-fs (loop1): unsupported descriptor size 0 07:15:01 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x100, 0x0}) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x28000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_config_ext={0x5, 0x8}, 0x4000, 0x0, 0x9, 0x7, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000001440)) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r1, 0xd000943e, 0x0) clone(0x40808000, 0x0, 0x0, 0x0, 0x0) r2 = gettid() tkill(r2, 0x1e) r3 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r3, 0x0) ptrace$cont(0x18, 0x0, 0x0, 0x1) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ptrace$cont(0x7, 0x0, 0x0, 0x10001) openat$full(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x2, 0x80, 0x4, 0x4, 0xe0, 0xb, 0x0, 0x0, 0x8000, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x8004, 0x2, @perf_bp={0x0}, 0x4000, 0x8000, 0xfffffff9, 0x7, 0x80000001, 0x8, 0x0, 0x0, 0xa, 0x0, 0x100000000}, r2, 0x8, 0xffffffffffffffff, 0x6ee4ca8bd5713173) 07:15:01 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\x00\t\x00', 0xfffffffffffffffe) 07:15:01 executing program 3: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000, 0x0, 0x0, 0x900}]) 07:15:01 executing program 1: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000180)='./file1\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="20000000360000001900000060008f000ff68f010000003f0000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}], 0x0, &(0x7f0000000140)={[{@jqfmt_vfsv0}]}) 07:15:01 executing program 0: r0 = syz_mount_image$vfat(&(0x7f00000002c0), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f736617e43c00088020000200000004f8000020004000000000000000000001", 0x25}, {0x0, 0x0, 0x200000000011000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r1 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6900) ftruncate(r1, 0x800) lseek(r1, 0x1200, 0x0) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, 0x0, 0x0) r2 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, r2, 0x0, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @private2}, 0x1c) ioctl$FICLONE(0xffffffffffffffff, 0x40049409, 0xffffffffffffffff) sendfile(r1, r2, 0x0, 0x108d1521) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_FEATURES_SET(r3, 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHGPRL(0xffffffffffffffff, 0x89f7, &(0x7f00000001c0)={'ip6tnl0\x00', 0x0}) openat(r0, &(0x7f0000000080)='./bus\x00', 0x51cc40, 0x100) sendmsg$ETHTOOL_MSG_LINKINFO_GET(r1, 0x0, 0x40004) sendfile(r1, r2, 0x0, 0x8400fffffffa) close(0xffffffffffffffff) 07:15:01 executing program 4: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16002, 0x3f00}]) 07:15:01 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\x00\n\x00', 0xfffffffffffffffe) 07:15:01 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\x00\v\x00', 0xfffffffffffffffe) [ 971.442163][ C0] sd 0:0:1:0: [sg0] tag#5637 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 971.444465][ T7981] loop3: detected capacity change from 0 to 16 [ 971.452533][ C0] sd 0:0:1:0: [sg0] tag#5637 CDB: opcode=0xe5 (vendor) [ 971.465532][ C0] sd 0:0:1:0: [sg0] tag#5637 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 971.475086][ C0] sd 0:0:1:0: [sg0] tag#5637 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 971.484661][ C0] sd 0:0:1:0: [sg0] tag#5637 CDB[20]: ba 07:15:01 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\x00\f\x00', 0xfffffffffffffffe) [ 971.502412][ T7982] loop1: detected capacity change from 0 to 4 [ 971.527164][ T7982] EXT4-fs (loop1): Quota format mount options ignored when QUOTA feature is enabled [ 971.536578][ T7982] EXT4-fs (loop1): unsupported descriptor size 0 07:15:01 executing program 1: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000180)='./file1\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="20000000360000001900000060008f000ff68f01000000400000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}], 0x0, &(0x7f0000000140)={[{@jqfmt_vfsv0}]}) 07:15:01 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x100, 0x0}) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x28000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_config_ext={0x5, 0x8}, 0x4000, 0x0, 0x9, 0x7, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000001440)) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r1, 0xd000943e, 0x0) clone(0x40808000, 0x0, 0x0, 0x0, 0x0) r2 = gettid() tkill(r2, 0x1e) r3 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r3, 0x0) ptrace$cont(0x18, 0x0, 0x0, 0x1) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ptrace$cont(0x7, 0x0, 0x0, 0x10001) openat$full(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x2, 0x80, 0x4, 0x4, 0xe0, 0xb, 0x0, 0x0, 0x8000, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x8004, 0x2, @perf_bp={0x0}, 0x4000, 0x8000, 0xfffffff9, 0x7, 0x80000001, 0x8, 0x0, 0x0, 0xa, 0x0, 0x100000000}, r2, 0x8, 0xffffffffffffffff, 0x6ee4ca8bd5713173) [ 971.613009][ T8017] loop4: detected capacity change from 0 to 16 [ 971.619343][ T8018] loop1: detected capacity change from 0 to 4 [ 971.629299][ T8018] EXT4-fs (loop1): Quota format mount options ignored when QUOTA feature is enabled [ 971.638265][ C1] sd 0:0:1:0: [sg0] tag#5690 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 971.638702][ T8018] EXT4-fs (loop1): unsupported descriptor size 0 [ 971.649021][ C1] sd 0:0:1:0: [sg0] tag#5690 CDB: opcode=0xe5 (vendor) 07:15:01 executing program 3: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000, 0x0, 0x0, 0xa00}]) 07:15:01 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\x00\r\x00', 0xfffffffffffffffe) [ 971.649041][ C1] sd 0:0:1:0: [sg0] tag#5690 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 971.671872][ C1] sd 0:0:1:0: [sg0] tag#5690 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 971.681448][ C1] sd 0:0:1:0: [sg0] tag#5690 CDB[20]: ba 07:15:01 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\x00\x0e\x00', 0xfffffffffffffffe) 07:15:01 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x100, 0x0}) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x28000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_config_ext={0x5, 0x8}, 0x4000, 0x0, 0x9, 0x7, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000001440)) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r1, 0xd000943e, 0x0) clone(0x40808000, 0x0, 0x0, 0x0, 0x0) r2 = gettid() tkill(r2, 0x1e) r3 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r3, 0x0) ptrace$cont(0x18, 0x0, 0x0, 0x1) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ptrace$cont(0x7, 0x0, 0x0, 0x10001) openat$full(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x2, 0x80, 0x4, 0x4, 0xe0, 0xb, 0x0, 0x0, 0x8000, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x8004, 0x2, @perf_bp={0x0}, 0x4000, 0x8000, 0xfffffff9, 0x7, 0x80000001, 0x8, 0x0, 0x0, 0xa, 0x0, 0x100000000}, r2, 0x8, 0xffffffffffffffff, 0x6ee4ca8bd5713173) 07:15:01 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\x00\x0f\x00', 0xfffffffffffffffe) [ 971.768042][ C0] sd 0:0:1:0: [sg0] tag#5633 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 971.778438][ C0] sd 0:0:1:0: [sg0] tag#5633 CDB: opcode=0xe5 (vendor) [ 971.785304][ C0] sd 0:0:1:0: [sg0] tag#5633 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 971.795000][ C0] sd 0:0:1:0: [sg0] tag#5633 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 971.804581][ C0] sd 0:0:1:0: [sg0] tag#5633 CDB[20]: ba [ 971.855026][ T8018] loop1: detected capacity change from 0 to 4 [ 971.874105][ T8018] EXT4-fs (loop1): Quota format mount options ignored when QUOTA feature is enabled [ 971.883510][ T8018] EXT4-fs (loop1): unsupported descriptor size 0 [ 971.897405][ T8054] loop3: detected capacity change from 0 to 16 07:15:02 executing program 0: syz_mount_image$vfat(&(0x7f00000002c0), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f736617e43c00088020000200000004f8000020004000000000000000000001", 0x25}, {0x0, 0x0, 0x200000000011000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6900) ftruncate(r0, 0x800) lseek(r0, 0x1200, 0x0) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, r1, 0x0, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @private2}, 0x1c) sendfile(r0, r1, 0x0, 0x108d1521) r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_FEATURES_SET(r2, 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHGPRL(0xffffffffffffffff, 0x89f7, &(0x7f00000001c0)={'ip6tnl0\x00', 0x0}) sendmsg$ETHTOOL_MSG_LINKINFO_GET(0xffffffffffffffff, 0x0, 0x0) sendfile(r0, r1, 0x0, 0x8400fffffffa) close(0xffffffffffffffff) write$binfmt_misc(r1, &(0x7f0000000300)={'syz0', "774e78cc98befcc35a25c7b2de0ac92f2ab559632965d4ae3a8d6ba609e4851be6e1457323ffb0258a81a4be7c3064a02375ae8fd77e8c4a26a320a7721ae076377aca2cbf121687f0a3f559c0d331eb0c2d4e7d703adda87c4b0812e2ae4cddb9df6c1ea707ec9d5275896d90e4d25fffa32c864ba1fe849e34d3d3091a14b1718c66cad98ab049c6d709f0302706d8f706eaeb498bb41c4173de7a40cb3d1b47bc5ddb4da21f1ecbe8e5e965e9dd93556d4cee5bc60b585b808a833cf2e241115565f851ae481f85439237f32d26ce424b59e3d39ec16b3db311eda451c84002e7dc9a276bf5767c44f2726b6493811b1e97b10210071c0c8168d34fa524e84db3da94368bd4b764b00d8833b4f19b52e3ba134459d156520c35223784700352621cdce4ebeccc8110f2f4ecd49d38b2f2fb3f7eac97d08b15411e96bb5ba9cca5540e6a9e09f71a2ab5ed1601e16fe1a264dcce712369324e0e34ac9b469ede547e11ad6e9bb4478f031e6111ea725a467de6f4beea28c70f3ddc16708c611f181680155725412cd694d6c485498103bc3ffdb141b61597f199c42d92cae6ead1f92804cafdbd085c0f9f9ecb0c3b1e48334d86a68165a18a48c3ffb55e09e1cb47aca9eb65e41c92077d29c47d8ef9f66eafd8687281f70b572af33dc16638c5e1332bb27c65ee3703b88feb15d3e33adc0a4fbd4a0fcfd695e6161d4305943f2887368c41765144ea62f89001ef7aac9480a347a15dc94929e3b28e0240c7815b72bbb052abf0c5aa6990dacb9a8c2b3470e2a7fb90e4f15f5646e155dae408c3768ac29617d74bd887babc53407db94fd6a2a35c5f0048cc3b51546358bd5a6ffc9bcb357d8ff901ec3e76cb715338b8a877811cd642b2360d03e62dd054a0baa0e6a5e374aa6ccdba0d7b10b0d6cea7edfea2a24ce44d7d07f1a5fb81fccde9fe0fc8c8a7b98c4a59975f7ed713394f6963e2737a09106ff14eeba9c51a8a67db557244d4da2af8d8a7d2155dac0e52934da8700318f06511973d76ee1b60c0483989b2385801fc8852f915b86d22b12abfdfcebdd9ccb24383cc075d90411529ac6edb16f7b5c0fbd0f3b19972e12e834e42e49cf6dbc72755dbd11244e0a4e52eec6626a15c801c10d95c458b21642e117c1c905f02b24fba591bce8168c55cdcd71e78d5d663cbbad96371f97bb9c68792dea3983f1e282ddea4a1f3584e8562765bc00f0dd0fff043f0b53c776db4556d21878ac41b3871af791ed36f159c93644e9ee634a722e1a01fe0c350e0394c7d766f89ec8a63756824dd552adc128c079abc779a3a9308d214dd2360aab8703232faf5c7c1f7f5defd5d2c924bfcd7fe96ba090d2ed002385d030c97715c993f9b0ce418070f4934333476c38e67ea73e99cd9adc62a96e1bf7aab5a5d7289f09e4929f1c52a1b1de0ff8a674bb6f5bd9dd71ae86c500f900825a6c48e9cd02ed37ca13f78bfb02efd9365ba8dd76fb326012ffe58f0ebd269ca08b38f7d4ea16d5e32f8867459d140940b6c548fe18de20bc762ba423ad02dff085d72151926e7ee4e6bbc7ae9fedef8b02103f052c9082fe783a217b82fcd1f4e88d9f1cd03d4240a39f1838df383b83698ea2964a818114c352eac133d49054907e0f7448ef5328f468bee04377b03e886c76afbe3954dba6273451fc8a9a297a5017eb5e8679a0443d68be86b2bd137925c4683a5b0c1f4f6b4ff6dc14f5196e43ac27ef4d5d86d401a32b73009b2a4c73858027db34578b1d2148a5ae409021db08c0a8cbfceea56b4b7d09262bb4895586d3a519757d5744b5d8a9af5f339d9d0ae986937a7e789d9ba3bb85622b00da0e30e1502aea799181f91c58ca9a1b74ddb7fe0b63ff1950ff02e62c1852bc8fbc90700d9c55f2e81d96d6e8aadb7bc97136fb04bbbd77aa63d0f422ebe401e871f83f43ddea30f668d6d9a9751d9dfa551323666ff0baeaaf7f2894112fff26e08dd332a75808b55015dea390fd99bc6fba680387713ff84e9052e0bcb6e0f63bccf6206cb09f31145c768a8747fa24c4efdd9862d8cd98aa123c46a9dfae52a64f411a977a8d543c7ced9216749a546b1b3a52d3b86102f26afe6df22c1ab81ce27cd93bb0d1462fbd3d610cd02840085d578ed3d310315477dae383a34df2f3c94a448366824eabd8ae46f861bf24dc8a06c4c8c1f976b413b87f7218685d6a8ad2f2341b41659dcf399bc63b9226a3a22a921e7c6afa86153c4fa026c301e374e697d90edb8c0a5d2eedc6ddf883a84b9a54902b725599cf74d6e141402738dd10c8765a444cab5ce1767d482ceba584d5770de1e1bce16bb6a2dfc0b67b71505593795fd649f96ca5c534ac58f70bca94b925c6e07ffafd39e7e447c2e2aa789888b00d9ce41bfb9332d1329e0247ce3b6515536c56dfa44a660599683929e1705096eb12ff142d0f1e4b825d4d7f867c935b3b09959d0ba529158ff34ceab5accb77a71b4bc4363f8eb2929a1a3c55c1c002201980267334edaf853caeefb686bc5a79fa54835102651cfdf355de524fb3e4d793fb0d329b5b6a7197839d16e502e4083d496d8028ad98e06c147549d82089081ce48110cfd4c602af17a6cb7d6ef9a9898c333bc38cefd1f1dbd28c40e3767e7a170903834a9240238f575d650fd1f760283e337ec41a8ede5b10bf608b36eee7dff066d243918e222b2c96d50061878363b60dc4714cfb3584237f5bb99292b0d54cef88be17e13c05877bd8211f28befe16d1e5e4c360114429957d444637a7f0b5101e8f16e32b000a8702195f4649c53da94dbf73a383bd5c5d57d05141d5b26e3cb1203e3ab93dcb52b913eb63f069bb7baf4626af3c630742c9343ca79f69dc2716ec45a398d5e732863e7091613decacfdbc35a9aa018ebd5ee9952812a466cfa7ac34bb50a9952f7cd73e622bd067fac4a1c004d5f2aed769c8cb450b3fa45bfe2ac9a3a878f6f22303e15a5e3ca1be71dca4ee42b7650e5a413209eaee041e2f47202dc4f5951cd0c44a08bd15ffa74a8bac517500195e223dd1db6e143be6b2f0ec82dc38e5e3a1a496885485af2a02a87f23a4c5cd5738f38ccc720988f24d74981ffd29091a0724c86e1ebb226bcd4f9c1074e45121d0685c817e48cd8bb8d72603874a113a6de3ae8a84535d96869bc743ced084e00e1ffb31033b30e45c2d803a1f051da1e0d130379bcf1f1401f5cc8731b508500beeeadbe3fb66f553938de981e6eb9fdb8941d98bbb557f59f82ed3a5e0942297ab81dcf830d227130345add2c3f30f1de5c4a81726d175dde33e81f8c02011b2c8123807c8dc1d13da21c341b0b84b92d16fd680df65d3eaa0bd63bde4dec8b22533faea84bfd6ac2151e18d327debbaa4cb3c6e7e4f16733c4513839357e4d0b5abee03ba488af2a4fd43d51216fe6106460f14dba454844bd148a75182be142abca36ce5967f0ec8ab2e4b5b914ab622ad1658b5454c7f3d4699ebcfb549fd8d93328517beb5b66f9fbf9fdc31c631a26fcca9ac7c4c5fc356046e980981b5a4d2966a74ba3fea1829e96efb6759f06f977e94b938f5659918c5be3274696b8363e10cd8be97c229e6f89cc930d0811b0799d9facd4cda16f3af2dbb8c58e411c0e9da40cb73fe70db49d3b067a63bf6e1db9225ea2fe686a6d95b3f215aef7f379a5a856392961c2de7cfc412e935ae3c02a1b3348b534a896e265903717fdf890f406cf68cc030545639a51764f722b69528c721ad82e1cb0be31bffccd54fdcdde0c53de6c2a7e795bd28c2c4bc0f27c7be7ba50d3cc2b9d34673e980b73c4b513eb937928f5def79c19e43b5c1f5850ae01ea4184ba3a6edd5b059eb9bf83c87f46cc364839f5b0b9f80ec861e4796504874bf093162b114cfa93a53f4037ddde0e5932f3d4c56324d548bab264c2d372c09aeccd8594bcebf3c42905d7d3c19882dbb867a0db905fec74c8b9e23e172ac3f448be76e3a6bdcedeb0148dd9c85d2a7867623f02a8ae94ee5ea4c92ac454d27e7521fb5b4aa1a689075c62727f506c31a364d66b0b5de78d1022c2fb6c3697999658862935facd8241ec8107a1ffe08a8882ee1241b4501e8ef0ab1a914ca95dc5074ef03fa36ddc7bf00890fbed60aee34a0d88faddfe62b1db2a9f7f404b24b1bd9f139e055ed3a759cce472f809a88c8e76e85fb93febf7c622712dc20a49d22433cc1ad6e9066f5daf5f06f9f9fe54039ad853420439c049067349b0633733690c8b2eeaee765bd4bba259a1a910fb1be3ea69626e6a7ab5a3a1292a9853a277b0e94fd83d012afd5d2ff8a1cb288ad857377971a408708b2fa8394cecd6a2ab3b09794d5b4114a093156769a6ae50aeb872dca481ea42cb3a8aa46325ee3e6497a048922e2c09b9f2f2906ca0757c16a39af13a581c290e56da5ccbe3fc88fdf663c7ef852e23c858000b3ac28016b8f7f6b2028dda8a539cfba441acb55729f228051c6c16add00cbab73658619cac15038e7ba9e83f3a5f25491d4b02ac4cb47b1eadcf1310a8cea4442796844e127f7e909b478c67013c8d0e8e2c525ec0360ccbc4497703f4bfb26533927216d5297830b4276055e28919b2926b13d782204a97850101071546d451550442a35ee886e600771bc11bc6381e405bfae3c746801ed0a00676ed7a59b514be127c9755a88568bc785d4955aeddf98b0dad4513c615d47742c1300ef8288018231fdba0ecc3725b24a2f819f81aefb5964267dac9bed637262a83031768b2bc58e11229fac41edae9de6e7bc56451078c4202ab6085e5fe812100e21773dea69b6328d887c2b3644de70607702bcf2f0a3f8c9c9eb481e13eef182d6458ceba1317972b9ad7990acbbb77fad00e89b4ce82980760a53505b144a2acde75b64fef6783b8c0d9053ae035d2a43adbdcc02cddd43cb5785e1d8978e809de8cee18b4d54cd378c11ce3d867ae0f50ff0f90577964c6691c9e90a2505d72840612404f5ee50b1a2795e7b2dc32b4c5149c7ab5ff4372878b45d41e748e00383128e9e88859b0a6395ebc98cd985fa71cbf5e9036af646f7f6f6e2cd60da95ba7d6f8e010471e6608190e388bc8a357a88bb74c8d2c67ced7b1e8b7f85e9b7399c3ffb0b12552432b2c41b1dcce242c4200065ecf92fc78d3011f04e63b9d7466307a92649a3925d129ed6f0d51a91c6360b548469f3252d41ef578ed7b1b6ed9d17e7fb9f8fe7842356c230929a2d1c77ebcf877af37742c05c51384ae698b3dafff31e52532f99afd512ec09a7d08aa59b2d7ed5de67faf5e335ea88ed3af749d5cd7e5d5caefb70639a8dc15e3ad2038a370dec775d8942d3391a87369c68758702d048f6855e4c586cfdcaf83bba25115ed9c136029c7f7a9f85baad6f9edaa21c8c87fc10322d2d13b20b11b0ec75d7a47a9bf667b6a83d5bf8c8c4bc4daae31746660289424a6cfc40e60265bee13eacf633092b5ec0a1b164dd29cf4adacce5bab75b24dcf4eccaad2bf97b9b3f5bde378f8a57014cc33b79f5627da41001282f6253b81e1907a7d4e3bea7a6ef23d27d777604ff9496caf9f1b49d19c7c83d424e78cf5c4304297710774365d8e67c0e693c1bd4f795c96a60d410a8484d69e0ba0aafb9307efa382ff73cedd443b41349085b8df997f732ea2b2f0e750f416ffc6e5a93314ab1b64b0fefe7fa3a89c6381737f70994428c00a793c7bda4cbb080a624c719ff8ef08a34477503c26f3c50cf00d8aea77cb71898ef972f1417c7054d3392f"}, 0x1004) 07:15:02 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\x00\x10\x00', 0xfffffffffffffffe) 07:15:02 executing program 1: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000180)='./file1\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="20000000360000001900000060008f000ff68f01000000480000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}], 0x0, &(0x7f0000000140)={[{@jqfmt_vfsv0}]}) 07:15:02 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x100, 0x0}) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x28000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_config_ext={0x5, 0x8}, 0x4000, 0x0, 0x9, 0x7, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000001440)) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r1, 0xd000943e, 0x0) clone(0x40808000, 0x0, 0x0, 0x0, 0x0) r2 = gettid() tkill(r2, 0x1e) r3 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r3, 0x0) ptrace$cont(0x18, 0x0, 0x0, 0x1) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ptrace$cont(0x7, 0x0, 0x0, 0x10001) openat$full(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x2, 0x80, 0x4, 0x4, 0xe0, 0xb, 0x0, 0x0, 0x8000, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x8004, 0x2, @perf_bp={0x0}, 0x4000, 0x8000, 0xfffffff9, 0x7, 0x80000001, 0x8, 0x0, 0x0, 0xa, 0x0, 0x100000000}, r2, 0x8, 0xffffffffffffffff, 0x6ee4ca8bd5713173) 07:15:02 executing program 4: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16002, 0x4000}]) 07:15:02 executing program 3: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000, 0x0, 0x0, 0xb00}]) [ 972.386709][ T8083] loop3: detected capacity change from 0 to 16 [ 972.393884][ C1] sd 0:0:1:0: [sg0] tag#5646 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 972.399950][ T8087] loop1: detected capacity change from 0 to 4 [ 972.404269][ C1] sd 0:0:1:0: [sg0] tag#5646 CDB: opcode=0xe5 (vendor) [ 972.417161][ C1] sd 0:0:1:0: [sg0] tag#5646 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 972.426731][ C1] sd 0:0:1:0: [sg0] tag#5646 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d 07:15:02 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\x00\x11\x00', 0xfffffffffffffffe) [ 972.436310][ C1] sd 0:0:1:0: [sg0] tag#5646 CDB[20]: ba [ 972.445208][ T8087] EXT4-fs (loop1): Quota format mount options ignored when QUOTA feature is enabled [ 972.454638][ T8087] EXT4-fs (loop1): unsupported descriptor size 0 07:15:02 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x100, 0x0}) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x28000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_config_ext={0x5, 0x8}, 0x4000, 0x0, 0x9, 0x7, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000001440)) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r1, 0xd000943e, 0x0) clone(0x40808000, 0x0, 0x0, 0x0, 0x0) r2 = gettid() tkill(r2, 0x1e) r3 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r3, 0x0) ptrace$cont(0x18, 0x0, 0x0, 0x1) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ptrace$cont(0x7, 0x0, 0x0, 0x10001) openat$full(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x2, 0x80, 0x4, 0x4, 0xe0, 0xb, 0x0, 0x0, 0x8000, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x8004, 0x2, @perf_bp={0x0}, 0x4000, 0x8000, 0xfffffff9, 0x7, 0x80000001, 0x8, 0x0, 0x0, 0xa, 0x0, 0x100000000}, r2, 0x8, 0xffffffffffffffff, 0x6ee4ca8bd5713173) [ 972.508348][ T8104] loop4: detected capacity change from 0 to 16 [ 972.525060][ C0] sd 0:0:1:0: [sg0] tag#5673 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 972.535447][ C0] sd 0:0:1:0: [sg0] tag#5673 CDB: opcode=0xe5 (vendor) [ 972.542331][ C0] sd 0:0:1:0: [sg0] tag#5673 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c 07:15:02 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\x00\x12\x00', 0xfffffffffffffffe) [ 972.551901][ C0] sd 0:0:1:0: [sg0] tag#5673 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 972.561453][ C0] sd 0:0:1:0: [sg0] tag#5673 CDB[20]: ba 07:15:02 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\x00H\x00', 0xfffffffffffffffe) 07:15:02 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x100, 0x0}) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x28000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_config_ext={0x5, 0x8}, 0x4000, 0x0, 0x9, 0x7, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000001440)) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r1, 0xd000943e, 0x0) clone(0x40808000, 0x0, 0x0, 0x0, 0x0) r2 = gettid() tkill(r2, 0x1e) r3 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r3, 0x0) ptrace$cont(0x18, 0x0, 0x0, 0x1) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ptrace$cont(0x7, 0x0, 0x0, 0x10001) openat$full(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x2, 0x80, 0x4, 0x4, 0xe0, 0xb, 0x0, 0x0, 0x8000, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x8004, 0x2, @perf_bp={0x0}, 0x4000, 0x8000, 0xfffffff9, 0x7, 0x80000001, 0x8, 0x0, 0x0, 0xa, 0x0, 0x100000000}, r2, 0x8, 0xffffffffffffffff, 0x6ee4ca8bd5713173) 07:15:02 executing program 3: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000, 0x0, 0x0, 0xc00}]) [ 972.641210][ T8087] loop1: detected capacity change from 0 to 4 [ 972.654175][ T8087] EXT4-fs (loop1): Quota format mount options ignored when QUOTA feature is enabled [ 972.663626][ T8087] EXT4-fs (loop1): unsupported descriptor size 0 [ 972.690576][ C0] sd 0:0:1:0: [sg0] tag#5632 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 972.701058][ C0] sd 0:0:1:0: [sg0] tag#5632 CDB: opcode=0xe5 (vendor) [ 972.707905][ C0] sd 0:0:1:0: [sg0] tag#5632 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 972.717495][ C0] sd 0:0:1:0: [sg0] tag#5632 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 972.727041][ C0] sd 0:0:1:0: [sg0] tag#5632 CDB[20]: ba [ 972.806498][ T8154] loop3: detected capacity change from 0 to 16 [ 972.838782][ T8154] handle_bad_sector: 5 callbacks suppressed [ 972.838791][ T8154] attempt to access beyond end of device [ 972.838791][ T8154] loop3: rw=34817, want=184, limit=16 07:15:03 executing program 0: syz_mount_image$vfat(&(0x7f00000002c0), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f736617e43c00088020000200000004f8000020004000000000000000000001", 0x25}, {0x0, 0x0, 0x200000000011000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f00000000c0)='./bus\x00', 0xc) fcntl$setstatus(r0, 0x4, 0x6900) ftruncate(r0, 0x800) creat(&(0x7f0000000080)='./file0\x00', 0xa5) lseek(r0, 0x1200, 0x0) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, r1, 0x0, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @private2}, 0x1c) sendfile(r0, r1, 0x0, 0x108d1521) r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_FEATURES_SET(r2, 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHGPRL(0xffffffffffffffff, 0x89f7, &(0x7f00000001c0)={'ip6tnl0\x00', 0x0}) sendmsg$ETHTOOL_MSG_LINKINFO_GET(0xffffffffffffffff, 0x0, 0x0) sendfile(r0, r1, 0x0, 0x8400fffffffa) close(0xffffffffffffffff) 07:15:03 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\x00L\x00', 0xfffffffffffffffe) 07:15:03 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x100, 0x0}) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x28000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_config_ext={0x5, 0x8}, 0x4000, 0x0, 0x9, 0x7, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000001440)) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r1, 0xd000943e, 0x0) clone(0x40808000, 0x0, 0x0, 0x0, 0x0) r2 = gettid() tkill(r2, 0x1e) r3 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r3, 0x0) ptrace$cont(0x18, 0x0, 0x0, 0x1) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ptrace$cont(0x7, 0x0, 0x0, 0x10001) openat$full(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x2, 0x80, 0x4, 0x4, 0xe0, 0xb, 0x0, 0x0, 0x8000, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x8004, 0x2, @perf_bp={0x0}, 0x4000, 0x8000, 0xfffffff9, 0x7, 0x80000001, 0x8, 0x0, 0x0, 0xa, 0x0, 0x100000000}, r2, 0x8, 0xffffffffffffffff, 0x6ee4ca8bd5713173) 07:15:03 executing program 4: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16002, 0x5400}]) 07:15:03 executing program 1: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000180)='./file1\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="20000000360000001900000060008f000ff68f010000004c0000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}], 0x0, &(0x7f0000000140)={[{@jqfmt_vfsv0}]}) 07:15:03 executing program 3: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000, 0x0, 0x0, 0xd00}]) [ 973.362946][ C1] sd 0:0:1:0: [sg0] tag#5695 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 973.368958][ T8182] loop4: detected capacity change from 0 to 16 [ 973.373365][ C1] sd 0:0:1:0: [sg0] tag#5695 CDB: opcode=0xe5 (vendor) [ 973.386327][ C1] sd 0:0:1:0: [sg0] tag#5695 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 973.396038][ C1] sd 0:0:1:0: [sg0] tag#5695 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 973.405622][ C1] sd 0:0:1:0: [sg0] tag#5695 CDB[20]: ba 07:15:03 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\x00h\x00', 0xfffffffffffffffe) [ 973.422893][ T8189] loop3: detected capacity change from 0 to 16 [ 973.430512][ T8190] loop1: detected capacity change from 0 to 4 [ 973.441277][ T8190] EXT4-fs (loop1): Quota format mount options ignored when QUOTA feature is enabled [ 973.450776][ T8190] EXT4-fs (loop1): unsupported descriptor size 0 07:15:03 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\x00l\x00', 0xfffffffffffffffe) 07:15:03 executing program 1: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000180)='./file1\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="20000000360000001900000060008f000ff68f01000000600000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}], 0x0, &(0x7f0000000140)={[{@jqfmt_vfsv0}]}) [ 973.494703][ T8189] attempt to access beyond end of device [ 973.494703][ T8189] loop3: rw=34817, want=184, limit=16 07:15:03 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\x00t\x00', 0xfffffffffffffffe) [ 973.576476][ T8217] loop1: detected capacity change from 0 to 4 [ 973.589778][ T8182] attempt to access beyond end of device [ 973.589778][ T8182] loop4: rw=2049, want=232, limit=16 07:15:03 executing program 3: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000, 0x0, 0x0, 0xe00}]) [ 973.616907][ T8217] EXT4-fs (loop1): Quota format mount options ignored when QUOTA feature is enabled [ 973.626351][ T8217] EXT4-fs (loop1): unsupported descriptor size 0 07:15:03 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x100, 0x0}) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x28000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_config_ext={0x5, 0x8}, 0x4000, 0x0, 0x9, 0x7, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000001440)) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r1, 0xd000943e, 0x0) clone(0x40808000, 0x0, 0x0, 0x0, 0x0) r2 = gettid() tkill(r2, 0x1e) r3 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r3, 0x0) ptrace$cont(0x18, 0x0, 0x0, 0x1) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ptrace$cont(0x7, 0x0, 0x0, 0x10001) openat$full(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x2, 0x80, 0x4, 0x4, 0xe0, 0xb, 0x0, 0x0, 0x8000, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x8004, 0x2, @perf_bp={0x0}, 0x4000, 0x8000, 0xfffffff9, 0x7, 0x80000001, 0x8, 0x0, 0x0, 0xa, 0x0, 0x100000000}, r2, 0x8, 0xffffffffffffffff, 0x6ee4ca8bd5713173) [ 973.731081][ T8217] loop1: detected capacity change from 0 to 4 [ 973.744789][ T8217] EXT4-fs (loop1): Quota format mount options ignored when QUOTA feature is enabled [ 973.752128][ T8241] loop3: detected capacity change from 0 to 16 [ 973.754201][ T8217] EXT4-fs (loop1): unsupported descriptor size 0 [ 973.784869][ T8241] attempt to access beyond end of device [ 973.784869][ T8241] loop3: rw=34817, want=184, limit=16 07:15:04 executing program 4: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16002, 0x60ff}]) 07:15:04 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\x00z\x00', 0xfffffffffffffffe) 07:15:04 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x100, 0x0}) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x28000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_config_ext={0x5, 0x8}, 0x4000, 0x0, 0x9, 0x7, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000001440)) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r1, 0xd000943e, 0x0) clone(0x40808000, 0x0, 0x0, 0x0, 0x0) r2 = gettid() tkill(r2, 0x1e) r3 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r3, 0x0) ptrace$cont(0x18, 0x0, 0x0, 0x1) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ptrace$cont(0x7, 0x0, 0x0, 0x10001) openat$full(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x2, 0x80, 0x4, 0x4, 0xe0, 0xb, 0x0, 0x0, 0x8000, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x8004, 0x2, @perf_bp={0x0}, 0x4000, 0x8000, 0xfffffff9, 0x7, 0x80000001, 0x8, 0x0, 0x0, 0xa, 0x0, 0x100000000}, r2, 0x8, 0xffffffffffffffff, 0x6ee4ca8bd5713173) 07:15:04 executing program 1: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000180)='./file1\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="20000000360000001900000060008f000ff68f01000000680000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}], 0x0, &(0x7f0000000140)={[{@jqfmt_vfsv0}]}) 07:15:04 executing program 0: r0 = syz_mount_image$vfat(&(0x7f00000002c0), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f736617e43c00088020000200000004f8000020004000000000000000000001", 0x25}, {0x0, 0x0, 0x200000000011000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r1 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x0) ftruncate(r1, 0x800) lseek(r1, 0x1200, 0x0) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, 0x0, 0x0) r2 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x8) bind$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @private2}, 0x1c) preadv(0xffffffffffffffff, &(0x7f0000000280), 0x18, 0xd9f, 0x0) mkdirat(0xffffffffffffffff, &(0x7f0000000080)='./file0\x00', 0x2) sendfile(r1, r2, 0x0, 0x108d1521) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_FEATURES_SET(r3, 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHGPRL(0xffffffffffffffff, 0x89f7, &(0x7f00000001c0)={'ip6tnl0\x00', 0x0}) sendmsg$ETHTOOL_MSG_LINKINFO_GET(0xffffffffffffffff, 0x0, 0x0) sendfile(r1, r2, 0x0, 0x8400fffffffa) close(0xffffffffffffffff) 07:15:04 executing program 3: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000, 0x0, 0x0, 0xf00}]) [ 974.225033][ T8275] loop3: detected capacity change from 0 to 16 [ 974.231780][ T8277] loop1: detected capacity change from 0 to 4 [ 974.260979][ T8277] EXT4-fs (loop1): Quota format mount options ignored when QUOTA feature is enabled 07:15:04 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\xff\xff\xff\xfe\x00', 0xfffffffffffffffe) [ 974.270385][ T8277] EXT4-fs (loop1): unsupported descriptor size 0 [ 974.311718][ T8275] attempt to access beyond end of device [ 974.311718][ T8275] loop3: rw=34817, want=184, limit=16 [ 974.338259][ T8277] loop1: detected capacity change from 0 to 4 [ 974.386765][ T8277] EXT4-fs (loop1): Quota format mount options ignored when QUOTA feature is enabled [ 974.396237][ T8277] EXT4-fs (loop1): unsupported descriptor size 0 07:15:04 executing program 1: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000180)='./file1\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="20000000360000001900000060008f000ff68f010000006c0000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}], 0x0, &(0x7f0000000140)={[{@jqfmt_vfsv0}]}) 07:15:04 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\xfe\xff\xff\x00', 0xfffffffffffffffe) [ 974.429236][ T8270] loop4: detected capacity change from 0 to 16 07:15:04 executing program 3: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000, 0x0, 0x0, 0x1100}]) 07:15:04 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x100, 0x0}) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x28000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_config_ext={0x5, 0x8}, 0x4000, 0x0, 0x9, 0x7, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000001440)) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r1, 0xd000943e, 0x0) clone(0x40808000, 0x0, 0x0, 0x0, 0x0) r2 = gettid() tkill(r2, 0x1e) r3 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r3, 0x0) ptrace$cont(0x18, 0x0, 0x0, 0x1) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ptrace$cont(0x7, 0x0, 0x0, 0x10001) openat$full(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x2, 0x80, 0x4, 0x4, 0xe0, 0xb, 0x0, 0x0, 0x8000, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x8004, 0x2, @perf_bp={0x0}, 0x4000, 0x8000, 0xfffffff9, 0x7, 0x80000001, 0x8, 0x0, 0x0, 0xa, 0x0, 0x100000000}, r2, 0x8, 0xffffffffffffffff, 0x6ee4ca8bd5713173) [ 974.514208][ T8320] loop1: detected capacity change from 0 to 4 [ 974.542025][ T8323] loop3: detected capacity change from 0 to 16 07:15:04 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\xfe\xff\xff\xff\x00', 0xfffffffffffffffe) [ 974.561186][ T8320] EXT4-fs (loop1): Quota format mount options ignored when QUOTA feature is enabled [ 974.570636][ T8320] EXT4-fs (loop1): unsupported descriptor size 0 [ 974.615361][ T8323] attempt to access beyond end of device [ 974.615361][ T8323] loop3: rw=34817, want=184, limit=16 [ 974.636364][ T8320] loop1: detected capacity change from 0 to 4 [ 974.650217][ T8320] EXT4-fs (loop1): Quota format mount options ignored when QUOTA feature is enabled [ 974.659655][ T8320] EXT4-fs (loop1): unsupported descriptor size 0 07:15:05 executing program 4: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16002, 0x8008}]) 07:15:05 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x100, 0x0}) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x28000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_config_ext={0x5, 0x8}, 0x4000, 0x0, 0x9, 0x7, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000001440)) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r1, 0xd000943e, 0x0) clone(0x40808000, 0x0, 0x0, 0x0, 0x0) r2 = gettid() tkill(r2, 0x1e) r3 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r3, 0x0) ptrace$cont(0x18, 0x0, 0x0, 0x1) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ptrace$cont(0x7, 0x0, 0x0, 0x10001) openat$full(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x2, 0x80, 0x4, 0x4, 0xe0, 0xb, 0x0, 0x0, 0x8000, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x8004, 0x2, @perf_bp={0x0}, 0x4000, 0x8000, 0xfffffff9, 0x7, 0x80000001, 0x8, 0x0, 0x0, 0xa, 0x0, 0x100000000}, r2, 0x8, 0xffffffffffffffff, 0x6ee4ca8bd5713173) 07:15:05 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x9f\x94p\x9f~', 0xfffffffffffffffe) 07:15:05 executing program 3: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000, 0x0, 0x0, 0x1200}]) [ 974.875185][ T8371] loop3: detected capacity change from 0 to 16 [ 974.940394][ T8371] attempt to access beyond end of device [ 974.940394][ T8371] loop3: rw=34817, want=184, limit=16 07:15:05 executing program 0: syz_mount_image$vfat(&(0x7f00000002c0), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f736617e43c00088020000200000004f8000020004000000000000000000001", 0x25}, {0x0, 0x0, 0x200000000011000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6900) ftruncate(r0, 0x800) lseek(r0, 0x1200, 0x0) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, r1, 0x0, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @private2}, 0x1c) sendfile(r0, r1, 0x0, 0x108d1521) r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) dup3(r0, r1, 0x0) sendmsg$ETHTOOL_MSG_FEATURES_SET(r2, 0x0, 0x0) ioctl$KDSKBSENT(0xffffffffffffffff, 0x4b49, &(0x7f0000000540)={0xfb, "d97b219e3c846a10dfba1aa59a8532f669f93c3d527dae66ff710007fb420bf5d8b9fe4a3990618a2af69f7724cec7d13d012e9633e2dcf9be40ba5b9c21656711e326bd24d0653e9d24fff85774c5c7aaa279c5848e79be3b9234f1b3f3687bdd6e294ec0514cf49ee0f9a776647c54c358a90035b39264c86ab3bd2b06d60bc27609104c0653b92045f25e4b69b26737a88e1a0b20d47a46b0383bf83f400291b3718b5f842a84ed44a20565f2a1fecc31acd15ed9a382bc7a67f54471befd085eaf60ae03a3ffefda8401a8ace165d7157aaffc9cb61c1998832325f973fc5ebb8ccdd31be521c9c6346102091a8f693d8e12becca31e1a896ad9a2457bf7baecb949ea805f45a25c56b608aa11205426edbc6857f3767a90f75204912433e0c30dd5bcb546f686a3bb3e1791900cb034551ae3215e5ec0b25eaeeda1dbd6e87d04b1c0bad43adccb8bb75087f97911ffed7cb0db033e81755e6a9da0def490bab444911907430eb45957b895cbb9a73025cf3b1ec41e32e32eca3256dfdc8b32c31525515ced29892676f903dcf929950e18ec964ec907ba041810ab9bbe07b1f913c4a2d8c915c6a6157273526a35c440a6c472cd84b0589c194304347303efbbd0031489f1bb032feb409a313346e7fa5c9d19591e8f3cfef7fff38b9eec047c9f7beead28c69426a01e5f1a7c28d76ba62f6ffc61fd35cecacec03229"}) ioctl$sock_ipv6_tunnel_SIOCCHGPRL(0xffffffffffffffff, 0x89f7, &(0x7f00000001c0)={'ip6tnl0\x00', 0x0}) sendmsg$ETHTOOL_MSG_LINKINFO_GET(0xffffffffffffffff, 0x0, 0x0) sendfile(r0, r1, 0x0, 0x8400fffffffa) close(0xffffffffffffffff) 07:15:05 executing program 1: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000180)='./file1\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="20000000360000001900000060008f000ff68f01000000740000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}], 0x0, &(0x7f0000000140)={[{@jqfmt_vfsv0}]}) 07:15:05 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\x00\x00\xff', 0xfffffffffffffffe) 07:15:05 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x100, 0x0}) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x28000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_config_ext={0x5, 0x8}, 0x4000, 0x0, 0x9, 0x7, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000001440)) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r1, 0xd000943e, 0x0) clone(0x40808000, 0x0, 0x0, 0x0, 0x0) r2 = gettid() tkill(r2, 0x1e) r3 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r3, 0x0) ptrace$cont(0x18, 0x0, 0x0, 0x1) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ptrace$cont(0x7, 0x0, 0x0, 0x10001) openat$full(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x2, 0x80, 0x4, 0x4, 0xe0, 0xb, 0x0, 0x0, 0x8000, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x8004, 0x2, @perf_bp={0x0}, 0x4000, 0x8000, 0xfffffff9, 0x7, 0x80000001, 0x8, 0x0, 0x0, 0xa, 0x0, 0x100000000}, r2, 0x8, 0xffffffffffffffff, 0x6ee4ca8bd5713173) 07:15:05 executing program 3: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000, 0x0, 0x0, 0x1300}]) [ 975.115284][ T8398] loop4: detected capacity change from 0 to 16 [ 975.133696][ T8398] attempt to access beyond end of device [ 975.133696][ T8398] loop4: rw=2049, want=256, limit=16 07:15:05 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\x00\x00\x00', 0xfffffffffffffffe) [ 975.172138][ T8409] loop1: detected capacity change from 0 to 4 [ 975.186798][ T8416] loop3: detected capacity change from 0 to 16 [ 975.194871][ T8409] EXT4-fs (loop1): Quota format mount options ignored when QUOTA feature is enabled [ 975.204628][ T8409] EXT4-fs (loop1): unsupported descriptor size 0 07:15:05 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x100, 0x0}) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x28000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_config_ext={0x5, 0x8}, 0x4000, 0x0, 0x9, 0x7, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000001440)) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r1, 0xd000943e, 0x0) clone(0x40808000, 0x0, 0x0, 0x0, 0x0) r2 = gettid() tkill(r2, 0x1e) r3 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r3, 0x0) ptrace$cont(0x18, 0x0, 0x0, 0x1) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ptrace$cont(0x7, 0x0, 0x0, 0x10001) openat$full(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x2, 0x80, 0x4, 0x4, 0xe0, 0xb, 0x0, 0x0, 0x8000, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x8004, 0x2, @perf_bp={0x0}, 0x4000, 0x8000, 0xfffffff9, 0x7, 0x80000001, 0x8, 0x0, 0x0, 0xa, 0x0, 0x100000000}, r2, 0x8, 0xffffffffffffffff, 0x6ee4ca8bd5713173) 07:15:05 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\x00\x00\x00', 0xfffffffffffffffe) [ 975.235951][ T8416] attempt to access beyond end of device [ 975.235951][ T8416] loop3: rw=34817, want=184, limit=16 [ 975.304902][ T8409] loop1: detected capacity change from 0 to 4 [ 975.319964][ C1] scsi_io_completion_action: 5 callbacks suppressed [ 975.319992][ C1] sd 0:0:1:0: [sg0] tag#5679 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 975.322635][ T8409] EXT4-fs (loop1): Quota format mount options ignored when QUOTA feature is enabled [ 975.326638][ C1] sd 0:0:1:0: [sg0] tag#5679 CDB: opcode=0xe5 (vendor) [ 975.326668][ C1] sd 0:0:1:0: [sg0] tag#5679 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 975.326699][ C1] sd 0:0:1:0: [sg0] tag#5679 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 975.337083][ T8409] EXT4-fs (loop1): unsupported descriptor size 0 [ 975.346357][ C1] sd 0:0:1:0: [sg0] tag#5679 CDB[20]: ba 07:15:05 executing program 3: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000, 0x0, 0x0, 0x1400}]) 07:15:05 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\x00\x00\x00', 0xfffffffffffffffe) 07:15:05 executing program 1: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000180)='./file1\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="20000000360000001900000060008f000ff68f010000007a0000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}], 0x0, &(0x7f0000000140)={[{@jqfmt_vfsv0}]}) 07:15:05 executing program 4: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16002, 0x9700}]) [ 975.485653][ T8466] loop1: detected capacity change from 0 to 4 [ 975.497143][ T8466] EXT4-fs (loop1): Quota format mount options ignored when QUOTA feature is enabled [ 975.506589][ T8466] EXT4-fs (loop1): unsupported descriptor size 0 [ 975.524985][ T8475] loop3: detected capacity change from 0 to 16 [ 975.547815][ T8475] attempt to access beyond end of device [ 975.547815][ T8475] loop3: rw=34817, want=184, limit=16 [ 975.563850][ T8466] loop1: detected capacity change from 0 to 4 [ 975.577613][ T8489] loop4: detected capacity change from 0 to 16 [ 975.578691][ T8466] EXT4-fs (loop1): Quota format mount options ignored when QUOTA feature is enabled [ 975.593194][ T8466] EXT4-fs (loop1): unsupported descriptor size 0 07:15:06 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\x00\x00\x00', 0xfffffffffffffffe) 07:15:06 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x100, 0x0}) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x28000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_config_ext={0x5, 0x8}, 0x4000, 0x0, 0x9, 0x7, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000001440)) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r1, 0xd000943e, 0x0) clone(0x40808000, 0x0, 0x0, 0x0, 0x0) r2 = gettid() tkill(r2, 0x1e) r3 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r3, 0x0) ptrace$cont(0x18, 0x0, 0x0, 0x1) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ptrace$cont(0x7, 0x0, 0x0, 0x10001) openat$full(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x2, 0x80, 0x4, 0x4, 0xe0, 0xb, 0x0, 0x0, 0x8000, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x8004, 0x2, @perf_bp={0x0}, 0x4000, 0x8000, 0xfffffff9, 0x7, 0x80000001, 0x8, 0x0, 0x0, 0xa, 0x0, 0x100000000}, r2, 0x8, 0xffffffffffffffff, 0x6ee4ca8bd5713173) 07:15:06 executing program 3: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000, 0x0, 0x0, 0x1500}]) 07:15:06 executing program 1: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000180)='./file1\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="20000000360000001900000060008f000ff68f010000c0ed0000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}], 0x0, &(0x7f0000000140)={[{@jqfmt_vfsv0}]}) 07:15:06 executing program 4: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16002, 0xff01}]) 07:15:06 executing program 0: r0 = syz_mount_image$vfat(&(0x7f00000002c0), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f736617e43c00088020000200000004f8000020004000000000000000000001", 0x25}, {0x0, 0x0, 0x200000000011000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r1 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6900) ftruncate(r1, 0x800) lseek(r1, 0x1200, 0x0) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, 0x0, 0x0) r2 = open(&(0x7f0000000000)='./bus\x00', 0x48440, 0x0) sendfile(0xffffffffffffffff, r2, 0x0, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @private2}, 0x1c) io_submit(0x0, 0x5, &(0x7f0000002640)=[&(0x7f0000000280)={0x0, 0x0, 0x0, 0x3, 0x1, 0xffffffffffffffff, &(0x7f0000000300)="aa704dd3e62bcf3bd8c8c05f81bdfc69a1728048f374d0119ae36b88b0cc3c27e6b89a344a90d87cedcacd040eec9056604c7150fc6bca03ff15c60897a8826fc8b5a170efd4949660fe2e4f1ebc2e994f937432695d9ce42a8fc21542e183a2da82e4ba5ecf10cf89b868e4deb1bada34699aabf6fc716274408ee32a98197dba7f14439232c998717040263ef8dea54242b97e38f1e4c2ee16a407f690cf658a390bb9ca0d00bf05e529a6e5c82de1d73f77a9dd59a903d133076c55e0775337a56c7b258a0db06325386abbeb8f6383005d6f07e3a2d736a667a630f4ae40802fc8a29d32d00fd24177e13bc29e377115982182c1000467637a877509dadaa013670aaab81209e484cfe9f841749545ed18acf47f0f7a9322273cc86478ee23204a484363ab233d98794480d8425c68afdae72b1b62cdaf8bf3cd20f9ce8af27b45622092b3b9d0f71c884817af377e84093b337a77083bdb5d8dedc7ab436baae50d2c92797a9ff286ba178dfcb185bf457c1ac9bdec20dceb5136b39da8e1e7c526816941d2e3ebbe2f228cad74c773d91d1e8161a2f785713837a663434f4155383d90e9b06fdd07289d70e22cd44b94fed07002aa0ffd2c8c97b74292637289d85b371cf17ef0bbc7bbbdd5505208c54cdb87363d4ac5f163c4b0d53503be331adfc6e2fdab3a896e84da7bb760f95fa46f1650badbdb0de6f08e5ddfb71b00652d988eb76b58cbadd603ac59a6fdd8d69b3244cb9b20d0be165e8fa627e633c926a58331b4fe2b525c4f61bb4bb741678c348dcf30b3818f7dbda215d36080a54643415bb09e9074c2b25f427bdf9ad0762409bfb672abd8917e1e5aa8cc57ef6603b64fd1fc3bdf4bea314cb6ecf3d982fda3135d0a7b378754b5e26a20f48f0cf345abb6ede1f93ec70afdf55337c1924b6c40e8aaf356d8a5fb752968e3c9f1b317c1a025d490f56640b2d7c373bf95d975133f32f349092112bdaeb806f3cde03f8b6278e10a3e529177fbfd1e7fd4cd9a90310cd4e660d53b8fd0664b577ea51fa7ae8aec2f5ba3551777bd3c6b0bc488d0134f4180ff544005f06cb329b270d556a00481f2af1d6f351e2ec4debed79c60ea72c4218e4d56e3ff1279fd60a8e2a7f1d38b8ba9a5c212a685553aacc87db9d71ba45c470a8fe2eb1459de9a5d445f11a794bd521cf4142a6b8202664747a8be2a26067e9d8d0055e2ea4488882eee43855ba31905136348c0794c6f757e4a72f8390343c3d8546d0134363c2e21e1acd64ffb0fcab01e91440820ab6fc1f436aabb01f20d51fc793ab5585345053c3804333b6d88dc7afa33a4174368bb539dfeb2c257a0a9ab5dbdd1a0510f531406c6ed0bd706d2987df33520bc8acd60684eca18bedbfa735ec0249fe816a07d7bf03cf7720d490302a98369d9e047162c1fc323d5bee7a458cdf579fcf574f8ae1b77dff0e1801450856a839ab41ae553cc9118aaf2b0d3a7a7062016dbc81a50a63a80de639da8ebc45f558597e62d6ce236503b7edbc5d1d99f35018ec628f4608a2937c3c2efdc4ab9c9f5eb181f3a1e8e844baffbac2f2bd0af9bf5feb3008ad8fc092af733fd2eb98576cc54c90e13437102a9ac3b4a7b899ff1f3a733489d4b9552a57e240cae69c16bc9fd51942d66ccb9b2df837e12e94f63ecca7192c71f7db4524fcddc130a2b7d5c05bbaee3ddc5ba8ce2854651230a1bfab88c4fd8ddfdac89ed60985097539df523b11f82fd745f8ce83cb8718341130135844d494708dfc8d8efc79681b6eb555788286f46149c6e82736ce673741df1a2e83c01afb98a1671be68cc8c8a537209b42aa1658100029f2fcd57783763da407d5d34d7cf6b3b69abd0c627dbeeb06bfa27258c9a551af36d0e371cdefaa53f94b8591292f3919552830d45abf98a5fda7735e1897e77c8b25b8f746b3aca41b824bb113ea2bbe51adaf4098f873755e925c4ab67495f0ef646772b192e5973469c999fec17c4bb52c19fb636686fac7f4fedfa93a0e2876939668d031eaf290ff928eab9e9adc60aee01154f96aa94899cb9cd9e1a4152a4b0c65892b4ab4a48410a87f7caceef2a45bf9d92809a442a8589db21c085de5a61cc86d381bfd6cf886e7e0d3e0faa7a80c1912eb1d4f66c2e094a391531c4522a7ceed5fcf0928f8d5cabb49d78e87da710feb7ddd8443fe7efc3075a33c1ce7b396cde9aa7870f7a17ac3c87d39a1c22027735c1303aa8cb274d95aa66afc86cf46610f28e2ee7ea631cfea79f1df61792a0f5be42bc6bb37c7de851da35ee20788741a06e820df5ef15d16bff8c1938c5120e2055b09584b6d4bb30528e8dc2e1151f6a4f52a68f5f458acbe708fabba6ccb1b11487e028d3e9db6bf28a8c2c60d5b8c42e97a0e0d917315662d163b4f22f82ef36cf632e88ad3569e459f635bfb1b045955e951375b5d6c9127550d2694cce5f0975595b847c89a0770a3aa6cf5e8f8528cd8dc8d11e2ec73fa9ea09ca8ef29d7f116bfcef3b37bf1e93298c6910f51b7b4688334e86fe8c64fea06534a86c3101ac40726b2166407ffe2ececa1b19b195659418c4ec6f9048945a1f128d09d3bd58a692778c0bc9700f538da6448b37f7b488f2132f2c5d8356765eedaa5165491656573178b96c2a1389dd8b06bee6602bf86d633507fec3989ebaac03dbb4a922adae5a7116d30a2e5970b0fc76e861d30dca5c853ff79afd5e53e9bc03cfd64979cc1bfa9aa4be551731d784c756f0a93f3a3b66dc6c01450d9a710ccf4223080fd6c16395a91f152df3285e6a4c31eff41f3fc64ff14eff34eb3e4f38e89b7e835abfdcff36d808bcc7fe837a28d24f11f2fb71934e5cc9cbd95d05c6fe32a71c7bc365be104ea9e25096ceada2c78e0b94e7a825e58628822ba1b9a7a0af04e34100eda140df09ae67bdc75d187c49ed4afa62ec3430aa44ed6c5c9cb3f6c0eb1df4e6adf46ea3f526a5e60fc9aa8ce1151084ca1b73ea8f141fd4f5602d64e3913d4c455e22d580f34dc2a642f7d9a4b202e6153255a7ba9adb42e3972ba012e7316a8f3bc09114d8268b9d823bb99cc55b96f9e96d26515be8e6bea722099f3517f130a5a7636953b9f9ae91fdbe34dce91aa139c2b56da9d2cd4209125c5cbbb723b7b7a2ef668622b3ac3dc531fdffec92ce9435384df206367ebffcc674aaf4fbf7a17fdbc115005eba873a420de39f49a7e63fd2c46293b0348fafb377e5dcd6dd86d9e9f52caf15caf596d388f692f4bb21e2b25dd58018bde4712bbc93411d110a3f7d5e41dc52fe3cfe451859f7d7b7b3b52fdc18b38c26668dd5a572c68403633f6a50134cfbe2c4808388bc3c23aded9e59acc0b598848fda1589d0514744e8ae9d77f82515f071a7b69732183cd9a95cc33bb49cbaf4a8ef384c0fd368279430837684b5f5f378fcc0b8d7d4a1fbd7cf1ab02666305f5adbe14b1451676069f8c0b4f7a0731db65babfcb264444fb3fc1dc257fd0b5ff8a854156654a287cc4d4c92f8af90b4a3340bc9bff1bf227a5040a91389fd67565f72e058700366d9c38ea9feef7c1ee0920a91d03034f3929fde2faad1032d91d1b40e29de39ee663c56049be65a062438efedb34cb942decce68366387e57eefda5aa4959279edb370fa68533ea65efd3664afc5a900e600973689d91143a9aba829fd736f60e8fbc72f6da9b2eb4f9b59fc8a0e45ad25f2c0a44ad1913fa156c9dfe4b21fb33fc9781a9428e623a4b1ee5aa7079762dcb1130c818b2ccb59f758af89820ba7cb8b30b2af97cf9d270f1dc834672bf9d583f7471e2e151a8e938e7ddadbd82966a7ac541560d75f909e7bcf75c991c82d35388d5d4cc95d34a1a3f3c39ffaaa272897c111019a44d56d24d06184c69d4dc7307e66d3a9328e04346f2fa2a80fbe20c6419d09e2780a20ffc383bee6aedd30014ea91e4ad2341ea313fa8c260da9af60931e8a480952b4f0591f7447f73b11ba900d7692964198095aba5d70370e5cd326da61ae5bc1d1ffba597dc28bcd3148402acbcb2aa62b647113ff852328d3bca8869fb4b9c75dcc8663e21dddd4e6280d48a8ad0be64ac2d85a476c1e1ab482237f4c3e40890e8f4939040dd1c16aff456295b4c47ab76da79eb8e8b806c486f72a46ab108b4e58ee4ef70d76d32e78f24de86a25f6045974e49cb7523dcc38f88bedec416296cc1a41ad06b7034c32685f6ef9104d41f708d48a4dd053171ca81fae9bc067b00b1725576d854fe35c531adca0e4d3c8e1e5cda8074fe0460ea8c9c622d0c24a0fc1ec79b2658cafdbd8b7f00fd815b845a1089a24fd3e694b40c8a0501637fece6e4a4ec1214d6b8b8612ff303793e7f646ce699cc4bc0fdaea1af671ecc99244a559c65f97ec0267745f6a3813b1b8f0053159a42018062bd83f128da923d6c47184173ebe5d26b6a745a6c28dc6e2aeaf24478104419a4661cbbe591f4f6539ae0d15db99fad92cc896f731ad30636923eedb8deb85325557a8a14c03b1a12c1d7d47c9ceb89dfb00c03b9a54bc23684661ae67e662aa4de6abf0c3b9c15ff0d3733a49dd54fe7083da1d1d9d982c76b0dc615046707b66c69135929dd22b9c9e107bfd1a916623ae333c69f5c7c05f849920ff290070a60beada69d7e3e191165ce9a1ecc3d78d2cc6ded0b17440c7eaadb493190d28f3e1498f4fa0768187bb7a9a52523276e6989d920d84c7dbe2920e34e8e849e52c9c87bd441594c8b857db8506ea8bfc8e31cdb428ffe10df1744801d60dc8b253f47e41d24234a17c73b427f871601954d4f689f4c1c7c6fabefdaa24d86dbdc9d5319db02532c74bbe236c4ebc160c2a53d86e549aa758cfe3fb8d5ce9e6de0ff72a3542f38f301db291a1575b2cdd82801363cbf22f2622300cf26af2a26536819084f561a278b9dc388f7c3cdc8aa7969f590ca9f494284b2aef486491d721efc0086da6ac1765afc4da3321a16fc0d96c460a0d553fd33b56f923f3df186d5df4ee5ce54410be9e7ba697c2578962e3e455006fdc4d6685b3044bdfa8fcd0090ab3103358406b1987a46b96653f91535032af9ce26d9a6c45b87aa5794f2ef63739526544c2f317f96bba28dba6383769289217ee86be860fd2c4e7209a9547f7f094eb49f0dfedee0a6752bd948b0bf47e19f7fa8a52851de91536daab6a1d7546a03cb09635350dcecb7233e933dcc461c5541d391e0a17c0210acbe0e6454a5a4b1e2cfbfe29ba4b1548fc5e426f616248f4ac7f355f1c45d16f6148a5c192a11cefc8f397a6474bb0c829591c8c386302cc544127de13b983cdd722fc7354e8684c1f3e3235610679434dceafb8e6f1b59e0a054b547b52c5c86406c7697aa859bbbe715d507310c7dc91da293d998f330918bc67103ce39d0a7ca5600ee4b80ec1bfcd20e9b00ce190de2970ba261850a86fcef1377ae7eaec11dbf62288e2c071c88f0bbad832c30c1baced5232a13f2a3594579c38e894ba9981b22301d30076098fad0b7fb1cf98cebdb76c26d8a2093c11eb7d928123647bb185c48b341e90898235cd2f704b47adb143f7af72db6818a3383369e6a715576085cb9a08876a1cd580e99f1eaabcf74a22a3f9735a3c2c2e70362b8058ddfb4042b0a143a48da628f2e97714b73188b61d9c4b9762d4b6b3b295507c141e75e32e4e19e8984583900f5b4a6275a9ca0176d4d1a9831f94ef223db2bde060114dc5c9ee29e534ce27c7ecf5c2ade2a5e686eacd36aa78d1d0a16a42ee136a41d86bc9b", 0x1000, 0x293b, 0x0, 0x1}, &(0x7f0000002300)={0x0, 0x0, 0x0, 0x5, 0x1, 0xffffffffffffffff, &(0x7f0000001300)="883da806ea8d708f351a75da7527e79fd3bfec014a5122c5135d413492639aea13b3cfa9707bf853e6037fad99ac1a0d0273e3d089ff8a08539cdb63137f8a2935b946fd3f1f830f4141c72f5b23ee2874421317b9741eb92518889395bedc85e9da55ed27cd27b57ca68f8bcd24dd4d63baa095390d29f6af2c898198949845752b8b45a238869f1692099cb1da64673b00ab053d02f26b775ff9bda95f1f4022b442698d2d10b09cb045fdc39adfe52bb60ae42649c31d6f19fb83a83b17f4a256feb2d4dbf33d0c0d3f4a19b14e9e4211826cf72e003a175007b6bcfe0f12a37925cf98e53efeaff16f02b964df2310af731c3c95e2f3612ae9ea78de4077cb790db513a129f8e20530b47dddd680fd2881e8a3ae5c931c5cc4243c4a868fc4e1af18e5bbffa7fe6778118171fdbefac483c87a924c9161e06386064d611f56ff6b11e99b4d73ac1702d86c4a565ae77e3ac828210c456f4558ba110ae9851493eb20ee1a5a8a6d0e399768dd32a1c57b6aa5ed3c279f8b32538f04cabae0150d0801e2e57571f89b03751807aca6b5ee137f2cb2b0bf34b8d048749a77b59926a2e61ae1ed245c56b7df004eae9a99818a2bba5aeae8fddc099b278e8bea8aed926bfeebc78c04da3d91b6e29399620153b58102197ef5e9addd01a023b9d460af5a035597b78a5ddd55cafc27d7996a6402deb25c722d14d44ff32f9b62778d5ccfa706d4523e5bd3caa5167186a46af3dec9664ea3e73f588281a16f5bd84ab41ab272c74f5b925cad983f9799604238dc2c324d59c3ac29e5f853eb0c3500fc4395178c0f6d2b0695aadeb5c2e05c08197d975bfa2cb91d380a51b1de978f85255699b04260e420cde1f9aabc450195357210df6de8af42ccfa03c846559424db20e6900da20ae0ec3b1ed7bc53f9dd92006dedc90ed4ff16f5a331e160fbeb529eb0c1f101fbe82c6b62c3ebf8ad3d5b5a399a123ce4e94c9eddd49774ee6fb1f8e210678f8c68d6bf04dbeea42a82cc7928e276b88d5bd6254e2709c5ed47f5ee08a12f10fe865fb766075eba7f66ed5cf6c10e17841a87b5ea3c498bdcd4f230ee62f922721297e9d314c718827182186b23446b3adf7b05bc0b13dda21cc7babda35ab127897234cf40b16c5bb7ab49b2acde9f634818aba8513a128512d0c16b31fd4a32aee34ad876fbbca81c38d9780aed3957167e74ea56813bed121bbaa68f3d005d6d9b15e1d2af07197828d3b22ccd9e25095c1868896e9df5197bf171b8ded561c0c33ef8c1c30bd95c9e6d6c77f1ee0590e63a9d3e2ebbbf0bc62e4ee09ae010ac6b614cfd18609bc41474abf5313659b6f93754e8d77fe3cd2c76b4c30820767c522ad07f9912de935dee1f819c99e21c6ca17ae4f1fbad2b65b1ee99da12bc0374ddd2f5ddf7d86c73a89ec7d5e8e146faf92e1ca0845c6580ce491a1e65ce641bd56384d5cb15078e4d1bd65fd52b0e392674bd9eb4abee706ee0f7271fa9cc965e99566d1430589dcad43b99445e048b12578914121bb6ba01e06a373b7cb91314d37feba57788f0831ddd5e121e81a213e63aee891877c43fadca49480d21bc95e571faeb2eccdb81084a777c58e0ee3d853cabf9bb342a9a9a01875ffad3a29baf01e9b0d6d246ad3fcb7b8aff46b8162905f6c3071cf2b6fa7ce51df49b3ac5ef5f1e8bc4d8885e89490d53fe48b7bd132b95a8e6c01bad24ed5615572798f2e1102ed81519403d5521acb763427755f217d42e36b9b4437e2c24a67ace588a793637ead93f2cd39fb8a8af12d2f8170fb455d9e32b0b236a8fc8d1d00db25dbd1a144dc2b8bfb9695c57024f1b02f9a9fbf8c43ac700705e8265ec3d02ce3e026362c9377867995057b0b57b7ff2e486a31b5b5b2546a56b034c97cabdbbf219b64494780912b0c3ef82bc56036efd511c0bc87969b9dfe51700d125b66a7527ae5370fa9b902f62f2358428892779a0f84e9c07f687992563fb9e05cb14be7e37a807b1677ddd4779a1eba8137f4aedea146fc3a693b1de3c15ae39e391908d25c19fdf40f66bc1e7b63c34730f251b709a0c9de0922feec6496ac1995e988fc232ae200e94cddaf18c7b1fb33f007b50ae23f2900ab2f533f70d7726807016b522ae8ad52721bb701a2a376108f6c8a7f2f6f59f6d7bb43998b85b7d3445152714f09df79fb7199bc62288ca440745949af81bef2e747d717dcd7fa146d378430dd75798b51ff2fa1c4809a9a44822f35f0ff59d2955332b696db9ef5dc4d9639af3c8cfcee46d41eb2ddec5b7ea0eba3ba1faf8d75ccae154502072d9d28127e820d008b6d4b645ec2bdf5fdddf32c663ff5e6b0970278a11df50bee7c1cf0e0d7ef5a4c05bd4bea75aa291dd6c489249c4bd6b695d477fb41ea4bb2752cad88f8bf8b329b18f3d4e342fdbf677ca7caed917a37fa4350a30c35ef008f596155bc9d879629b7a6543a24bb0d7e3d43bbbeee34ba82fcf6251874ec14fee02650184f6383e4a7d71bef6542f3da9750d792aca7d8c219da08e0ec57226f855e732b6ce7dfdf7c5c28d9600123a4770aad0fbb1b9a4c3a56fb01d4920bc2618736daf115b2c84952928e010f7f638ea4d7144910bdb344c16a1971661341d7e5add384f2271c90ddbda7c40b2076c782f3c7d1ed4f238743613bb3a912274052208fe59bab241b822e3a36c226b83cd7aeb23e8d07814571b312a2ead9ddf4295909b77c5045ac7d8408c5e42a36d64ea6969a43b4a2c5e205671185e83f7238d27c1cdcf1b2c4cc93b0a2213b9796fd5a109f5b1930fc88f0e74eb9a501d261eeca874a7d3e2966b8f584c8569a9eee4b263bf601287fe7603496d5f6f551b7c426c566029f0a8714df99acd0c3cd816d4c42b89ea1d86931ff7dae5bfcbcf36ac586ac1e84d0953ddc282d5984169f0f3cf9661adecbe0e2d4e305faaca09a259f00945877eb531ebd0d088213876c6975f401c0e22b88d36a00691670cee0dfbfc1ab92c97a56641d8f81f57fdc47150d3d7bd9e2503a69336f974f71c938d1fda75be8b0cd33a589b867f986809a01b23ed882e2fb336ef6344b2f6e4c6db5243bb9ef06b0f74643ad4d2f6bfd2a1a58539a01b37863145f97cbb067dd1ffdd31387220b86e4a4e3537d04991b15f2e22baa52ce60da11a5b7dfce53ba057f67111ac864954b5bbeed3c87983e4891d4b137e18fa6ca84adf17344739b7fb63a7087fbbe746a5d0a6da4bccb7e86441ffd8bfbe706f5c8ff1b5c220d61568a2cc78543b795ad5c74fd2d05d8a477d10c4fcea651e5839173bb38aca2e56c5bacc49f8fc275101b178fe07437e05c5903c3cb27456e106b83a922077239e784b8d987e668b9476848bcf443add1a6737c679a6dbca383375074b1e18ade5f7271f51d5b563e8903d944834bc67c76488d0931a82307c8457a2bc42a6b0db774f2c7f1a0dc459dc16005a3bebe131371fe34f97d23c82b00b7a9c08ef7519b0daf4a8aa6a291261ad85ab83277fac0e7dfc052baa94ee810688c65a444eb4b95d88dd6ce6e509f145877de87fb3b58c7ade418ac0de6585dfe99c70a8bc187425941117d9e0d2ac34a921baa2ab23216407e352ac1a089d17e9055d42f0450f260ecff4eb0b3aaa67b2046f3b8facb672987e0b6404086849b3e923ee84a93325856ccfccfc8ae79264c11d34b8130928792c5b80fb9d554b1fd86e5d5efb4732e79d65a21cc82e0053079e5d503a723c7617829bec1eb36d5e708f0f0913c7c0a28762f3e41d15f6f7dce360819ed9c7be81fec1737215df6df4f2fec509215592151a9937616754282add7b1c7773d790488d3dc651907c1d91c248daee2d33399d7c2e78a2c389049af306b4e66a83b1b246d06dd0a697a7faa29fbb0ccbe8f2ba91377ece471d8c085ec24eefcfdd4b110b9c9a1bf9548a3a74cd468e08cf357c31f5cf52c9c0b3bc92307a5ebefa5e352d4f5f1118a5b064283773aa00539c7a030a1a6456d24eb94eeff44f7332e0b4fbdbf9ac5505e4aeeaaadce6a22884440454b8b9c3571c7b63a6d20dc67f390484ca38a4d4c6a9980856ebb477b130f9e743c7a06dfc256aa52545c33c460aa65bd61278581fb615287572b8dd3fb4cb52fbf5c2e603402ece1a5687248bbd8ced804b1d3551aa82a712b74658a510b77e251375238dde753771038b9a5e91448a717a3e1aa1e649a2011995c3006f0eaf19d13cd51b4b61cc9f624225f4addf784666ac18cad422b2a1ebac0e8ad48767aab8fd0d3adfdbb609661f959c7c0c3cc1b30226e9d9cfae0f9ec53efb5c661ed0f57632f9afc52555fe7eadeb1fcc4f6d77805e435cbcac07492b38b3a2089f5761c1bf9d51338ca7e38127fd59c72598f99b6bdf98a9fe9da3adadfc0f4c9be0e4eaf2dc83cd2e9d60696081690e05e3b93e98adf38d2320bf46325b9051de649ce5d97ee8643bb4790c187f9483a6024b64b8570182ac956b54e94b16fe926611bce00a242551b721292b75bdc02f56045e0b99ed631c52c389adaaf78c59e90b33af9913c7b66026c06fd2d26c3879c269c042664cd2956d4abd82fbf7e7a63aa83e6da985a6f23b8cd13918f2aa9c3885aa348cdb70d6b32a02c87c0fd35c647ba20fa6b882333fc474cd0cd349db1ccedd7b2ed2d97c13887427b197a574231a574f14b74bcb87129ccf44eaa3e42286f24f8a710d00432cb2e7889bfac8103a0963de50c261edb4afea65e9d90c2707586697f3d347b3af6a1ab8eaffa36740b9f7e8f76c4c8c728bf80d1be935fcdd3f7c16f79a742b683896fe9b04d53583fe4b6a85bd9e7e7d409190bea03d76b58b8ae2109cae5e7a5fb5f9988ec066a23707105071a0e4de87c9ff11d98b1366c2c4b90ed02e9dc451afb9c214e70fc8b52815500aee608a09e6ae7c56928ee0f959311c1ea2159d71a0ccbaafff1a3065e5ad0b721758aa91c82856cdf91f92c8f583d1fa18ab19cc86056aee9f5e1e88ea625af5c65dd7b5bf5569901f7a99cd4d924eca397a986a85848af85c50405cbbf16644dc07aee6066b3b0920b23ebc3d98b6b865604a120cddf4047521f8a13eb05610704269205fc701e161742804de8590f1ae0dfc3f8472cd93910a354237424efd3a67484be727f5abb2a68d2a92c796070a11cb6ee85f2cecdeab2ed6ef423c4d99f3d95458624e097c5594c65b08168d07cab630e3992f1502fe3552dcbe6eb780308678b87d1f30875cd281d0b00eed154e91db96169af2be7505434692e7ab3197fe45bbbebea5ce25a876a9b53971c93593e599388ce0f377675ee1bd6dd098af2d1d062372bcfb64d287666859a0dd6c42f5a8c6babddeb6ff9dec1ad4881b42d68e8a4635c1f2fe6ab8754e7eadb9500a81ad4cae539c522a32e01549aff1faea6b3df1bc03bac51083c207c3fbb127c530e1fd52e243c8f1ab65c23ea8f3f232842afe87903cfbcc2c2e19212dc39a44329c6f9a5d45dd1738ab9608c4317282c94b57bba8b060e7b1710a1bca11c2dc70fd7ecd69cfcdfddd3e4912628e1cae9ab3d203110e659d7d61614f3c90c5a5c0ddf35d1619b75ef7a5abca777bbb79a196cd723c3d09579cead091b66b2f9ba130a27dc397c815ca69c81c5b7a88d98ae8b200cfef9bb5815a3e2c5cd799d0944457c293db5124f4e02f73d7ef4776247557d9ca57a803f240f25a1b2f120ee3169fb133239d9cd997b6dafa85bcf40cf5b9a045d04579c456faeb0226df9485484d5b1dd1bbb493cdc6586d0d4359f130", 0x1000, 0x40}, &(0x7f0000002440)={0x0, 0x0, 0x0, 0x2, 0x0, r2, &(0x7f0000002340)="4f271b9288694f90e8a690e199c8fb29a10dc504f4d90c2bd7bf87d28334ce7f749f1ad804b88ba4fd855a1c93dfa1580045475fac2c8fa93506698538cfd02de4ca5bd4274be7c875a31921aadedcab506ef5f92b3ca2b92434cf0601c42523d44feb7015ce73722de2db02d185c7016cd069292479cf14625ff1d28ca6aef15f44823495e1e697c16a44996013562fcb43a1e6afb0c47a792d40c492b00ecb2d209749799c82f76d23e8a64b86ff5d9715ed07ed5d3218797e25871d59e2e09497f014fcb1c55cc8e084df7dbfe83ce4f3cd3d0f5e32ef6fb98150b6cea480c16ae66f82756ce06c743c4b81d4d98de8", 0xf1, 0x9, 0x0, 0x2, r1}, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x6, 0x3, r0, &(0x7f0000002480)="db3d420926fd090260a173631b9cadcbb88b659a447670", 0x17, 0x6}, &(0x7f0000002600)={0x0, 0x0, 0x0, 0x3, 0x1000, 0xffffffffffffffff, &(0x7f0000002500)="67511297d98afdf8c9d920f39c94f57ced1d18d42e89d8590ebbbac6ed01d33115beb8e36a95b89555012af665b199d4dc00fa2c112c248345ac6ff2e93b30bd8d6eb809d8275c7d1109c8a056fcffda971580335e3ad9eac46db1a7b435b48126cb1d5112cc921c28ac12cff536a77edff0fac56204bd44585b841ad40ce05cdcdff3bcc8f01d17ee9fe0f3cd7f92bf3faddfb861241e62a4e6b53f0f4e972f2c2381fc16689b7840fbf93235ef0e0916f3c242ee05f9683eb91aa1dac5bb95d976abb5ed163f27827897ef01", 0xcd, 0x9}]) sendfile(r0, 0xffffffffffffffff, 0x0, 0x72d) r3 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$EXT4_IOC_MIGRATE(r3, 0x6609) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_FEATURES_SET(r3, 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHGPRL(0xffffffffffffffff, 0x89f7, &(0x7f00000001c0)={'ip6tnl0\x00', 0x0}) sendmsg$ETHTOOL_MSG_LINKINFO_GET(0xffffffffffffffff, 0x0, 0x0) sendfile(r1, r2, 0x0, 0x8400fffffffa) close(0xffffffffffffffff) [ 976.087277][ T8509] loop1: detected capacity change from 0 to 4 [ 976.094094][ C0] sd 0:0:1:0: [sg0] tag#5649 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 976.100354][ T8511] loop3: detected capacity change from 0 to 16 [ 976.104445][ C0] sd 0:0:1:0: [sg0] tag#5649 CDB: opcode=0xe5 (vendor) [ 976.117428][ C0] sd 0:0:1:0: [sg0] tag#5649 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 976.119054][ T8509] EXT4-fs (loop1): Quota format mount options ignored when QUOTA feature is enabled 07:15:06 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\x00\x00\x00', 0xfffffffffffffffe) [ 976.126980][ C0] sd 0:0:1:0: [sg0] tag#5649 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 976.136350][ T8509] EXT4-fs (loop1): unsupported descriptor size 0 [ 976.145875][ C0] sd 0:0:1:0: [sg0] tag#5649 CDB[20]: ba 07:15:06 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x100, 0x0}) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x28000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_config_ext={0x5, 0x8}, 0x4000, 0x0, 0x9, 0x7, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000001440)) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r1, 0xd000943e, 0x0) clone(0x40808000, 0x0, 0x0, 0x0, 0x0) r2 = gettid() tkill(r2, 0x1e) r3 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r3, 0x0) ptrace$cont(0x18, 0x0, 0x0, 0x1) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ptrace$cont(0x7, 0x0, 0x0, 0x10001) openat$full(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x2, 0x80, 0x4, 0x4, 0xe0, 0xb, 0x0, 0x0, 0x8000, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x8004, 0x2, @perf_bp={0x0}, 0x4000, 0x8000, 0xfffffff9, 0x7, 0x80000001, 0x8, 0x0, 0x0, 0xa, 0x0, 0x100000000}, r2, 0x8, 0xffffffffffffffff, 0x6ee4ca8bd5713173) [ 976.214622][ T8532] loop4: detected capacity change from 0 to 16 07:15:06 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\x00\x00\x00', 0xfffffffffffffffe) 07:15:06 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\x00\x00\x00', 0xfffffffffffffffe) [ 976.293207][ C0] sd 0:0:1:0: [sg0] tag#5641 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 976.303566][ C0] sd 0:0:1:0: [sg0] tag#5641 CDB: opcode=0xe5 (vendor) [ 976.310428][ C0] sd 0:0:1:0: [sg0] tag#5641 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 976.320137][ C0] sd 0:0:1:0: [sg0] tag#5641 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 976.329782][ C0] sd 0:0:1:0: [sg0] tag#5641 CDB[20]: ba 07:15:06 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\x00\x00\x00', 0xfffffffffffffffe) 07:15:06 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x100, 0x0}) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x28000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_config_ext={0x5, 0x8}, 0x4000, 0x0, 0x9, 0x7, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000001440)) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r1, 0xd000943e, 0x0) clone(0x40808000, 0x0, 0x0, 0x0, 0x0) r2 = gettid() tkill(r2, 0x1e) r3 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r3, 0x0) ptrace$cont(0x18, 0x0, 0x0, 0x1) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ptrace$cont(0x7, 0x0, 0x0, 0x10001) openat$full(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x2, 0x80, 0x4, 0x4, 0xe0, 0xb, 0x0, 0x0, 0x8000, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x8004, 0x2, @perf_bp={0x0}, 0x4000, 0x8000, 0xfffffff9, 0x7, 0x80000001, 0x8, 0x0, 0x0, 0xa, 0x0, 0x100000000}, r2, 0x8, 0xffffffffffffffff, 0x6ee4ca8bd5713173) 07:15:06 executing program 3: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000, 0x0, 0x0, 0x1600}]) [ 976.394885][ T8509] loop1: detected capacity change from 0 to 4 [ 976.417057][ T8509] EXT4-fs (loop1): Quota format mount options ignored when QUOTA feature is enabled [ 976.426456][ T8509] EXT4-fs (loop1): unsupported descriptor size 0 07:15:06 executing program 4: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16002, 0xff0f}]) 07:15:06 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\x00\x00\x00', 0xfffffffffffffffe) [ 976.442869][ C1] sd 0:0:1:0: [sg0] tag#5650 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 976.453229][ C1] sd 0:0:1:0: [sg0] tag#5650 CDB: opcode=0xe5 (vendor) [ 976.460086][ C1] sd 0:0:1:0: [sg0] tag#5650 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 976.469659][ C1] sd 0:0:1:0: [sg0] tag#5650 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 976.479222][ C1] sd 0:0:1:0: [sg0] tag#5650 CDB[20]: ba 07:15:06 executing program 1: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000180)='./file1\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="20000000360000001900000060008f000ff68f010000fffe0000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}], 0x0, &(0x7f0000000140)={[{@jqfmt_vfsv0}]}) 07:15:06 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\x00\x00\x00', 0xfffffffffffffffe) [ 976.552757][ T8585] loop3: detected capacity change from 0 to 16 [ 976.608297][ T8604] loop1: detected capacity change from 0 to 4 [ 976.620837][ T8604] EXT4-fs (loop1): Quota format mount options ignored when QUOTA feature is enabled [ 976.625881][ T8610] loop4: detected capacity change from 0 to 16 [ 976.630270][ T8604] EXT4-fs (loop1): unsupported descriptor size 0 [ 976.661857][ T8604] loop1: detected capacity change from 0 to 4 [ 976.673820][ T8604] EXT4-fs (loop1): Quota format mount options ignored when QUOTA feature is enabled [ 976.683244][ T8604] EXT4-fs (loop1): unsupported descriptor size 0 07:15:07 executing program 0: r0 = syz_mount_image$vfat(&(0x7f00000002c0), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f736617e43c00088020000200000004f8000020004000000000000000000001", 0x25}, {0x0, 0x0, 0x200000000011000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r1 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6900) ftruncate(r1, 0x800) lseek(r1, 0x1200, 0x0) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, 0x0, 0x0) r2 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, r2, 0x0, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @private2}, 0x1c) sendfile(r1, r2, 0x0, 0x108d1521) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_FEATURES_SET(r3, 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHGPRL(0xffffffffffffffff, 0x89f7, &(0x7f00000001c0)={'ip6tnl0\x00', 0x0}) sendmsg$ETHTOOL_MSG_LINKINFO_GET(0xffffffffffffffff, 0x0, 0x0) sendfile(r1, r2, 0x0, 0x8400fffffffa) r4 = pidfd_getfd(r2, r0, 0x0) sendmsg$netlink(r1, &(0x7f0000007f80)={0x0, 0x0, &(0x7f0000007e40)=[{&(0x7f0000000300)={0x2ec, 0x34, 0x100, 0x70bd2c, 0x25dfdbfb, "", [@typed={0x8, 0x86, 0x0, 0x0, @pid}, @nested={0x2d1, 0xb, 0x0, 0x1, [@generic="7ffa9f303f216965a1c058afb4256998cd3dcad7fb6e2a437d5e072b915356237096f4109f7bb007e977b503f689ca96e86bfeaecafb0823c56142cc1c9791191ac965232a04747f4e7c69f8f01e8d3fd45641e1efa056c9dd885cbac5ebf043dd77ddc1e7c74c72d318f23f4c9948c1a766547a5f18ef6088e9b15b7019e4f4945b9259c80fa61c7f755ef3c8d080bffa17397f9434dbe4610599a061264839d0db6b7ea44eaca5212fa831a93cb646c3afe6d3d9796b69daf11830facff26d59691ee1496e1e1d8c73589a315fb493887487cb5124d5474d30388ee192fba8f4258444", @generic="f018f649160935ca647ced1e01246a871d8fe57b36cd8d799d217f2095252d9540e7a09f86160ec5d4efef0c2a28055b7b892b0e9888b255093523a3a0de7d9c41901ffcf87ab7fff0d35c027f7b11660b1d417092fe533bcee2b51e15cad227cc0467c8073b79b56a525a0700eec00e927cfae12923624bd8037fd70174a3a2569044e445bd1725a12b714975b9b693800c07bea60c47f453c6c6af7d094664d8d73aad310e3365dd1c33f5c41d51bb33d5b4736138010a6827e1cb74f3c87a7a6f5d1d5f5ed85813c3db7e489a6d82a0e2dd5fffe250fdd6a2ea74e0dfb2ce1f74d27bb2d8cf9f5ae27ba432c00d906cd4fb8ba197e8391c940aaab28059", @generic="e70bf36c12b445b9e675ec6ebdf9c8b03eeb799c58b1f16406c83e44f7c06343025963dd56da", @typed={0x8, 0x5, 0x0, 0x0, @pid}, @typed={0x8, 0x3f, 0x0, 0x0, @pid}, @typed={0xab, 0x12, 0x0, 0x0, @binary="0444b1faccd9a38f4f5d07a218c37709572c7d9b7e9fea92075e3565f18b47215826b053d5a9954f8dfb1916cd57d3709ee720b598707598133b96381f81e9f06abe7df7c20ab52fd6deddbfc47479791269293a1a07c9c99f4c80a6815620c992d00ab03fad6380c540dfbe68c3ba144a925802cc17e34a4f1c368ba09d6610e6df55b9d51cab992a11a53df664d3f9cf135709262eeccbbcc433b574d56d42672a10e132ef54"}, @typed={0x8, 0x54, 0x0, 0x0, @fd=r1}]}]}, 0x2ec}, {&(0x7f0000000080)={0x10, 0x1a, 0x400, 0x70bd2d, 0x25dfdbfe}, 0x10}, {&(0x7f0000000600)={0x1088, 0x39, 0x100, 0x70bd2c, 0x25dfdbff, "", [@typed={0xc, 0x75, 0x0, 0x0, @u64=0x32}, @nested={0x106c, 0x4e, 0x0, 0x1, [@typed={0x14, 0x7d, 0x0, 0x0, @ipv6=@private0={0xfc, 0x0, '\x00', 0x1}}, @typed={0x4, 0x2a}, @generic="ba6e35500cdf7840b291ea2d97040ef33a9ffcfb5675dbbe675408086aa4c092ddd93f4ca0df6d91032243437f0a9edbad8145e1d7254d049168d1c5", @typed={0x14, 0x6d, 0x0, 0x0, @ipv6=@private0={0xfc, 0x0, '\x00', 0x1}}, @generic="561ca466eb5c777b28f38e7dd86bed736e1a5da7ea91b6573c1f3199e066ab39f3befd9a00c4549327557c80ce14ff427d0762d5adcddb1ee64573c70e619f6eff88bdbb45f7565851e5b229405e152cb95586cfd56dd00e0b23d229a6b081fe561e05a8371dcaf66049f2f63a7f92ad9a349cda661e6d03e4f88b6a530ccb5896baa6f25f192b8de220d4b814dbb974419e349265d6efd9dffe0b7b9a334dc9cc2e3a6994414d942ac7e6cb509bafd968ac36afaa9adfa6972379d47e1591ab98f41354aaa8ff9f8d36859b1b0a754447013f086fa7980be357657247d85655e396781e7aec30edb44aa1b56f8f66f5a39d07877822ad27b85ec1e5b411b669dad645d755bb0d5daae83707296729be07c1da215eae672cabffd16c3d9ce067ec818487e104998021dc6cb14062bdcb02858f084b3f72b713ec955b3f37d8ba56c799bad879e4bf693661aa52affe057ee66712741a1402f27cf7576636c3e8258868ddd9fb9bbcdac8e706df1b85ee41be491589690c1e6978f0252a0809d195f5720c9825a5da1d9844108c7872e593b01dc1eab888c04335bf485960b55c2cf2ffcee7c109430cafc2405866ca5e3d09915ca8e909ae4e046d5bb44bb58a678bec6d11ba12c67cbdbd9f2aeb3d8f58c2a3ee94bfeec7c253e6598c51071bb87523139ee5aa403cec44e4f90a873efa822e8c3cb5f1e6e60c26efdae0aa1a422171b863da90df6f5df5f2226f7febbae6b6be17074cf78a42ec45fa640626b95e36b6e0c5026f3415a391ff1a761fb38d61f219e426dcc3a0e60a8ceee402acdaabdc0cdda8437ddf8ad9bad6a110180d68bc57c08ab9bada27a95227c65522224d536feb963cf580facfc354aa3103832f536f9053d7dc0b62c86c8a5578ad3f5849dadefc3473e5f9bf3a2a4a86d9f7cb20d973448c1f916053722be7716d506c62b94110daa5f65f00a76e8c6eb1b3c2d53bb8d01467dfd968f0d964207d43b1c87972e069f840fba7da47f94fbf0365528b7ebdf6be072810abf543d449ffb50307bf4cd0e8970bfb3446c649baed0888e98ebe8a3e4767de1846d3536c35ebc3cd8a491baecdd8778b8aba13c678d01c5243802802e9317307b31a18e0cd3b606616a7da2e10dd084f6fa84d27f866a65e79d0e6c79a88ea6a55705ab62cacdbde49d1db266455569af3e387a0b46123feba0461a23ec43fea703f7be75ee4be78651d35a1f1e150107be6cd16fd44ab01d717413bc7ec376ba3bb97b3870b1158081074b448bca22a2a5658fe3c47a4894c951020094139f613e4a04e73b2a499be32adc2813bb30370316558d563e07dcd4403579c4ec6376a57b1f71a919bd1d775aadc4ee5b88475c8a6dec6593b3186904ae1e86625afe3198e45320ffd783159db8e0318b4891edbd78467c0a0bc907f9006a8df645be9a2f33bbabcf04af3d2cb390087c044e2a5115cfd9193add63998201b288dc24015219eb2e5e2d66509fde5c0885b5e454273db84bcd02054de692e1469695a578b61c34b0c058c08b90cd20c7f81f5f2936bdce5b8e991d030b8e84d543037450d25a8126dc4fe8f9a74be9730e6af6a5cfa629d1cfcc6c55ca8778e37dbb516a29f2c4db3257104464c57df59ec52e2c36e24147924f57fe4d4159a5349900e2c0332a9195481328f12efabe2fc0f9824fcaeb72f0a642477ec87e92a8ddbc9c55488a528d3cb130a3983516b111ae19c5a35276d002c25ae51b63e165243d9ee75e5371033192eba042fdba8a14ffa6af2861153e971bcbd786def568ae0708f4927f1c97ae2cd6b248765a887d3e85853a6fd8ff8a91a0739aa1269779aa90322540ec60a068e4031d81bc203d4bb90d52404057061945bc7050dd03351a2198c729187c48f6c25c700390f9eb020a0454fccd3f6944b92f7543aea97c7c84600a0c7a98673dbebde85c1c5dfbaf158d39e792ec0077eb79c5df00b389ac9823cc79efe82136d9f8ab85496874b5d64ca9892f3129e41ea0ee6dfcac341c23c7a9bd1f0586ec75a0b396bf1ee3c7495cdb794cd180f85933251b3eacd6d4e140b5a9275a86f815919de693a3a09c197db51cd5029aae35446017089d7b5d5784fe14038c5093d9a629a72e1417c9931ecb22ddc9a7faf3edb0e71149fb5349bb86538b5eca7a36980faa8a25afb12d6e71e8bd1464826d0c2c1d52cdff12a9a4f6e379961cf1ec5e48790cbeded6250e2e9ad49f79097d8221a3f4172e7ee4ad50734027da2ba6feacb1ec15a522c799ef4333143540efd2c6fe09e6b885213dcff0bbd1de96616ccf8dcfb2f7a6dd9a2fe315b565dad730bfaae4f8720d012f786835b0525107c9c5ce54c6a7ddd3d5ec0846e1ed7f1d6cd9f21bef0ded6bf2815a498801b574ebd1a6560bfb6d52e185f54ba81289e8043598e9b283349993edf2558cba7a9fa52c9819a9a38c94877a8778f3b6dcc29d1a71545ef51ab60c32805f2c12ef12fac255a5cdcba78449d645b642e44ee11affdeebc724fa99c6495cb825dcc0fc22d86f16d2337d930496f95421a111e90f16924367d23c0665f8d465e9c5a535f53142de746c18d84cf77db38c5867e707b239ee20fc6dbd8351af9e163264b9c08fdc3e1916d51e0d0e75a1d73395f33dcd922a8a1cbe175a18fbdae1310c033849217677153e0a6bad98f036638f19fc1df615395d97e8f2eb1c43c61e49ddf4c27bdb12442b0a537fb8bf4bd9981d881a92d199d0c9669afef4848fd8bfcb8d707afbf6e117f1c0ef4e99b2ccbae4fa3f805fd2887fcd6cee009da2e5d147d06041e6d56198c1d37b80de5604a5e465742d4b93463ba061015a6f9a2a80c57e2253d9c904db676f8551c1790031900168bf01e9d9ff6f3df6e54b3d3f69ffa4b1aeedcf8e6e57654f863e391e3604113e171beda724ce48bdce53db29c6b386f5aa45f3f3eba9cb82ddd700980ae9960c39d059d1b39dd650fafa1420220e10bee04df5fa9f8c88a63f69360136426aa79126296c5080946099d47c416a3e02d857b7ca4b3a2c9932c6004f63ae082f55abef7599ced3014f173f1d284fdd52751aa4e41f7296079dcfbbcccf9bdc0f98c682f98128d86ac6bfd089677096ba39f6b886bc986355de2218c9c0c892928b8a61a47c1255b1c1ab1068492e27a477ff3357895619fd4ff3b5f37dcd02077b453a68e262c83a4bb14130b71c6fba33d8f3f3711a019c79484c5d1947fdaf603e42e7b670dde8b9dee9c33e852d71b7becafd472cd0f533329d6dc7176e254d9b617104280245679512f8a3bddb30b957b0bf7a4bbc38d036b20ab7ec63cdf849f94b1eb9f7dc5be1f9f9ffaaf5bbfbb207abf1660d742c174dee53014d0dff9aa772f09465d5e56e5536070d592ad9ce7359a6ff65279dc4cb759e3a7944a52bbf99f651a0256da8bfd5e499a3497224204b8e720bca7f02a387851f578f9c534ba151dd05f7b72bd5ee21895c5bebc6df99de9f25d6e07897042f6aae644c5480d544d3f28c41b90349d5c400dbb4020186e2867df34ac1d173f7532a359a9d3890ef6259050993c9d44d5bb1c47346677e93fcb637f2fafd1ac8c4948a5d1572c4cce7b50080fdc8250ce4d57e1a6c3533ffa841bd274381a68e137f5cf20791437d0489bef5c0e5733f0ee7de672470c309c60b8dc645fb179e98135f6e04fb06fb2aaccd934fc0dc9b7d5a8621d2130e1676298d3e2d6b0a3b8fbc6e6afd9bd19b6093f46967447d4842a5febcdd6a35d147f9a55c1397637c1b1e9731f5bc2a7e654822e5e19fe54c51c16eeeeb1fb375a01d22f344b947d0de2faf83528e020f2c586cc57916c3a99320066fea593630ee55bc272051e71473f3f3fd01f04bfa5f339660b4f4e87e5d6d86bc042ecc1f616d2542520876e7edf3568793779b45b597cd1a79df09c3c4b59f504f7148138579e6c4b5608960195b5a8b064ff8976c678cf7c384648b6f7ede71059c2f6d203d933299b798fd9f7750f87c00b146455a035847bbdad4a5c7f75c356f1aa996f1d9b2bbb4533041066323a19d5335d200473f1776a2340e42573851f86c110cb71605df9cea14991cbac474c9d97ee45ed35c27e0998f58f1641d35fad30e6c55c736f6d50b94b677e38a1e5e6e5dd38d614a7f0c4b21474bd7fef2b526763aae185997fc47c1a02fb9b8e8262e7d6d8c7904fd4ea8f2d68a1b618afe7f680c907474135769c4e6911fa1075d49da96b43b1a7c5668e47d9eddb2605ba73b5f76d15b3c3a9312e79212a27b9e251dbf96daddf227fd008b27658ab7ef061d418006cfbe0154191b4441f2abe0d315197d2112aaa38212bc6537116a901e87cd4347f58ed7a3df39c3cb32f1dae1035fbc7f5c45e39d6cfe7b3b530a02f347c448a4c539bba33e0eeb628484c65e8d029bfb7d7c8001aef20579a98b20215fec09f3323c224f66c8889f6cab16b553d61d3813de04a9ceea17371709b8c971b0a18626edde7ead0eb5f37bbe7967d7981b4b881c7a040a8c84df17fae15834696143a73596aae334a6a9dce9f9b04112f831582a7497c51c36419bcbe64c9496faca966ff77a38af34f518fd6c89e00c00f9ebc880afbc7ad55dfd0b4d2e81c44c005eb1efd2740314d0d37e9ada0c83726cb2fb1176e4d44680fdb22f13c53ae28a2f974a08db303aaac808b9fe2265be458fd681bae74921a43c4be221b17ac594417481c80606b0524911a69a6dcb63b3fcfa7745f14cb08fcf51cdea527084fec154bcdb7b604502ceda9548a8df81532ea4338f67e39e4bb205dcd9d3f6f960b0de05f01b0a4c908fe973c78db77901b6c6a0bdaee5a709a508ca83e581694fd1db76f249364b0fb327cb0f1edbc409cdd2c8a31474f60228dad9230ed971ddf74c7faa5510efa880a54e272a34a0905b2de7caa9259bdefbc5561accf8390e10e5049920e1d6fac655a56520f36a56e2870986d33a03522b03c06ae635c347e0b0c42556246e6f6c4b79ab021f35968f6afd0119cfdb03d398950114ba9bdbf4bf42d327049dff7923e0ac8151a3f7876e303cdf655bac35b688220ac2da2258e74046a18858c2bb8995bcb865b5d010a7dd664594e472c294b8e1e9e49cbee0278d9a3d935f52fb6d76dba9e94b52f0f951cd6692d5dfbabdd0b29a28e651112ff85caabc3580e792d8f1f341280c0b546028ac80416dfb10080b94c10f7e909e6a7ff762a0d9fb8fe9cdd39200c585b568e3e0b4619e19b61b02c3577099338985f6a20fd77a86ff296635aad4ef5a874e2e9c5a9a9933a0d69e133427e2dc8d6d4e8331c4f87a127aa9e0da305cec259ec3833818fe047f1f1725c2799134b0f5a685892d7f10a47ba80301815b545ac4dea1db03865a5da3ae046362dccc1605d045c069a7eddd48d6240cfbe3f6794707ff5d5639cb5f6075337c2c3a677ee878dc145a64999230682e0bbcb5eae9870cc186d645ddf8b8278104760481f07a51795a75b7e15d7ec5656c415fb9f1ae627e84144d152a714c068c737aea3af22cfda14d9de874bbf318487e662792dadf95cc6061dcc9c48a6cb8e579809d2c662f6ce28a7fa1ba75d6f874fc6907e46bbca7e2703bb97a3c3e5890d21a4290d44435c73078aefec3e254aa9f3d7708fdda404b898053d90d6d2f0b85cd50776928d8fb1a82b77864558c45eea97d4b0c243a3b79f144a6603b5a1a02286317d809ce47dc25cf7e2de2e9cc3763fd641a2b8b9b5659e9d78a8184ef8897c40519ff8183942ba874cde2a503cdf"]}]}, 0x1088}, {&(0x7f0000000140)={0x80, 0x16, 0x200, 0x70bd2b, 0x25dfdbfb, "", [@generic="ba2df6685786a0d26adf143ad76bf0edd212fe642914793ba36b69af56f8f019411546e4940765e837ff138461efcd4c5770c839d70f5c6f29dba73fae92a67d182594d73447096b6b5f26ad74d67d97c57fe9f1bfb62768cf0129", @generic="e0361fb13efa52f3883945a73b76523e69211ff1c0"]}, 0x80}, {&(0x7f00000016c0)={0x2e8, 0x26, 0x1, 0x70bd26, 0x25dfdbfb, "", [@typed={0x4, 0x60}, @nested={0x151, 0x68, 0x0, 0x1, [@typed={0x73, 0x85, 0x0, 0x0, @binary="9eb1279f23c1fafc78147089c7b6c518240c2417563830fb0f9f41619f306125583400d2556643a0fe5e2a1748a1ac745024688021a87d04b57f263e0dada1987f7edd8effea9f73267ce95b012c45c9bae87ea63e23f07cfb7179b44d04e8739f40210382f4ca8083b9db0b834a63"}, @generic="983670b656f57548b0c5c16994c72907be52ebf6604c422cd365eece17afa7eb9e4db79c19343e5eccde71584d8c4c272a855b0c474ab032e347d14a389f78166272af6abbf7cbc60cbc102adfdf900abd36156c25900a6136910185efe9ba0990495dcdd990da8b4b7fdf6aa4c79c16b3edd5eaa0569800a719dece0e3b285440ebba40683a880cbf4b697e4f099f5aa5153fe617fb9da51454ff0741750c2931e39e258659b4e53bbd5007104a4a62ff2b076c9e7ce66657c86762e80bd2c30ec219a874f1b8a6f94ad7ebd669c145809315d8664269e2c4"]}, @generic="30a00d25a5a3fd85407eefa2c19cc7ad43019a30533d13316d026a861017e839517a7e47c1d458d424bc8d1d91502e84d21578e1adc246528f3e079900ebf1adfab88be29c1ddfeaa8ae9c5cfa172e39841c8a63c7f7d46135c62464112bb86b616202f04cfa195cae970c5b4b85db0ae1c6b96aa084fc0c12aba1c4751217dea38e1e25e2b97c01d29a0da15ef519c562483e", @typed={0x8, 0x14, 0x0, 0x0, @ipv4=@initdev={0xac, 0x1e, 0x5, 0x0}}, @generic="a3019a7688ecc606123ef2b894b1dad0f854a80836ec5e54f22f285883cda7e24e9a5e25fcca553d5ba1e6209f17d4bebc1e65a7d91de378898efcbfadf426747c65f13ab2885c165df2841ba9bf10f3e86455ac8d2fba2534eb670a85a5552b9c8539152cc53c069613afe6b41de573fca9cf959fb262cf27c2bb10e93e9f941b7ca6ebeca075d031de41fad04f2d4f1a2e61d300540030d78618dd7af198992cb25f8579e017ed78564578bd6c5c749986d541ab21661d39c3a5322e3a5f2be285a928059da711a00faba507b5a3183670c095fa44bcd76c0b593d3c1e9cf67a14852f"]}, 0x2e8}, {&(0x7f00000019c0)={0xb0, 0x31, 0x300, 0x70bd2b, 0x25dfdbfe, "", [@generic="3299b9c8c4b108a5aff49fc4930dbc92424ff883163c1ed1489e6e10e6657a39129822ef55771f12138d5df13f1b73ef008815d51dc646aebdb6cbc193a6bfbb3fd9c5fc57589c38e70234112fbdce2cc3bf48a77fdb418ebb04642632cf7b504932440f243c2cdc17aed739c9c20c92ca1200f9579e24f930171d107b68474c7b050a2a368aaac7e3ac4c62aec3f197a3929ac0a81cb4abbb16cfc065"]}, 0xb0}, {&(0x7f0000001a80)={0x23c0, 0x2a, 0x800, 0x70bd2d, 0x25dfdbfc, "", [@nested={0x134, 0xc, 0x0, 0x1, [@generic="6b80b5de73a35a02fc2a5a352f325fda2ad9ca1cf9e43207e88983c4706cf64aeb36d728d917326519a357719383f3e6472021ee13c7d2ca99bf15a6b1e504cce0849a53396c2f24fae030c6240f37e4af91ba582e3492b99f55fa9a488c4f35b0ec2d8d36c91ef63be5323090b46d38d775d69ccd436664a46feb959b079c56d5807af385e6292591c0cb2dcd5d", @typed={0xc, 0x8a, 0x0, 0x0, @u64=0x6}, @generic="d45c7bdbd7b23da887363f4c94b0aabe9126d328e8095d1f4f5c9b3ebfc31104d5d92fe00f206a5e7e93b8334958bb0921c9c79ffda42000a8f7b22c385d6acc0ab824ba9f22d3f8084e384dc3f13fc6d62d2bf8e7832147bff6193f20a72a0b746aa07482639ad5e84c92605ac4cc0b14d05a198f46a272fa8b13702d30295829e54b5bb8325be8ba5a4b884a703b84cf03db389dab"]}, @typed={0xd, 0x30, 0x0, 0x0, @binary="7eec00dd4f69561832"}, @nested={0x10f4, 0x76, 0x0, 0x1, [@generic="9a53a9f1c8efc98cfe5c2c67a5a1ca8b544de2a7a1bcf81a9f101cbb0c49c20a3c3b25d676c27bf0b426bcbf6eb07cbf8e26c9992890835bbf4a898fded6", @generic="15fd79e6d05d77a6100edd960444dc75aea7bbc1f515ea4a6097ddae5e5fa83e08b0d1424717e89173f46d22e1ec7c7adcc66980ee9c4ffa305bd6ec556b305af01a518795cbc16368a828d2f4baf361cef33c87a00be95518072c8a6529daa017ffa0f0378ab195224116943d39", @generic="1befd3e8c1fd69a4001ed63d273d71196ec3934cb033d93d32a3a7c71be947f9188ed8e0fef5157535a014b723bb1bcd2a8dd43195a864a5372209bbe522b2c19b3aa739d07c9710d0829a44e484b2bc1e222034e5905f1cd7210435aae018656fa3d5faf7b21581209dd39cecb6c12b75bcbed42112bef682b03fff300a2b5e29399e488d15afcacc6ea5727d5d43287a020658b57d3cef11ae9f15bbb2cf296d2cae7889fccca1ab566ae53af4c8a23bdd84e0eb50cf7c9028911b96361d14a47d14a9acbc587c099074bf37c1fdf4cf4c50a9132d0fc65d28337bcfe16940c82e1bbbece34b29c28e9b66cafa89362b6e185f524891dc4e46791e15d499313ed3c8d840e8d1e57edc5454014a5594214ad0e2092b5ce738b9522095e34693e2366291f0d0338234e4cfdf2585b551b23d497702d2ee1dc36deed7a86282f2fa5686bbb4b6f0249b51612a62102e262b3baf299c6b527f5c63e3f409b190c78d793caf7b88035aa7ea913166d438424abbfe8e2d539ad0dc6b261e0c283a912e51f45b7f674350c64a893cb183aec0189f22a7c679158d1936c5bda5849ef3a554e59b8d771f2ec1e67e55545506791a361b77048858f90850f734718e41ab4add997dfa8b61eb389d725325d37142ea1a40909960e3153b7740f17ec5e8c68ef8dcd305d27899563bff36ba3ef666baaefe783393f45a065893df4240a830f1ed632d499ca828b9fca5d8c754dc4902801ae0c1d25bc652a0bd41d07c271cfea2396c32035bb8bd240ebe50f0d361e46acb2e535338dcab07d88ad38754a88e39dd546057eaf54a4dd218b2497a8192eb8e116d4ad9313b308e9a7a21574a16fe2470270510529d33a00a327acafe8a21c6ece354c535fd4fb2ad1aaece51d1229bfd8443c8d071f02349d928f5651f02828904e40c7b72d0056f5f63444afbc0d8f3245d89e60fb47aa9425741bd16c588ca2ced94f64fc51c28356dba761cf031132a1a097996dcece3eb32b9b76709b1ba90b982e39c789da25d50319b7b8963cda5482ab083e1eabd4ec2ee63c89450925141c28947f651bae98967649268278874ff349fb0703dcdd30be3e30e76cd4f7e181939514b183b0fe46880c71729c79c1a4e6457c760f403ce70f7684e4c4c9a41cab8e0f1a0de9fba319b8fff25b8129f7dfb6a466ea3845cbd7f17a6992f9cf134393cc36ce8ec4c7bb8555ac3cff93f30580d908490e5d0b67994e6e12d9c83ed480cf05336ee790ead34edb2b6bd16d7fa19cc2fd732d0ff808e1a999dcf72608c3e5fc8ccac5b1aefbba5be3740f509a7ccd4fa687f8d897086abe9755e76dce649f2a8835bd21fce37527503522f473be1e1f783fd6daf04311b7f5f66c5eae6e5bcfaf90b25c3e8085c643021d409482d26b44e260c114a3b9d302a46bad644e6499f8f42edb693b7ad2fde09716f8470c54ba610ef03819baee02b10cdf83df0a7a5ae5c15b62dc0a7f3c8dadf0451d7c39f3d0e8127539b07a7c228802f8adc97b8dfbaeb94feef4522511f12db20f4e0285a1c9521ec4a8e78584b06f98453fe25b1e32c8daf6c7ad3e2cc451aee36e29c333cc9967d396f3b85a1550583f9cbd1550c0cecb51bce531331f73baa6d1aaea427c1daf217001b060af6f38202f257025e87798dba6c6efaf5ba68aad910787b1526ddadda49b62c821a2644d75b6e758ad7d7a06eaa1b107a6ec97a1aeafddafe25d1aaeffd3f58581864458b948e1232cbbe8127cc1803a22f955bd60806d422018be3eb8be669152e4f7c18339514b16b570c0a13915587cfa1e5f861f2e1e783aacd583f785ccc9d68bf498dee8013ca662072ccc10b461a478f19dd8b90e116cd1e36716283815cc3a0c97466fd8e3f1da3dcfed44d0b5230b36bc65507a2a94f5c9240d77393e29c2216459a11e484f9b4557116ed587fa6a9f591ccf9bcc60f9c253ac952fbe57f6c394e1dac17a5495d956237d89fefb95c4a59c0d4237c035503681aed55fbb01c9c0df94d5f585d6af23db82ea587f15dc97095db5f1c079033539c0beb29f4a56e45f965c790df32089e18af6bb27234d45ceb544541516c864fd8b89468b7d56a6e20eb530cd30697a2b3fd6f2f127e12ba6bc1e2314b4d9bc06ae87603bbd3bb9fd4b2303df14688aac3275e1ed51b50139b15a13bdbdeb7f389efcb64b6ead8a1e54eb40652e120ce43cb8b14d94aa04111ebedc3cf973bf12c28d030002d4c14d697b6a5fed67a9ba284578ba5f0c77ec28c0a9f8958410d291a08e19717fc0a5598f4583c060ac21fe0e503660de862ecab01e7069462359d27bb51bc97519a40280f72f4cf441802a431ff37562fd88c2c2d3ff9e5653d255f58cf7a96f402387bc0b87bf39a26b93a00301ca4fdc46816e28044a7f96a9604349e0b455cef217907edcb740b0735685106172a870b79362e5e0e18a24324b90471356bffa6b2f86132f66d3ada6309afd01324f0191347ac2effea06b3a8bdf462b2157069bdca485cbf05b90abb5fa2dfae95e4341aead90deacb8f3ed645418563ad76bf8825ed79db4a88d304045e95dfd0d4d57ce47486b042de5f269be3f05964de2e5343b7ac44f66353f4ce58658cd73652e8f9984188e9616105b7b3a608bd235d9274f861ac936cd262b1eaa9c79078efec3c1c9e269546821eec7e4dc2b09ad7e2ff75670778612441e34102e0d674dc2b223edc902b41a69c8400f4a001ca96d51a6b4ae2d6e3398a30b28983e55c4a09da240f140e34719a4c1c9d5333ea98d64c9adc349a191057ee84db4700d628e8dd401789f1aed459304ed0725179a5b790dc77bba47bd91bc3a9becd7fc4c07ad5756488fad555c7b8055fedaf32e96672a00a99f128bfe14e45e5c07b8506441ce750ecf2585615a68997841cdade99e27bb940f26aa7ee42f7b3b9380a6213ce663ee6619a618b996c156a4a3ff5c1d0f1478c48e5925d96cbf66e6c1f49f0357402f9e0b7ce3b6bd1143948760b05183689881193248863d689c259d1bf7234afd33f6387f5c12e15a1939f325e3ea0436e8046638a4daa00579762f1abc3d0c345fe42698d4d111442302cea4b74e2c73cb20bc6e32bf40fa5e5677f8d22dfbaf5a323e30c5492124aa080f0b2e2fe3360161fd054527f5083aa3b95d643d734a07197cfb73712404172989b1751f85035e7cd0ab0788b308526a22905d1e4d0d55c21e1a03974932454c282fd3b3b8df05822208f8fc8e82204ea749b0049f3e5b2925cbec316ec502b1c6aa7804c09b3c4f8fa8ebe67ada0c10c285315c74089d1e3358e61f3b32c1fb9debc5b75015cab213cfd6b3b6a7f3a5b63523d6dfff03293fc8e5051f87d0bdfd5dc1438923408b3ea722dde4a80a91e7c91f5de26205517506a69c9e83936391859e460ae8a1ec8378cf91fc3f5726874ae42b227f4b15ea58a25319a5abc759144ef7a7c083c62965e5ca677a119667fd3440c245026146ccb9bde9b176309c412011b4166890ff545bd3f3bd9da1870dceeff9c59f65ca1ef40d1cd1234451278d6b93f3c19d3bc109b79152017e775c6398fd4e1602874a7347980d086f138ff203c2fb2ab405a6bd1ebfd160ab10c8cd75f4aa2fe8d94badcac653c55ef824ae79a26287fcba3b3ac48f2335102455385c16492a472cc54bf0d371ff13bb1dfe4f13ffc2d4dbc51520bb281abe4795992d0d98957817603b6709b572f6d45c9c5dd7898e15a52dddc9537b9f891e61af8fc887e2761090019b675ce9d84fd167370986613c0bf3eac617da271419b2c274a9e94ecb829c32566352e3fb15d357f33fab33c96f10320f12709c6dbbf817a647d75e8f330d2ca2ebab0e9907184ec7b96ac61b939f42f71675d7034c93747b1ef81ca1105b774d3e1ce780c76ae7d326d1c9f5ae6ef994028657526f1d5489afe3e7f82600922afbc454d0232eaa901cc87ed270c9f9b441e6638067f5bdfdb32d2d58f4daffde3359e97fa63ef8a0ac060c1cfe1e73a2c301077ebc5c5221c3b97bf4f83dac6ed8965ccec19964bd5f64b60af2345dfef925ec11b4182c4b4c79c1d0eedf6c6e52f07442ee1b4941fc132ac771006cc9f929f41a3084513b8c32a2b3d1816f4c8e562d56338666702af4d7721efc867c65737dbc5d712deb4fa6a49484e2132608d9c5c4ffdf6a128a74ab628b695fe8fe56f89a2039aa37e232c4638254154196e33e89cb8d4ba0c988528d2665eb114ae63cf66216663129bebc4b223a3be18aa9e96898ead98f63b0d49029dffd737c85337edbbb960a4261f7b45e40c20339be5db066ae050c4a23aa015e1bdaf9951d6abccd577f6cd52f29b59f3a77e365c8170fd1980762142bce2cbd40bef38bd10b707d751ee2663b6bd63be21b8073e64558a639c7e6158546a7c601e54db0da14c42b3532520b75674d45658bf5fbf1950fa1b62bff46772dd787abee1c4fc39b850bab814dfc2c0bf4032ecb332dbe88ec4edf0e039e043f6cef1c55ee6fc36641bb6bd27cb9554bf4475aed59fe649728ca5bc031db028b7069aa12ce4e23980d6a98fc77bb2fecb2c2c6c059ae714ddcf6cc8781b170587991601d68bd367c4ceb6b1d0438bbfe632d37f1527e34be7cc7d95d7fb79aeab83f1d0043cba1cdf32b6b6f8378b28c573c5c3650c65080494233aec5a5863b56d4805fd483c61c19b88e544cd3a8b2ed0e8aceb6a4a3b661d51c2f28d7ab4acd54e2218e694cdb63935613165a20ccde78249dfd007361d2eb555835c430311a4525862e16cb38a465fab367d9fd7d7cb8582ce10215ba37e2c5d54f2a8a47d8074f19cddc6f720cf55fb3df1c63c022a2877a2176293341b4044c2d4408490a0286c18e34252d3548a0f0c1bd1a09279a9b7b2e84bc9237db102931e17f503e289559d68fda865b30e6971cabace37a4fd60865beb2667628a3daf89ae5e76dc33f90b983929b7e51480813b4542439faf0acabceda9cafd351eb3809002e0d6fa3a466c5ebe10bfde5b49d165c3f7faa5233091d9166bdd2958df9f8141507b08c4534b7cefab082ec6b910879f9bdaae9c1f6c7b25fd796f43f2dc53635e942f99c09acd19a28883b4d48d783e66d0780d3ac3842b5644e6cd576d72eb0e6be65980a8233f23d8e716faaa7bbf48f5b1738cfdc648baf527b070d9b73fedb888351c1fe7cd2779f6232aa6e544fe7028f228f85f36f5394fcb1c7faea807d73617b05f27199a0b6c2e6b268bfee74ec2e074564898dc36f10871656f3b1cf398fe93c089970bd6d0d7234a748bc95a3a49b55d814da28015cd5ed83d9746b163de248395a477221a9f1d714a6e9fa8c8e62be680c8eda5d5f5ba627e3b1135650ef1c6f352c481ba5dea48d450465684d0da2cb6d14bb67ce279faf91cca919bd10813cb5aed146cf1d3919e4d6e7de70e5e3a5f59be18d1a7e2d0150e38b2dc8528f2d340f4b42a40877e9c3995311444c0a4e5b5e51f1d5baf4e3c24c257a07c49f5df645d0dfade04e395385fd42e4b65e6b028d34613d371520d312c90fbaebbc95f88e343db6b7daa64e510d564749f665a4dea783be8b0a55a91194d9341d8bcc6166f2a9a8130be8c7b90892015e7b89544475060f08baf299ca23aa724c2e10ad3df3ce22886103c4607a276660fb51b2d16383425c9cbeef20c3d4cd7277b55a11cf77c53bf24153fc16e2805f58616c9bfb766dd745df6da0fc715e0ca6e39541d77b5e1108b0311b5baed18f63d9016cf75844e7b013ed833d0", @generic="d7d51b855920edac33c830c0c7f2222df43933bc77521c7a82ef1429a176f3a69863173ed39853e2281259aee7bda641169b9d3d2ad3dec1", @typed={0x4, 0x64}, @typed={0x8, 0x52, 0x0, 0x0, @ipv4=@local}]}, @typed={0x8, 0x8, 0x0, 0x0, @fd}, @nested={0x116d, 0x71, 0x0, 0x1, [@typed={0x8, 0x41, 0x0, 0x0, @u32=0xffffff7f}, @typed={0x8, 0x65, 0x0, 0x0, @uid}, @typed={0x14, 0x80, 0x0, 0x0, @ipv6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, @generic="a3b4c509d2895ee9d191816dc03564fe210bae3d5d9e13b6bbf02dd2fd12c6b71dfe28b9be59287a408cf65b1b7ba1a0b7c8471ffd752d566de814a71fba2dee660f2ad5ca183550e75a0852e32d955ace9d9bcbb9a12af0140e21bcf3c59076494dc6cadfb9c9c34bd29b8001f8372b100bbca915b24b688fa41130b49bfb813efa38eef4cb9711c919f4b5447a36901662b6ce5b9e75c4c340977a81a7e2b33618dd8dd5fdbfefc40b35f233e1d84596746d8f3046871500568b2a82d02e8ca65307964e89a3966f8f47785a89df02384086778577e9295631c7d16bdc29d2c3dc596b1e0bc8583f98a199a06ead7e832e2c56fbaf44d4f1a11d20ab7d646e4331e524b9a431af99861f79b6790085e966ed43fcbc98f886572cd9f6ac89de168c24803af710647732c087854839422cee8ebce64520d6c74d7f31fe0ce1969a5e97059dd6fbe891d97dfb4a4d02c8ee08b7b81997f0d33937b6b349368dba73409630d73b8c48c155255b09088386196c40706d6648aabefcc506a85340dbf8537eb2607f88cbe7b12761deb978fabfb3afec2c81adca1a49981e45362e0996e44452aa8fc758481716c64cd0f623771712cfb1143c32260c44a3d7e0aae08ec093e3117dd13d5381ae4ed1f851030313eb49867da319635f3085dfa7719a41afd5fdcc42db1560e9abfa33661523f12c5b626e5d523867ca51c377d1f5df9cc26a5da88d18bb0cc3260110b7d2b3dc66be18a034d590ccdfe577e98bae543ac9ccd83055d5e77d05a3017db9f97564404c78c7db6d61eeb1d8c7d134409096c0f4c824092d9f33bb04201409eca51b3e684c7b88d0224e2703d97f2f83a57cb3128a427881c264bba576e9ae35aec6217ef3cfeaf24838ee28226ed0bfa1854126ffca95e08936b458e18249f4f8a440727b288dd5f6b3fc59461c0ca7de0ae9887a0462d19524229b7c4cda90fda631b0fdf3d480db676ad3098cdc473f703ee1f2887ad78704c28c459b0f0bbaec4b69a9955de661e264b262e9cc7990fd3b01e0151d8f6d32581575ff163787fcf77d309c41079e55f7632da2161a4b3cceba305f2d4d16439dbc85a450168b530a529aa32fa2181197eda9d23f447807e3fd0da144cb452014584000c98ee794c14051501a7e2b1944d60fdea68cbd51beac6a849033acf9904a78357fb2c3bfc217ef7768de1f4051dcb09d797830d6016321f1ad376aa86da1ba537fb46c0c6af70e46da71071991949b22728c4c3aeba2b9ebe04f6a7bf876ae6ba712ec9013fd0d45eb6ba7d7b6e556ee63e08e563c451051247567d031f7a3931ed496e6c2a2a212f5350bcddad6e5b3d995043e3d628739801d42318cc6dd120f6360acb1af4e58d1249683cac83599dceb040d6afdca281e28cd1209c5901c62c73943ad282d62c3e8a9b6cb765aab2e1fce6c414a28c0639a4fb66cbeb0fd993992634f9d6b459b607422884094654e30a54ce7ed6418756df59ac0e6bfa12342478bf32d838a445d2ea4509937e77163cf9669be0d942b2fde15c53f0a76f3c97de9ac211ac8d6c89b764b53c24a2b5e4f86291fbf7c8f23eae26752ec68702d549695190456c63d04498de48b4601d3ef35d84227631bc1ee0dbd9212551ce8f18c87636a9458413e1b53c047e2ab38a8ac84dc2216728b9f63dbd7fa60da09fccdbe89c0982246c48fd30a76d316c4504af84de41a93b79ac67250bf93e8875c26bc3132722bc955315aaf34add2b0e8a2d3b07ae4395a5b4bdcab4a7e8dd48f4480e52558fe15dcc96b4fe19cc440d223cc272d9034580ccc5247c3343c2cc6ff1c3f3dfc413f02ba89764a8c45d9aad1444126e51c236536afcddca370081cf0b59083c2fed64f594c23cf8c1ab340838dd342a119b19087b9c6994e1ff960c7149a5b4e9bca85d578f2e120903f064ba4dd814815ec0c3933d0f81261b6b259d9c4c3ef1fa83581d010242cace8353893a2ba48210c5d19a2cde554d4e868b076299241e247db32e4cc70b8e2da39b039f1e8fac7043bce66ccf6c6946ff76bc374548bf592cbf03f8c7574d80adffd30df7a6ed08cee32318d5df68882d0bb410793be8b9bd12b5b0e73321f34c247c8761c12c196444ea8081bdcc0bf40fca0e0f56550e13112303399ae5f1c2acb8a91374ace66e50dc10fe200715a2795c56e3a23c53f25e6a238fa9cc9416a0462a478be1984718e8167885af0a5855b809399f70ab2a72fffe467b88e751687ee80b9a1ebcce9581fdd3f325453f7edabba360589c3685bfd1472c76eed65a2113c5bbee9eb80f19429f07a5922a255e90f221da88a0f9479c7354743060299473edc395c1542f56890b1486ff4742865172dffa650b1aeb3d9b456b8a37fd16f83bebe71c05ca071ee4264825fc3e6d154b9bec3637b862229162125e3f5218b83f1e4afdf7533432cf5e5a12ca17517343640acd5d67c17bcd35fc977b8a9fe686aaf8079a88ebd6d648f1a11c149aa330a7454ffb2980ef0eac614696bc5d8c2f768f0ef440de92b9374b75be9e9544b295a9092f5b81738e3f9c4c2a420e2a989cdda6005973662cbe324256727359416a4876fb5cb3eb5155b0ad848590cfb78d35265fd83da4963f48c1eba976c14d8b8b6c79554a7017903722676c314d94a6a5e9590bba2c048aff434ec82e14f399cfeeba50a67deb6355304f3e79610f43f400ec1be62566ba6505ff7b82acb00db0fab6f8e19381cccfbaf7701fca8b847b137d76b754d27d34f196b936ccad25989f696d592520fd3a388ab67c4529ccfaad09caf561b3b78d7d73dcee54e72108ce46146436859a1ced7643517d27d574c09ef7849fc11a84731282fd391aa4cf75cac8c5b2e25466954c1fa3b932ed2798fce196405b67f350cd42f392d4eecfbbce0849a5e9f6b7e96591ac9ceb9fae77ec52746752e6b7c957de52775681569ac8b60a5a995eb17e66c309d51a6d83acbbd5ed35992d51a4bd5e83a0260c8b484782eb674f7c311b7e94428a45ea61e9cd457648a01eb5e99bb3c324ffc10aa837c32f39d5d12f05e384e26590d5320707a2671f038a6dbd95f747b3008fff2e73dc0a3c90ef91b66e6e638e36ceca7f9038e6b586a701ff29c23bc32ae410a1a92d47fe71595c1b5bb7dd0c789bc4409e82afe83cd69f546dd9577e66f455aba6516768b627e7fda71850dc288ce26cedac9d6f5b0c89542ffca4c44d224a7fdb8a252fe53ca4cc70397b2914f1b0d53fc1e7b9e92a8a52d3a934ef551f135f516f1427b26db632b2d5fb22b11fdcc71ef24b18f444198200c714eff0f65d0bdfbdde31ad4f8e2343e7b4e9225e98f113b49cd0939b0fcd8301763a8c6fbd8ed63cc4ebe20a63e8611adab316a51b8f892615a4ae8ae1ffaa03e9052feee391454ec8f4783c5ad02ba9ee6bc1cd770af1bb295bf81813758866ee33dfe95c2d63bb9dc874c437f23326b6ff3035a65f06b180a07be9b18d5fd53fa109c23b33d4dab8fe55cdc9796b6b1fc079d0dd69ad63595c79709caad379dcc096488a8ea145009b5b8216de92d74a56c26af531b78c86ce131b2de76939b500e9d987a955df301f3c1ac780d44fc73048b835b7e682ef07ad2a3e3b75a706285ead912a3298f718b7135305195fee5ebc4fcc2d2a46d0c7df3feb3a0fa12ae253b9de22db7338c0a311218fd562344cc575c6fc03645daf5c21b2a0a63110df9de1c453c9e9677f34fa305bed36bab917a408ba606c8d1043d56b213b54adaf91e660d997d2cc0fab5674579146a0c494ce56dfe3b9a61beb2ff5b2ae8e1134ed18583fc10c05c2bab9868a48823c08a15386080340f136f5c668f540b6c6dd0bcb7dfdd1f218c01cacf52011a25f759b6babf8894b23591d0ba7653d2e800f918479052cdcad3f3d9876703fc5ef6da5c85f822118641415b94facc5da9a4ad6b189791dc1c917adb4d19c55ccb7fbcfa44917e23c94c6b64e19e1430012e2245969eed53e816051093589f352a38ec412ee3fbce28123ef4677b0ee60de555311fb628e81af96efc72d8252607d436f4626cbdf78e283dd2c75518c8a26816f0fe59286389432ebf0ee32da216a25d15ec70425a19340a9bf5d13f512160fc83b035a1974843f7e0a181df736875ecf7ead7fdbd2ebc053b4e8751ea63691caf1da369db1fb535b6943399a6367339386197be46deca96dca77198bceccb8685ee25c44d83cd34159beca002b79ed82175b0713f796b75b0e9caf33faa77f648efcf147424f9b8577ebd30f1b8a41dd089f6ac05638a547511e0ed71df9bf46f1f5c34dced0d8d85dbb72d38cd9ca708d00903a9e6234f16f323161957dc1be0ad81df29b3afa848fb7755c62c08cc301c307523e9afad0eda41903c02349c75ea19f74bd7ddcb5f6150a9828b790c05843b2ff054fc2b21dbe96bc1761571cf6ef7cab1f982e9e94ad49a143ca7f49a4c7dc256530316d1a3c63e9e059c8d36278f9ad1cba5a540cc46673e360d25f94582d90ea3c637f694427bf2228db189da188f304a38ed17544bdd752e2fc0781edddaaeb6147751e09f97abb32f52557d9d3555bed11a3ae1664403677d46c610942c8d1f880b8ac8afa2ebddb0bc3f2e0f2e9e007321dcf662df5d4cf4c4dcb6ee0bafd5e2acb8b2a8a512040776a35486076c628f35ecdeb669113169b12dd0a09143f05d69f3142fc39aa69d595fe7ae282436e7ee1f68f53d3c11b193d6a03516915f448063be4f4a3dc7262113c06ffe3ff6dd893576de3eee33dc91216d0c2a7d8c19395f5a2eae522639e5249c16174b81cfd8783aa0463740330fb660ed1b93fd65e7ca885f049b435fed8a3839d1aa6c5814aa2a43fb68d6f1ddbc19225ec2e409990cbbda2d74248b3e44b06d6af40812c2aaceb96882c7598113f697101e58870bb46d6d1380dd4520bfd2474063f2e4d485340d41ae4d11443ec5bff74f89c86d100c21b766646401f6fcb22c74d01769ac0ba8220a61c9a8a7162bcc5c5a05af6f64484d42c668a3e27f1fca2a640a9841ec4b4fdb853e3fd73b13cce537f96bdc5e767255ddb8efa05395ee1411247205e0b4327a387fbecf0f59eda190ac98d7e95b35e8b307f983a6b4aa3a8b189cfe20ef4003e2e5f6aa0a6d7561c94a529b15644f1e8a284cb07ea2e9188a1a9e141787677befce42b52d9fc0fd6fd1e5cc9b50b99e135c13bd383f17cf42a6ade342dd2631a40f8f0abbad5cbb5a1a66efecbb80fd9d7267c7d5106e35a0b069fb5d655cb9ee3091c37fdf5dbff133339e933a7ade983928ef0bc04909a14270568807814f28d1df6c3d959d936708b5774b72ac464ada476cce5f91c2f42f0839567460ee74895d4779d5c1d03b080dfdee879b4597125382c0a65b1795471c04bb42bd7c7287e1c1bf5acd803fdb5c78e084f6030ad893bd7471688bb652344d42a37adad3237fff347f220d9c1dae3bb582a00f2bf5beedde3df7ed15b2888e3ac8b982dc78e3af71b1637f1d37d04ea7c501450b58884b3011dad7f0fe3630517f7581883c561d510fe5d975f40db244da210e19492d296456c4f7e55df04ec2d98dca4fa733b3f34fd17613c30a6c328c1aee57c5225079b9ed5298e44fdccd2aa9b4d92e94d5d4ff8dfb4eda0fc32a0bb783f2d3552dd9972bdf8fcaab6e3ed971bb12a8ef88dc2654476e880cf8b68da3c4af155c18a60f400aec7bb3e0ba46db82382897608f2c2275cc8e3cc41384e9847ab2cd0db4e4cac9e3feb2dcb7570a62", @generic="491ad0c4b49ea1fc8971cec29bc19247b30900bdc06414619086223244144f16597c6cc0f253", @generic="6efa0ade3ed41a7bb161f4f32405c9bae4d88c01d8d39dd418ab9a51f2c522edd7870b80eb805a63cf3cdcc78ab578bc9af6a087834a30c45efdf611d15cdb95", @typed={0x8, 0x3e, 0x0, 0x0, @fd=r2}, @generic="183d8251f855a37e35daa9f7c241d2482ad9689d8a5c8fb0c12a5b7290fdd34e702dbdee1bb69ceb7f65401d4834dc26df1277be171815edee274a9187a751358983cd9a949bb0749647bff8788518266528c8f4f597ed1c6b4ed5dcbe47d43e1f17c503ca9a24526b9f9b3b4478f49ff06c71fd62c3263589992a703dd7b50b754ded12a3bbfc179c45163235a29bc608320963d965f60ff78591f31eea6da0fe8548a69425c81a8bad0332697d1f5cbbe4b90e2eb5215c5db8b4cfe87e679c1b935172312ffb3203b8417f1d23142b555d7b74c23099"]}]}, 0x23c0}, {&(0x7f0000005480)={0x5d0, 0x42, 0x1, 0x70bd25, 0x25dfdbfe, "", [@nested={0x130, 0xf, 0x0, 0x1, [@typed={0x8, 0x10, 0x0, 0x0, @uid}, @typed={0x8, 0x12, 0x0, 0x0, @ipv4=@empty}, @generic="917af8a1c358214cc3c72c4bda5977996a095af8889ddbf0ca160df78e99d1b356637f742f38ca45ef1da78974c56bfff8b09d36f8b4a5e1f330ab0a394fe518f23286a785db1f87ee474b8b4fe5585daa48ee0308ad1234b8cd00c9b8a59488b180a07cfa46f3deb4a2a6b6bc4a11db83fa445e21713d9d53623035aad0771c3b142dad0ebb0f4ce1bb3c3a756f2d402961", @typed={0x4, 0x4f}, @typed={0x13, 0x81, 0x0, 0x0, @binary="fa75708411f6badcd1c54618184200"}, @generic="1dc872c5de670787fc085e53ee20dda115cb32d32a18e4f7aee3651f1419c7d86893a75d0c1c985f90e43ae68620f89e35a897689068c395b909d7484eddf67045539675061007a956c72d7808bbe13fd1e834f82d7c6d50e38d9610562542f601f5f9b91b22e40f6ced9e647e244b87ec69"]}, @typed={0x8, 0x66, 0x0, 0x0, @uid}, @typed={0x8, 0x95, 0x0, 0x0, @u32=0x400}, @nested={0x4, 0x4f}, @nested={0xc9, 0x1, 0x0, 0x1, [@generic="453690048a300b1ec2b5150c", @typed={0xc, 0x38, 0x0, 0x0, @u64=0x1}, @typed={0x4, 0x14}, @generic="8dfedaf079e8b468c4e52d530d219341a84043d3730f3c3134821e98dbf0f8a32f2fb3c56190cfcf6f0eb1cfe42d55287779a788f406677d57d07c4e56f32cf1f8f1acec9827d558fd36a4d68b06940f3403b046cc08677063d8fc47be471992b5be7a2b8ca778b1a781e3e040ae", @generic="cbd15f1ce46a84990c2949f4d150f62f18bdbac3d0f1f42f086d2db2cab29873e3c878e097519a6045f7b64fbf7ff3ea1cbe389e1a4bb4ea575ad4"]}, @typed={0x4, 0x8d}, @typed={0x1e, 0x5c, 0x0, 0x0, @binary="2b694fc57873234e0113ee4994a371a90f7fb96e5268434950b9"}, @nested={0x1cb, 0x7b, 0x0, 0x1, [@generic="c3739823e136c14219142af836", @generic="23dd4ecd51926dbefa8751b9b379899d69165701821226078f8dc7d108e487414a1e09e5e5d49deb8be07f78e7966a692babb4ca3f5c2956c8970681445e75454eacb20c72dad58bf756f35fc71f722058c4442ecb1a9a85b2aba28bd04662c4663a2203a0fa5a432ecec06485f5bf79436b469f568c7b34647339494271befb4548c1d4ec390511bac214d6b3bdef9083d605665a044f342679c36efc73513515fcec26f7b51b11d7535323c49250ecebe59b4f6d53970d473eda0f2ad42babfb7eac310ab31ffbe7", @generic="8ff1f9d470c0a4ef07d6656495baa631f6554eb5a676d8d70290dfdd44183b8a860d0e57d2ba92554d16dc10d415369f3d87d274bf58dfc6fe517a2272f4feb038c11f23da9bb18c90f50f0b623a22ae18fafc5e27b9f5cb914c9cb43d9bd3fd610c6eb84c68e0bffaf24ec87da19e442a2a9729755018e57aa122bc9c6a5c3ae980efbf4469fa4d53c6399f8d9ea462ecc5f962994078adf3b148ee92d33ee43311893637757654372218f21e1ec76393b5a885dbd43b150e643e4b1892c961c0bc1947ef4cb03e2bbdb55368aeef05cea56adb28abac5d6391a926c02c0dd2a2ff2397011e645d89d0b263cf", @typed={0x4, 0x96}]}, @generic="f5a58bc7e0e830ca17dc68efb8cded1ca8afb39841b2981f10439316606c3fa4da1ec7963ec772374887952d04972f75a2cb47f5ec06473fa470b19e72bd1abde48a8af70a1ee6b03807", @nested={0x171, 0x4b, 0x0, 0x1, [@generic="a6bb5f5ed1dbad45fc1a0eeaa8bb5d6674a0cb562290041647b2c64c102fd6e34bc5485363f9662fab9a385b9d0d74f91c3ce43bd0c6639323564a129d93364bdfc0843426de5758db76636379f142fbbf1ab8d77b", @generic="c9bb52d455415a5c29d40ea3d29e97aef9fe1ed3318f9e7a7237ba06e21e130dbf350267f3a15823180148adaa5c0eb72440c5c3a06dda7777fd175bd163b7de1805c38ad224", @typed={0x7, 0x75, 0x0, 0x0, @str='@-\x00'}, @typed={0x8, 0x14, 0x0, 0x0, @ipv4=@dev={0xac, 0x14, 0x14, 0x10}}, @generic="38328a9ea70d9d6f44690cd9", @generic="f50f33c48364bf2853595fe980285bc1c68fb72c913c739ad6b2b7ef7881e7eee88f8609a33b299ad033ef5271c84def1ebf59c0c9fa5d2b0c1ff519770ca39b4bcfb46180935ff7537e106e5e1a8b2355099907a38524f928d51c689a99a4b67d0ff8b37cd4724b975e5730cf779c54427925ae4e1fc641efcbe76e488c6f53d8d58a1c6fbcd3475ccef6734e57065338739f3c3500544e779c8b4570e2c2d9912794244a75191b94f357713f59fc8eaff5", @typed={0x4, 0x7b}]}]}, 0x5d0}, {&(0x7f0000005a80)={0x2134, 0x25, 0x200, 0x70bd2d, 0x25dfdbfe, "", [@generic="22d4401918be3b2db4e90022d651df3784c7df921f2390451b0a5d2616e861de36fb0a9e4695059619ac7168d68d105128e0ee8fdbb6287e566702dece42074a8bdf3462d04e00ad12c3ccdd93745766f2d40640773923a8205fe5f59fd1589b73621a6d6f9f365585b6b17db91266f328f3caa77ee9ac15068d8f2eef9cff860deac4c96ad9738f26b4568941070602d26384ab536cd932eecd9c873d429f2f05a4c582a14d9cc21c8e898961c37d467ad5307413b2f18678659fb9198484cf13194c1a96cb0085ac9f8e5d11ecc4a19843915500d0c41ed5d27c52d9c292da073ace6c6e86c7b4a2a89a71e0811c4f4614dbe8e1976804d35511a64276913c59a5a22d3613a8d197a8ed16c6575067c39c4677d41ea05a41c2a836243e448190a7dfe0dbcdcdec54d22f9eebd988ceb9ad7308b6a166684ef7c5772c606035732d37d1a3bce9b80248429bdb1e29c67c40b9a7856b3987ec7880d6ce7e48e01bc73ed6690e642837a10bf12ed25cf64280ff89b2d8ab1024ef69a78decd7e957e71c1e01ddd22d3d614e55bda6c991c280849b7b21c8eb100da23f19c811a93efbfd55de42bf4bfa3cbdba469703682a62cfd1a1966614cec02ad5591624fed9d9cd83f324214fa00388f4c2b38c2754371374efb3349a1e50560b6c09a041760b8f28b3570193957227beccfe71e1f9ce7cbd3855f4104112fb72466a9e8b0b1a5b37b6d70bb65cdaa8491ae1b3c73daef31ac9c25819b459817e3d5a7b9adcdcb8db6b2b90dfb33d51582c6b0f33703c913181b1181dab4e4f4e414adda1e987d632f55fd075b039e768b3285fa9aecb55a6a7d5bbe2ac1af0c6bab3434b9bbc59d165c099ee70ed9a5727aeb6cda7fa5a5df9f954803295c721d98fb092f14d1f451eb76fc5bc95583f349e3e00c94576f7d52a5b29943f401c97c5f05470f6e355e97bcedbafddeb36b3702f037d453c748e02ebdfabdf325c8c9f3276ca44d03f71d8ebeccb803ee3e8bf094cf1a4814b6d9f3927dc30327890c239991219007d4d62425a4f75d99813720c72a4fab6e2958d8aef6131f965016c2e7685bf501d0bd517119fca9c5d35c3b119613c8f6feaa85d831cfb93c2ce9eb0c6e089c98ae5ca4704b842b6926b02fc14de6e32b8ab2f4966b22f902a1bbe45166d3fa8ffb84965bbc546c030cf5e9a24b5c470b7ca5d64a3cbc1df29de4564b94e50f88bb950a7538b9930b61d0b1b06e7e2342ef0061bdab01923bf956c2f467587db352bc7e6a8526234b2fb625e6a406456d5e68420bdbd810d849f94d3b12d001719b3bee35e71d6db1c3bc18c6d95299e68c12303bb542fb3b9b5fc514acabc1ba583f32a2280b6d1602fe89575f7c9cd83181de810db3427cbd0bfa960330ec282293fcc77892b86ef1e5a53fb1a96b47b9e164d5368f2b4f261241c4a6ea250952554d8842c1feb40fc04d458d95591f1b371e9e6d1c9a0f6735ac28af32ec082930cf7fe87a4ef56765ac505fdf3fdb83e1a6566550f4d229c0c43721f6d96e610acc2dfd8d9ee5d298ca03fe4e9fce154ac59a6cec0b8069b6ee9a63e10fc278fd514c07e740af90b920ca268426bc24d12695bac0c186e1199a5f7e39fbda05a80e6ce1802724f2ba49fa08206b95de743e492f7a2b075fdd90348f117974b35b6fad0f6a4eac1adff3e817d83a7bfef6fa18f78629d96cf7e0c272aeefb04295a1174a8ee87db676bc9f845241a159fd8735db847d8abf0e07b86c2170eec3b87e2a5a633745c690ebf72a6aa0598ac846861b6ca481eb40faec4f2fdec9ef76df2fc315328686390279a8faa17de98103383645e7c78df2f7b9f9da99402ca9f5eb5660fad88b57da6b42f74792d22cd33d42fb91d8018aff3d81efe704b1a8174b4dc2fa86095a87ee86dd6502b739a9c2410d23eefc9570225ff350707b66cbdf8716a1deeca4c874be2cd7fe7cfec5930bb1137d898bb58ed2b31cd508d9516229d629e84700dad8466155869cfa4e699fda92c8d0e70bb0ddf2b0571a64dffaad8b7d380d497fdb80d61cf62a8995ac592d6cec80712b98cd2760f610f97c22c29a818bba1ea85f40a5e1deb0a4434c18dcbae1c4797b23f80215a45dd8680c6bfecfad40d4f4abceb19ecf5715b459f27b3b814f13dc0ed73bdc4b9568fe3da3792e683df417c44ee9066adc1fb28462ce40dde65b4dbf256ab509ad2c333b43a36bfab6075a473686b2dac1fb2af3aea8eda7d475ededac2f2f7a36cef44bc00b5a93bda6cab0e6ed37a0f6268d5dda690220984b1f3ed8abe6c75804c1fc843fc133bf49eb0db7b9027bb79a0528ec2116191488cd77b79a25013f3c7ebe0d4aa67ad325ec056e129e90b6bf2fc6b31ea853b90b480cdf1fcfc68159283bf72ec065619aeb0a0f7dc0d591efff3cd6a91be6eefbd3e3bc90a885e37bc59d83a9cd0d95b14b421cf3e395d7379f26e3842162a5446e26894c7fe776bf1134cc4001bd9c0e7373445397e4188c21878697062f8ad10973bd3836422ac6b2c3b44117566142fbf3d701a7db328f81f5b3cd528b602ec68a632e9949007d26fd035b3c074492ead211670c1ef724520ebfc13e1b08bdcfb678a775768340257556d5eea448b07d18484c78aa428d550fa8748d35d4b89309e0c5a72727c55650631cff9859aac4c8398a19c0486b3d08427bf74f36a6f3d4d850f93f15ad755b99e6f9a160eef4106eff3cf72e0269b1a9af22b805d2636df545274048cdfa6d89ada4b1ae30f9deea342286f02b2b69492b1dbd0ae1cd4afd5fee3c3c6dbf86538887f88bb7708210849f1584b90ec14ea71756895b301df539c8ec6f3899b8fd1d7c6873802ca487eec30ce1b528a10f6f18d294a7cf417604aab258f886cf12f3cf03690aac9a59da2e60cbb0731bf1213d97c78cdbc91b3807b8c4aeb2549035590c9a087e1730550d49fd53c94fd9ce3d0070bfb6e2e4271b59e75f30be0d8f6e7efffd598e780776dc8c479a27e092672db814cf444424880e1340bb0888d6dcbb39fc8cd1e2e7208336da49b92eb3ead5e3a759ea22ee83c6ec7b9680abae66ad5680fe3a6b9b3bcb3a30a113f4778ece175ecc903f9e7963c6124e39bcf432e06ec0834a4b3cf61d76d61bd4d69bce3cfccd7fc28ac0fb8a8bb227bf990a6edcf6f5ef84f40fcb95d63196aba779919c81592f282c3595ce51f3671c1bf511ea8c6560ae2083da8fab8eff5cd7a5612563bb8cfbc457a5546609e12fdfdfc47a7d7fa1cecf36da4c9258356d782edabdff4cee592af26011dc815e06b5be2ec35902cef8bcfecdeee063d5a5d8b197fe41083ef753a04c74090e88958fdb7bc91ee4330b368c1b33e608e6b74503aef940097116c6be4991934f1b5e78f7e8c860a4089655ebffca9d95366ed5db523ce9f076f0007c3030f06dc75d046abb3f68de897b512efd8aeb4e8a5641d9c96f5b264776d1e101bf0b5fa607f9e31bc78e947714dcb838bbe12b21f6ae3a3a1798f1da640ff2541dd2cd268ee1c62427e7c185a95ca49143e5c8ca6a2b90599573facac7d5ed4ed1435b8d2082a11b028b75699e27593cb3d0bba500bb3ebd27bcefc355e347d4134da5fc790a7c570f665d9a672ff6dea58f91632a5aed8cdf5c4acaaf1ebd7316aa51ee88f5f02766656fdefeedba17f4caeb52acaddd14a81e8910c42275eb3d178a1cc2b3551a0b7e7dbcc6e626bd3e2921af97f4a8be1060de35a91fe13e742c7cd809bb141717f3ec93cae0f51f1552165b0c7fa69fa0454c6d23de6da4c4794fe9c6943ee7ec455807a7450dc63d84c9bd912b416b2bff2fb16d926c88e4da1bfc87e5b058b95cb4b4cf8e48bd9e06958796aa6110d3dc4dd8bb3964c64bfc9c33aacd8af5640415d3cd5b30859ae82c864532dc9c07df31aba887d06b7dcf8c496618923db0267225365301b87901f47f81a8116f32614815993c90cd02d61ef56204ee1f1be8403a1e92e9655af9697ac304d8b953ccd62015382b715a67a7410c34b9ba83d54bcfbebeda434948310d85f2979cb8bf9497fb34738869e822077ea1cfc7910d7f2741580cf586cc06e6f468148a8dc70b69711e8b8b23381a517f67c9133b90129d04effa2dc0cc51da402885c20664e235cecd5106fba6a01d10ca9e69e8a314351a129c4c95284ee5c2783c2d38f4844f6b579181cf3c0d5f3d6ca71a7a10223ae7f9bd907eedc0d3419b94a998c2ddcb7b7dd7da50dd21e3f08e83398177e4e43ea7393f53e132fb19862fc7df548b05e4499b6185f8af898aaffe0c04e658bcfcd7856b56cc49d28b4fd1f198d66df9071764c0b3d8b80c7964c3e8fdc6d85cf241655cbe3df815a3ac3ef5b81dc2b44a10e6f738181fe86c8938f09115428f7cb9c97f572322017c9c9e4f3e7ea013a5abfdab96a4d56180371daa183e1932bf54713759259d32b2ad5ee78480c0d51a993c10433cb88fe160cf23f0db61729967fd310ab4ab44ac6ce4a87f765ac1abb25300d822aaeac0305ffc277633e12388e545d1e7095cbafddf468871c3d867900dd9542f451199279247aba6a14b358214cfbaf0eb9553e61ab78b4855db4ad92821bcebb5ca8e65a2ac9d7566a8bc709ced2c67383e63972e338ecdd508b29c4c0da8a3cb099f486e1c0d375c325af20fc8f64fa630a4dc1b29fb2497c64f69506a4572c8c1b83b989b5e4d8b3d774fd4f2d749505ea6da8597c53baf93965707b1594a71a2e32ea19309cde1900f7a9671df649e652b392540dfd2c0fb075d25473ed36c881a0eda4e75b0a3d676b75466bd9b145719a196400b6043a26f4021840d782aff37a0cc6adfc4baef67f3fe8719bca78b94ca2a12e0d6fb76aab4d95798a1f5b7895627687dcb4609708605ac49192030dd67dd18abcc1e3f1597115f2df3ee77fe7ab5705407a91520649594955b063989bda2101ea7001259b10d3807d5426afd1cf94647ade55abb34f6f8fe1eb605f31427b9018fbb25760d778893dc7448f9020106e692f2ff2b5ed8d135e7899d81cb7597009176b789fc73df04f3aee3ad5be6853a1d5f8fc00cf9df5806461a6d4cd5315e2c1906ab4f2a25d0093d40ed3a04070faa1fde3adf866b928c458b3902e680f784d3d5d9aaec1c7a8eee291519352a27388fbdc29cb87c0378b5e7d7fc006314d3a9aafddb78083f75978dcbdd8a8406e3cd45f3d49cdfb2058dceab76a674889278f4f05efb369f29a50414cdbabb28335678306434307abab3724417a555e71ddeebb56e31ac411e7ab067fb01e546b4fecd8396ce7a74cb3691155d5239f124ecb3ae5c84d8c14ddaf7aa48d1a2fb7019998a46e217ecb319fed7e1c578cc926f911d0e35df2b98f9864653005f3f4560debe5b53497f9d392f36d8488988aa7b6a8f29282cf07b0922b51413114da1dcac499ecc2ecff098f2c9c80361dd9ff8aa58e82eb6bb1dd0c4700ff972b6c4d4c577483c568d083790d80b7d82c4e4a2c26a76dd3f0f6d85e4c3971ef3b853b72ec7e963e26c10bf93052033205ebefedf2722f6fdeecc4a7e1370875eb0900120eac2de5f518fc44e6841754fcfb677539d0b85e61a33b870fd4d19a0327a32887f86d0caab3d9ec03d3a0e8a9de92e5dc555bb6313d742cd711e561b168af4459319d4ef37657584520e3b1d559a675e1da51adbe29fca7e41d1c8220eac0454b7ace39e8578c96fb1c45bc279f6e6c45e639e7ab9e26aa354ff5a333402abe01712ba7ee84bd9d6ee136bac1b4d748675c", @typed={0xc, 0x6e, 0x0, 0x0, @str='.\xd8!*\x84+-\x00'}, @generic="b0fb2faa3df5fe12cc56113c3d8a7b90af261ea4ad2fec0c03301412092d9125425c7e3ce2143480326890b07b0393e1f853f1b411b3bb878d60b046cfeebb57d4dae3ecedc10f24f0434d6a7caf8b1e58ac9a6bc7004f8ae588ec0a1887c5874e9ef84a223236718726fbee173e3de012516401c235ba34b499966a3e9725425b32da6f0ea7dd1bedbc9cf2ac971817afeb025e2211b121454def34161ec9241f112d06b22aa84dce1706e65e4e85640c48790f4a3a2e382b83a7cde3d7c8f73f5c06f273882a409356d54aebafa55314102ee615e48bf0b9d62fc41c1f008b2611a1b081", @typed={0x1b, 0x14, 0x0, 0x0, @binary="de56e0843fd9efb62fe4ecbb20a2f91d1e75e8d5f6eb37"}, @nested={0x10, 0x0, 0x0, 0x1, [@typed={0xc, 0x53, 0x0, 0x0, @u64=0x6}]}, @nested={0x1004, 0x92, 0x0, 0x1, [@generic="fbbb02bc35a7bc161eb54dfe75a88697f0dce24f25d830d365887a70ad7ad5cd4f956b7c46b68aa5f9f1df4ac6b75a6802fa8acf60f1d699cb1ff19005266860844828882d78654ec3507f5973e1f6c092c6bc41ca2b2d4b1fcce23e17bb08b2647e29b40d0421b0fe110a4ff7a7394292d5b92d72c51f878767d66b8909f10a9e15bb2fe8898baf710108b747d8eb056faba183c071d6d242e248ce3e5b7e0783ac5cd11156bbc4558817b2337f66112f75e500d0d5e4cc87828bd38202cbf16f2310c5d2e34e5c5d2ad1aebe28307c4d2a0131784841688a635b21bda2895d1b16622c2187fdd995f6b2a6c8407589f95e57d82851235c4d9b66840b7859e6293da84417803ccbe4cf197c4f6f84f22a29c275fe512c9859858bba6ab5e9ac5052d91334d6d4607ea27d79827ad1e70a8d1fe70cf6dca94aa620cc57c9e86f7b0b281cf4a24e54d5ad332610388ff811004cbc6a26cc5602d5043be00142a60662b577999e0611370d8ef16307fe561de02db4d366b0bb1cc5125adadc30264caa5c7eb5c16418d1a99a0cdd1130ecf8b653f910fbdaf0b03436c3ecfc72816fad43c7c51ca3b042518a25ea2c181af92f4475e8c042be227799c9d379cc55464593ae25f0e712d23aad33215019d1d7cd71952ade2cc86ca76500e6eaabd84a3002c929b8a4475afdec866250f95ea807c5087f36972cbfaadb3d968216a44e157d57644e62c40ccf70a926004198d8d28d6ba8b3981a22c45359553f25b3d717e5e317f86f4a0d415a81a5a226cabf88d02dd1e3aec9a0f9c3d06a4fd5c15cacfbaf5690fb11b3d40984505d9fab78fb99de46a48c617b0421ca2a981a8ab413bc8164263cea0c4fd37ae366983283e9b1da50ca726b9ab27e3b6c38d54eeb885d746a5e0ca9acfb10d81134453221d77abc708b5a2f37c339a0334571b535213e817176499e41308daaa4e3bc04482cef0df2f367c37d248fa2e1f2df7d9823e452790a7140cf2dc790700dbb5f2bff72067444776e7aa9a5373d125ab8e793fd5a1eb68e9dc9745facd9d2ef1b84ebb3c23b008ae62aa2cb2be1e1587d0b05d9d65e3bfaedb5d65d0fbcfd94451933154e2d481bea4798a3f2abf2f1b0bce8975f4ff60ff544f472118286bc72ded8485d2b5960f9ae696318232e0042e022b4f2b4cebd43c0529f8c10dfd9ce1fb48523007aed49ac1a5915fda944c9e8203fb15f8270703095807139af8a45b47689bbd391be9670970a3e2fcd13e9855dfce6b1242af00d182c01b53e1fdfdc0b6f696a47075650ccc867a1faa3c13d49f36e5fbfe030dc6aea4ad8c33e83b581dea9a83ecd4b74456c6eace68ac367fda488acf8049fd00b16f2a9e049fc5ec6d8b8b82ac58d05e287a16da0340709887e28c8d85d491815b682486eff536e3b8c0d55f8a63fd200384ca84b535ec9c7b279dedfb1cc38b4c8b657fafb52ad4f7ac297a0fa1c644e9f30888952da8bade23a3f155bee24f4ccc542c5c4c97d2d7dc13e7cbf7b9ca9f459fb2e5f06a3e0a27215d0a0bbf69aefc6691c8ca849a62a34284cfb7cee9b90360f278427e49d0ce972633ff9191dc47f153e421c9b758ce864f79d933484eed6b05f63615c995aa1b342dbccd7ca19afe05697d271568acdca5fedcbead1e896508bff7c8cd7bac6fa6658bb2a5a5118c541a51cbcd7283913eb205c34fe3415e2f34df296720342cfe428d99b48bf4fd545190eac18d8f5521e639f524e47832b7e2e3485bb3a4316c4d3728915ba99d5b3d255df8344efb42308940d52b5e9c8ba233575adbcfe839f97e76f60abdc2f65509c8bb8d5a56c46a32ef1c756a9a83777947591a2f4cc08e0ca4a2bdf103e43e87edafeb3567fb783d697c92b09d89d7dab5d7b889c77cc1a88f0fc56cd2beb49e4f257a2de72a0b6cb5ec2c5d1a7c19998ae237d88702239b0534bab4d33a36d9d5bfaeb39328d4d8692bd0f6f7207eefe0532d5dcde74ece287a795705d6cd2413aa4f685fa143b8a363be33cdee09878f426483e9c87a3ae1e8a5ef976295a1f3112fbba41e7b005d5836f4ec2090a8e3dfc8887bb845c50f1b56f6ec46c380269202ed7d38e7b9871a586ee1de82e9e6ba9ff89197c0f71b77e4ffdc14b5e0b3ff424a58a1e1b243f517d5c937974109fd2f2a4ae9453e4fef79c8eac063dd9b75356643c50eb0b2cdbce57c2b929b7993040819d71e5733a07ba0089f233d55a4d495a1e9196e6acd1cd4cb0734bf20658267c2fdd009ceb4d4c7377d8f1ece6e988dd951d0bec882849ff187f4912aba5d080bd236cef8026781dcca31446e829e515296a3f9dfff37c33d6867ef84b3d352a4f8e7b727a5e82523536d06c2c83f413589ef0898b7c00919ebc737522dd170c559bd0322426014c596b89e21e1f5a708a9804914aaec06d20fa503fbc3dfc6e1e80e1c9229903848d0526a503c9e4ec7e581791d4e08c20cd27ce949bc4c1e219af5a52638a556744b5bba0f4f677c9e90748f942a015a089c1c8ebe2fabb1e0be3d9467e906a429e399530e7c70c0690cff188e3330c7f81faf9d44cbb952549652a8653ec2ba49cdbc8d6cf712593a0001038c2828ae67fb827b8909490601ff2041ffb676ba20083c82a764b48da9f37710eeea137142e9b0d6699a3e80c7d2c057b4c33047865681bd5cb814a3dc660525eb7d6cf2154433889d88a1db11d09348ac9df03ba77bf0458f7ff93b5e1d264123ba6675aefb3e22ee7b41f6bdf7226e086e2492c7ce8a065ccc5bb89ac0c662ef5eaf7a90ef30337059ca8ca93c34958dcf5fcf4118e98ab39a7772efb6c0773863209768c7b042bd8d8a6c3616b3a9f386a51e98c9f690939924abcf75539908d47c73448dd2db0c63d3414518cb56683a0998bc9e4e0f9fedeb5fc06bbe9afc9eddf2d4ca9c7d32c704ec78aec20e33d52a1d1ebb9fd63f47a9269b3c4fe9b2cdadb498ccb7a3380cffb3e10b072c8b712804c31dec367adb53a1b7e3a16437078c4fe1c749467fd68eff66ff21c70058b2fe41b6b74c4b9ef08255d683832571b8bc7328e20b5050c02e7aeacd48c6571d75913881992d722e53b43b3efe05c962bb42dc3b20ab11d7bc292e26e50608819df33e09fc9187092b589eb5faf09cfe162abc6fa4c0a9c4679ad19fce6546e08c44c223aeb60eab1d134d361484c5928d37a8f87e3e86ed2c6bd77de82d109843ead5de830aeccecfe6151f4c61b39fcefa500158ce7509e9f58c7885eb68f94209fd2c04ccf20adbfac551eff15440eba851a239c36fa4cd37de7850c48cd726c32724ecb9c115dcd20a27df5c3c9726ff8ba4e9827b65cac190e176225824220fe476b6f29f798e54658aab568ccb3090ef9c9a66169d345ff578095d3dbbb6238b2a47b2f096f7fc6607affa3120ab1df1540c07f4f15518a87ef8c1e83bf28a3fa65ef272a9fa3e8bfe5970ff05756113a41a9276782052e47d2eb48c7392c38f6ed2855f9f81afa03f05df1979d487a4046386d007c0fe18e66abe30e4747cbc69cc6cd55da0ddaff77b3bd248f5c0785ac12757e9ccfda695d2a275013a0927ee87ee37c24b499228a1a28396473f2908bd0e4ce38cb7188327aa9656579d84665e151a2da4aacbef57d49ae38a313a20ac5e877eb4183f5aefaf412381f481dc65d44ae294840845b0c3e5243fee8369e27a442d4be385b41b66015b3ff0e62c4872b71725302539fa5aaecb68bfd2cf732ac5e0be972fbbf2e5601587ceeeef3c7841665da01e9064a82b308080bff85d1ec7ed1f96ce643b85245e3f66bdc78353b12b8c81689231b67f9cc4cf31e2ee6bf2269af545a889caa8f3d8935d4a1ee5e6183013f448b43640cc655a0cc5eea9144f0670d1673f6e8217cb9b4ef0400287525da781ac0bdc76ed57ad6eb7ca1d2d03c89baae8cdc24957da3e5201783355bbae082ca49b9c1530441634589999b5e3fb6970772eaa3421997549159a3407683c1b6d0373b4a8bc81140d392707e981c8763a9a54aeb517285c64e8e6bb09a482014e43efa541de5b2aecf01afcc1774e6bf1f062d15c391f05cd1674df49041360f2d225df05c0558ff24eeabd7ca11ca1b8ab256343e0d555dbd79c7525a1eb83f90fbd57264bcde97128b2ac2d1eae2c187f54f18f5203b7b5aca22e2494bf19ce9db0782c4b4dcb1b975a0eb98bed2d72eec499ea919ca935f8d58dd5708af08fe10f1695d994b82ff7b035732a78259c0d95f1e1f6efe0744478df400c4b6c887151708f3d35bcef4b0844f3dc7b06167a6df40869679753bdba3cc727425499f469bcd7cec8ede26ca3febb860e82855b59281fa7f3c38516dde93937939b987656482408a94d79bc9c7a3bd8665501d7c1a4991d294d8dc9960c558a5f687db5c636e7bae7a0a726004e94d692389720f664a67be7831964de42bf0cb0d08493a2f677a368380e7a14b1c2c5cb3be41a8ccc355d6dd9f6505404eb114be891008fb046de121f86783623e3e9ba1aeed8bf0e7aa8304fb5d6fcfd8eb192a671c9334a15cf4087119816e65b607844ddea03b1c35c4c33e7540a0115eecc02576d39636543417f78b923ab7e9417aabc82c66f3c1da873976c7ff19bd0ca96b600b5c1226287afe8d15340bc5fa309d0c40675dece93e374729eb960705de3a84830dd80cd38a97a4219ac53522c880d13bf02b0a052163801529a06eb9a02cb399199e47501f08973cff2383fb864f2d7e4e86fef93e83dc9bf23cc997fe7f11db44881e0ca880547e6b3102e15fa513b881f9eb1f939b22f6955fa32debeed32cd1b94ea921bdba30e9426ba662157b34dd7180118b14da8ae2c29fee1384f57df2578c6717b031d583d86a3978672f5af44d77f2a76f87d333fc875eb086ece8df0ecd5d32d4fc0d3be64dd1d84a6e4aa9f7334d50d9d86776ffa6ec17b1703b9098218ec3e72d20176b2329074ad7cc08d443aa92d47052e595d5a1810aa69d9ecaaf9f7199c4a089d003a0ce3061af24523262a3d4c8aff87d57b6961a7813c22c11c89af7ade7158354dadd0c26ce21b7f2d766ea25fcfff2cee42ac690c2a44ec5558820de836c5b48f112610612b7390d46576450243000e83ac30e65458641595ac8333360ea2f047af96526f01bcb1f9782e45bf74adda5272affebaf85fde57afdba6561e14dc08b5541a465adcb398be2722b99c37dbca460ea7ae0b71efb14e826dea22e9f48053e30010fc6842a213ff44a929bdc7e60c054c393c96ffbf2fd19d08bbc8065abe72296523247cc458ec922e1392bb25ada22849db1232eb6ce377b2483a25b59ab595a3cffe66fff2d28ed6d6fc97fe2b31753d3d175b665a3fa57d291233177506f969785494eb49bce09947874ea2e07eac4965180463bd3bc563714af85db0474bab430f8f0d50710374ef9736f14ff53e0bd0475ec09cef27c60b3e9334890f3f2f6b666284c8ffee7de9d2a68f15d726d6325de618744e57a8430f5fa18d7cf4fcca2722b97910f5c1ef7f235e2b47ee833c9289ea92f2606f6bd7fff6da7fc3adcdb900306de7ecf8e02500760b808dbbd03f51c599479ae2abd477843f38d68c866b5183a97c5c2d0dff8374685500b4598e590d3a19372b5c39dbdde05d40c458cb48f8f8d1f1066eb60ae5199bb4f680c81f1ee0349fa0b24a4d215705657620e3134bacaa8c25de623906edea0d64c948c4d86af5ffe7146d903f849e272472049675dd42acd8bce1981e1fe3c5775a652a6818898db447b"]}]}, 0x2134}, {&(0x7f0000007bc0)={0x27c, 0x16, 0x200, 0x70bd29, 0x25dfdbfd, "", [@typed={0x8, 0x41, 0x0, 0x0, @fd=r2}, @generic="c1650599e6539f70afa1ca3621bf2291b55740055c0d94720288ac903350e311f9b43ac58e3ff672a24bcc12efdb4c09ebbb000594542206e88b642a3438bfdf2aa0e58c27bd023cea4a4119c1bf1b92f7103b74bde59edf2aa5823b5259d3ef0abf0fe06dcb25acffe37331acab402710b87d12b8fc8abc9368c4e8ddf1839143712f8d49f380f1b4abec03933d20fd34", @nested={0x1ce, 0x25, 0x0, 0x1, [@generic="ffea360e810a461de1a94bf1fd2f28cf9fdfb09dd1bead8c7af9f1994dc43ac34c0d763bb71c3b6477a4b68a0c33c4690495", @generic="7298354bab7915702d2020e5fe12e691bd3b9cce90d1a76f921447f6e7b1b031bb51b3dcaaa2a01939ff508eb2abf25d47adc4793511d6842601db24eace16db1019a168efe818e599cfd221e5567312fc9314c1b345a8218764b005ee04140aea8941d5c68df0e61260cc66cf98507fd7c4cff710b4d6ef1cd4f41d272f754552ed748b0f9b9f66523b9f8b2e224071599880593869cfd425be5a0ba12575613557a1efcaea1d9f35c627af94df0a4fae62ac39bef2483c93d66ce417", @typed={0x8, 0x42, 0x0, 0x0, @uid=0xee01}, @generic="f2509fa04c1059a00501243cc068b39dc49945dee2a37a2ae93476ae1faa24498262914e", @generic="b4360aa24098585202f046acc884870ba1ebbb855e2553fd9b0aae619b7f46b69db9424290773d602118c678064591eeb8cb0001f3e7cc34463d7e420112db1be8791c31493301facc3bc4a581ee47c1e0f00608ff177c6074698192a239443463de2b5c49475653e4f8e093a8c1e6807c63bd23f125b6395166909e47760715460d8389c0a486b72a98a056a20e3c72aa607bd1282bafb9f0da4bebd3c82a804b4030885d5fadc0d897b25ef48ded"]}]}, 0x27c}], 0xa, &(0x7f0000007f00)=[@rights={{0x1c, 0x1, 0x1, [r3, r1, 0xffffffffffffffff]}}, @rights={{0x30, 0x1, 0x1, [r0, 0xffffffffffffffff, 0xffffffffffffffff, r0, r1, 0xffffffffffffffff, 0xffffffffffffffff, r4]}}], 0x50}, 0x40000) close(0xffffffffffffffff) 07:15:07 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\x00\x00\x00', 0xfffffffffffffffe) 07:15:07 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x100, 0x0}) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x28000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_config_ext={0x5, 0x8}, 0x4000, 0x0, 0x9, 0x7, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000001440)) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r1, 0xd000943e, 0x0) clone(0x40808000, 0x0, 0x0, 0x0, 0x0) r2 = gettid() tkill(r2, 0x1e) r3 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r3, 0x0) ptrace$cont(0x18, 0x0, 0x0, 0x1) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ptrace$cont(0x7, 0x0, 0x0, 0x10001) openat$full(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x2, 0x80, 0x4, 0x4, 0xe0, 0xb, 0x0, 0x0, 0x8000, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x8004, 0x2, @perf_bp={0x0}, 0x4000, 0x8000, 0xfffffff9, 0x7, 0x80000001, 0x8, 0x0, 0x0, 0xa, 0x0, 0x100000000}, r2, 0x8, 0xffffffffffffffff, 0x6ee4ca8bd5713173) 07:15:07 executing program 3: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000, 0x0, 0x0, 0x1700}]) 07:15:07 executing program 1: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000180)='./file1\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="20000000360000001900000060008f000ff68f0100000fff0000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}], 0x0, &(0x7f0000000140)={[{@jqfmt_vfsv0}]}) 07:15:07 executing program 4: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16002, 0x31000}]) [ 977.032911][ T8634] loop3: detected capacity change from 0 to 16 [ 977.045527][ C0] sd 0:0:1:0: [sg0] tag#5638 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 977.050782][ T8642] loop1: detected capacity change from 0 to 4 [ 977.055896][ C0] sd 0:0:1:0: [sg0] tag#5638 CDB: opcode=0xe5 (vendor) [ 977.068772][ C0] sd 0:0:1:0: [sg0] tag#5638 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 977.073802][ T8642] EXT4-fs (loop1): Quota format mount options ignored when QUOTA feature is enabled [ 977.078329][ C0] sd 0:0:1:0: [sg0] tag#5638 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 977.087756][ T8642] EXT4-fs (loop1): unsupported descriptor size 0 [ 977.097201][ C0] sd 0:0:1:0: [sg0] tag#5638 CDB[20]: ba 07:15:07 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\x00\x00\x00', 0xfffffffffffffffe) [ 977.128459][ T8657] loop4: detected capacity change from 0 to 16 07:15:07 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\x00\x00\x00', 0xfffffffffffffffe) 07:15:07 executing program 3: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000, 0x0, 0x0, 0x1800}]) [ 977.204327][ T8642] loop1: detected capacity change from 0 to 4 07:15:07 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x100, 0x0}) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x28000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_config_ext={0x5, 0x8}, 0x4000, 0x0, 0x9, 0x7, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000001440)) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r1, 0xd000943e, 0x0) clone(0x40808000, 0x0, 0x0, 0x0, 0x0) r2 = gettid() tkill(r2, 0x1e) r3 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r3, 0x0) ptrace$cont(0x18, 0x0, 0x0, 0x1) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ptrace$cont(0x7, 0x0, 0x0, 0x10001) openat$full(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x2, 0x80, 0x4, 0x4, 0xe0, 0xb, 0x0, 0x0, 0x8000, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x8004, 0x2, @perf_bp={0x0}, 0x4000, 0x8000, 0xfffffff9, 0x7, 0x80000001, 0x8, 0x0, 0x0, 0xa, 0x0, 0x100000000}, r2, 0x8, 0xffffffffffffffff, 0x6ee4ca8bd5713173) 07:15:07 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\x00\x00\x00', 0xfffffffffffffffe) [ 977.247540][ T8642] EXT4-fs (loop1): Quota format mount options ignored when QUOTA feature is enabled [ 977.256952][ T8642] EXT4-fs (loop1): unsupported descriptor size 0 07:15:07 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\x00\x00\x00', 0xfffffffffffffffe) [ 977.302097][ C1] sd 0:0:1:0: [sg0] tag#5655 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 977.312502][ C1] sd 0:0:1:0: [sg0] tag#5655 CDB: opcode=0xe5 (vendor) [ 977.319350][ C1] sd 0:0:1:0: [sg0] tag#5655 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 977.325265][ T8690] loop3: detected capacity change from 0 to 16 [ 977.328920][ C1] sd 0:0:1:0: [sg0] tag#5655 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 977.344600][ C1] sd 0:0:1:0: [sg0] tag#5655 CDB[20]: ba 07:15:08 executing program 0: syz_mount_image$vfat(&(0x7f00000002c0), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f736617e43c00088020000200000004f8000020004000000000000000000001", 0x25}, {0x0, 0x0, 0x200000000011000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6900) ftruncate(r0, 0x800) lseek(r0, 0x1200, 0x0) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, r1, 0x0, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @private2}, 0x1c) sendfile(r0, r1, 0x0, 0x108d1521) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_open_dev$evdev(&(0x7f0000000080), 0x8, 0x44a100) ioctl$EXT4_IOC_GROUP_EXTEND(r3, 0x40086607, &(0x7f0000000140)=0x8) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_FEATURES_SET(r2, 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHGPRL(0xffffffffffffffff, 0x89f7, &(0x7f00000001c0)={'ip6tnl0\x00', 0x0}) sendmsg$ETHTOOL_MSG_LINKINFO_GET(0xffffffffffffffff, 0x0, 0x0) sendfile(r0, r1, 0x0, 0x8400fffffffa) close(0xffffffffffffffff) 07:15:08 executing program 1: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000180)='./file1\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="20000000360000001900000060008f000ff68f010000feff0000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}], 0x0, &(0x7f0000000140)={[{@jqfmt_vfsv0}]}) 07:15:08 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x100, 0x0}) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x28000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_config_ext={0x5, 0x8}, 0x4000, 0x0, 0x9, 0x7, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000001440)) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r1, 0xd000943e, 0x0) clone(0x40808000, 0x0, 0x0, 0x0, 0x0) r2 = gettid() tkill(r2, 0x1e) r3 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r3, 0x0) ptrace$cont(0x18, 0x0, 0x0, 0x1) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ptrace$cont(0x7, 0x0, 0x0, 0x10001) openat$full(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x2, 0x80, 0x4, 0x4, 0xe0, 0xb, 0x0, 0x0, 0x8000, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x8004, 0x2, @perf_bp={0x0}, 0x4000, 0x8000, 0xfffffff9, 0x7, 0x80000001, 0x8, 0x0, 0x0, 0xa, 0x0, 0x100000000}, r2, 0x8, 0xffffffffffffffff, 0x6ee4ca8bd5713173) 07:15:08 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\x00\x00\x00', 0xfffffffffffffffe) 07:15:08 executing program 4: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16002, 0x80000}]) 07:15:08 executing program 3: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000, 0x0, 0x0, 0x1900}]) [ 978.077208][ T8725] loop1: detected capacity change from 0 to 4 [ 978.097593][ T8731] loop3: detected capacity change from 0 to 16 [ 978.103980][ T8725] EXT4-fs (loop1): Quota format mount options ignored when QUOTA feature is enabled [ 978.105369][ C0] sd 0:0:1:0: [sg0] tag#5673 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 978.113605][ T8725] EXT4-fs (loop1): unsupported descriptor size 0 [ 978.123785][ C0] sd 0:0:1:0: [sg0] tag#5673 CDB: opcode=0xe5 (vendor) [ 978.123805][ C0] sd 0:0:1:0: [sg0] tag#5673 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 978.143710][ T8731] handle_bad_sector: 7 callbacks suppressed [ 978.143721][ T8731] attempt to access beyond end of device [ 978.143721][ T8731] loop3: rw=34817, want=184, limit=16 [ 978.146496][ C0] sd 0:0:1:0: [sg0] tag#5673 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d 07:15:08 executing program 1: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000180)='./file1\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="20000000360000001900000060008f000ff68f01000000000200000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}], 0x0, &(0x7f0000000140)={[{@jqfmt_vfsv0}]}) [ 978.172941][ C0] sd 0:0:1:0: [sg0] tag#5673 CDB[20]: ba [ 978.194292][ T8746] loop4: detected capacity change from 0 to 16 07:15:08 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\x00\x00\x00', 0xfffffffffffffffe) 07:15:08 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\x00\x00\x00', 0xfffffffffffffffe) 07:15:08 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\x00\x00\x00', 0xfffffffffffffffe) 07:15:08 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x100, 0x0}) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x28000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_config_ext={0x5, 0x8}, 0x4000, 0x0, 0x9, 0x7, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000001440)) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r1, 0xd000943e, 0x0) clone(0x40808000, 0x0, 0x0, 0x0, 0x0) r2 = gettid() tkill(r2, 0x1e) r3 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r3, 0x0) ptrace$cont(0x18, 0x0, 0x0, 0x1) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ptrace$cont(0x7, 0x0, 0x0, 0x10001) openat$full(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x2, 0x80, 0x4, 0x4, 0xe0, 0xb, 0x0, 0x0, 0x8000, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x8004, 0x2, @perf_bp={0x0}, 0x4000, 0x8000, 0xfffffff9, 0x7, 0x80000001, 0x8, 0x0, 0x0, 0xa, 0x0, 0x100000000}, r2, 0x8, 0xffffffffffffffff, 0x6ee4ca8bd5713173) [ 978.389524][ T8781] loop1: detected capacity change from 0 to 4 [ 978.396183][ C1] sd 0:0:1:0: [sg0] tag#5675 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 978.401076][ T8781] EXT4-fs (loop1): Quota format mount options ignored when QUOTA feature is enabled [ 978.406563][ C1] sd 0:0:1:0: [sg0] tag#5675 CDB: opcode=0xe5 (vendor) [ 978.422825][ C1] sd 0:0:1:0: [sg0] tag#5675 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c 07:15:08 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\x00\x00\x00', 0xfffffffffffffffe) [ 978.432382][ C1] sd 0:0:1:0: [sg0] tag#5675 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 978.436727][ T8781] EXT4-fs (loop1): Can't read superblock on 2nd try [ 978.441951][ C1] sd 0:0:1:0: [sg0] tag#5675 CDB[20]: ba [ 978.515389][ T8781] loop1: detected capacity change from 0 to 4 [ 978.530445][ T8781] EXT4-fs (loop1): Quota format mount options ignored when QUOTA feature is enabled [ 978.540982][ T8781] EXT4-fs (loop1): Can't read superblock on 2nd try 07:15:09 executing program 3: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000, 0x0, 0x0, 0x1a00}]) 07:15:09 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\x00\x00\x00', 0xfffffffffffffffe) 07:15:09 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x100, 0x0}) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x28000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_config_ext={0x5, 0x8}, 0x4000, 0x0, 0x9, 0x7, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000001440)) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r1, 0xd000943e, 0x0) clone(0x40808000, 0x0, 0x0, 0x0, 0x0) r2 = gettid() tkill(r2, 0x1e) r3 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r3, 0x0) ptrace$cont(0x18, 0x0, 0x0, 0x1) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ptrace$cont(0x7, 0x0, 0x0, 0x10001) openat$full(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x2, 0x80, 0x4, 0x4, 0xe0, 0xb, 0x0, 0x0, 0x8000, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x8004, 0x2, @perf_bp={0x0}, 0x4000, 0x8000, 0xfffffff9, 0x7, 0x80000001, 0x8, 0x0, 0x0, 0xa, 0x0, 0x100000000}, r2, 0x8, 0xffffffffffffffff, 0x6ee4ca8bd5713173) 07:15:09 executing program 1: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000180)='./file1\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="20000000360000001900000060008f000ff68f01000000000400000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}], 0x0, &(0x7f0000000140)={[{@jqfmt_vfsv0}]}) 07:15:09 executing program 4: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16002, 0x100300}]) 07:15:09 executing program 0: syz_mount_image$vfat(&(0x7f00000002c0), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f736617e43c00088020000200000004f8000020004000000000000000000001", 0x25}, {0x0, 0x0, 0x200000000011000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6900) ftruncate(r0, 0x8000000007fd) lseek(r0, 0x1200, 0x0) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, r1, 0x0, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @private2}, 0x1c) sendfile(r0, r1, 0x0, 0x108d1521) r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_FEATURES_SET(r2, 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHGPRL(0xffffffffffffffff, 0x89f7, &(0x7f00000001c0)={'ip6tnl0\x00', 0x0}) sendmsg$ETHTOOL_MSG_LINKINFO_GET(0xffffffffffffffff, 0x0, 0x0) sendfile(r0, r1, 0x0, 0x8400fffffffa) close(0xffffffffffffffff) [ 979.141212][ T8812] loop4: detected capacity change from 0 to 16 [ 979.161331][ T8818] loop3: detected capacity change from 0 to 16 [ 979.167944][ C0] sd 0:0:1:0: [sg0] tag#5661 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 979.174332][ T8823] loop1: detected capacity change from 0 to 4 [ 979.178387][ C0] sd 0:0:1:0: [sg0] tag#5661 CDB: opcode=0xe5 (vendor) 07:15:09 executing program 0: syz_mount_image$vfat(&(0x7f00000002c0), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000300)="601c6d6b646f736617e43c00088020000200000004f8000020004000000000000000000001a8d14a33d17279151d2245f7649640180b8b2a926bd3c94bd41ce6dfd1eb32baa739f091b08c5069db046f23bc4df7e7a000c2d4ff7e5fc553f6e050fa360bddd9d7133032cad520294c05ad92fb24ed2d077d20ce009581f60f0abbb7e3728506ddbaa1c28d66be3b5cd67b45c6b54650db3bfd54cb1610526392558b2205f7fcf97d080274a62ae66b65c2a42f2c", 0xb4, 0x1}, {0x0, 0x0, 0x200000000011000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6900) ftruncate(r0, 0x800) lseek(r0, 0x1200, 0x0) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) pipe(&(0x7f0000000080)={0xffffffffffffffff}) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x2000000, 0x4000010, r2, 0xce31d000) sendfile(0xffffffffffffffff, r1, 0x0, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @private2}, 0x1c) sendfile(r0, r1, 0x0, 0x108d1521) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_FEATURES_SET(r3, 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHGPRL(0xffffffffffffffff, 0x89f7, &(0x7f00000001c0)={'ip6tnl0\x00', 0x0}) sendmsg$ETHTOOL_MSG_LINKINFO_GET(0xffffffffffffffff, 0x0, 0x0) sendfile(r0, r1, 0x0, 0x8400fffffffa) close(0xffffffffffffffff) 07:15:09 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\x00\x00\x00', 0xfffffffffffffffe) [ 979.191320][ C0] sd 0:0:1:0: [sg0] tag#5661 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 979.200891][ C0] sd 0:0:1:0: [sg0] tag#5661 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 979.210447][ C0] sd 0:0:1:0: [sg0] tag#5661 CDB[20]: ba [ 979.219406][ T8823] EXT4-fs (loop1): Quota format mount options ignored when QUOTA feature is enabled [ 979.228934][ T8823] EXT4-fs (loop1): bad block size 16384 [ 979.267191][ T8818] attempt to access beyond end of device [ 979.267191][ T8818] loop3: rw=34817, want=184, limit=16 [ 979.292372][ T8823] loop1: detected capacity change from 0 to 4 07:15:09 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\x00\x00\x00', 0xfffffffffffffffe) 07:15:09 executing program 1: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000180)='./file1\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="20000000360000001900000060008f000ff68f01000000000800000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}], 0x0, &(0x7f0000000140)={[{@jqfmt_vfsv0}]}) [ 979.309412][ T8823] EXT4-fs (loop1): Quota format mount options ignored when QUOTA feature is enabled [ 979.318837][ T8823] EXT4-fs (loop1): bad block size 16384 07:15:09 executing program 3: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000, 0x0, 0x0, 0x1b00}]) 07:15:09 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\x00\x00\x00', 0xfffffffffffffffe) [ 979.371601][ T8858] loop1: detected capacity change from 0 to 4 [ 979.384036][ T8858] EXT4-fs (loop1): Invalid log block size: 8 [ 979.439491][ T8858] loop1: detected capacity change from 0 to 4 [ 979.466595][ T8858] EXT4-fs (loop1): Invalid log block size: 8 07:15:09 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00w~\x9f', 0xfffffffffffffffe) [ 979.489164][ T8879] loop3: detected capacity change from 0 to 16 07:15:09 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x100, 0x0}) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x28000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_config_ext={0x5, 0x8}, 0x4000, 0x0, 0x9, 0x7, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000001440)) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r1, 0xd000943e, 0x0) clone(0x40808000, 0x0, 0x0, 0x0, 0x0) r2 = gettid() tkill(r2, 0x1e) r3 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r3, 0x0) ptrace$cont(0x18, 0x0, 0x0, 0x1) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ptrace$cont(0x7, 0x0, 0x0, 0x10001) openat$full(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x2, 0x80, 0x4, 0x4, 0xe0, 0xb, 0x0, 0x0, 0x8000, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x8004, 0x2, @perf_bp={0x0}, 0x4000, 0x8000, 0xfffffff9, 0x7, 0x80000001, 0x8, 0x0, 0x0, 0xa, 0x0, 0x100000000}, r2, 0x8, 0xffffffffffffffff, 0x6ee4ca8bd5713173) 07:15:09 executing program 1: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000180)='./file1\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="20000000360000001900000060008f000ff68f01000040000800000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}], 0x0, &(0x7f0000000140)={[{@jqfmt_vfsv0}]}) [ 979.543728][ T8879] attempt to access beyond end of device [ 979.543728][ T8879] loop3: rw=34817, want=184, limit=16 07:15:09 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\x00\x00\xff', 0xfffffffffffffffe) [ 979.621866][ T8895] loop1: detected capacity change from 0 to 4 [ 979.628226][ C0] sd 0:0:1:0: [sg0] tag#5670 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 979.638573][ C0] sd 0:0:1:0: [sg0] tag#5670 CDB: opcode=0xe5 (vendor) [ 979.645434][ C0] sd 0:0:1:0: [sg0] tag#5670 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 979.655017][ C0] sd 0:0:1:0: [sg0] tag#5670 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 979.664577][ C0] sd 0:0:1:0: [sg0] tag#5670 CDB[20]: ba 07:15:09 executing program 4: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16002, 0x104000}]) 07:15:09 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x02\x00\x00\x00', 0xfffffffffffffffe) [ 979.727738][ T8895] EXT4-fs (loop1): Invalid log block size: 8 [ 979.763601][ T8895] loop1: detected capacity change from 0 to 4 [ 979.784080][ T8895] EXT4-fs (loop1): Invalid log block size: 8 [ 979.833720][ T8923] loop4: detected capacity change from 0 to 16 07:15:10 executing program 0: syz_mount_image$vfat(&(0x7f00000002c0), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f736617e43c00088020000200000004f8000020004000000000000000000001", 0x25}, {0x0, 0x0, 0x200000000011000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6900) ftruncate(r0, 0x800) lseek(r0, 0x1200, 0x0) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, r1, 0x0, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @private2}, 0x1c) sendfile(r0, r1, 0x0, 0x108d1521) r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_FEATURES_SET(r2, 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHGPRL(0xffffffffffffffff, 0x89f7, &(0x7f00000001c0)={'ip6tnl0\x00', 0x0}) sendmsg$ETHTOOL_MSG_LINKINFO_GET(0xffffffffffffffff, 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f0000000080)={'ip6tnl0\x00', &(0x7f0000000140)={'sit0\x00', 0x0, 0x2f, 0x7f, 0x8e, 0x4, 0x1, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', @dev={0xfe, 0x80, '\x00', 0x3c}, 0x10, 0x1, 0x3, 0xfffff85b}}) sendfile(r0, r1, 0x0, 0x8400fffffffa) close(0xffffffffffffffff) 07:15:10 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x100, 0x0}) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x28000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_config_ext={0x5, 0x8}, 0x4000, 0x0, 0x9, 0x7, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000001440)) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r1, 0xd000943e, 0x0) clone(0x40808000, 0x0, 0x0, 0x0, 0x0) r2 = gettid() tkill(r2, 0x1e) r3 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r3, 0x0) ptrace$cont(0x18, 0x0, 0x0, 0x1) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ptrace$cont(0x7, 0x0, 0x0, 0x10001) openat$full(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x2, 0x80, 0x4, 0x4, 0xe0, 0xb, 0x0, 0x0, 0x8000, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x8004, 0x2, @perf_bp={0x0}, 0x4000, 0x8000, 0xfffffff9, 0x7, 0x80000001, 0x8, 0x0, 0x0, 0xa, 0x0, 0x100000000}, r2, 0x8, 0xffffffffffffffff, 0x6ee4ca8bd5713173) 07:15:10 executing program 3: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000, 0x0, 0x0, 0x1c00}]) 07:15:10 executing program 1: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000180)='./file1\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="20000000360000001900000060008f000ff68f01000000004000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}], 0x0, &(0x7f0000000140)={[{@jqfmt_vfsv0}]}) 07:15:10 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x03\x00\x00\x00', 0xfffffffffffffffe) 07:15:10 executing program 4: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16002, 0x400000}]) [ 980.254816][ T8940] loop3: detected capacity change from 0 to 16 [ 980.256159][ T8943] loop1: detected capacity change from 0 to 4 07:15:10 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x04\x00\x00\x00', 0xfffffffffffffffe) [ 980.300978][ T8943] EXT4-fs (loop1): Invalid log block size: 64 [ 980.303300][ T8940] attempt to access beyond end of device [ 980.303300][ T8940] loop3: rw=34817, want=184, limit=16 07:15:10 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x100, 0x0}) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x28000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_config_ext={0x5, 0x8}, 0x4000, 0x0, 0x9, 0x7, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000001440)) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r1, 0xd000943e, 0x0) clone(0x40808000, 0x0, 0x0, 0x0, 0x0) r2 = gettid() tkill(r2, 0x1e) r3 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r3, 0x0) ptrace$cont(0x18, 0x0, 0x0, 0x1) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ptrace$cont(0x7, 0x0, 0x0, 0x10001) openat$full(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x2, 0x80, 0x4, 0x4, 0xe0, 0xb, 0x0, 0x0, 0x8000, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x8004, 0x2, @perf_bp={0x0}, 0x4000, 0x8000, 0xfffffff9, 0x7, 0x80000001, 0x8, 0x0, 0x0, 0xa, 0x0, 0x100000000}, r2, 0x8, 0xffffffffffffffff, 0x6ee4ca8bd5713173) [ 980.353314][ T8943] loop1: detected capacity change from 0 to 4 07:15:10 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x05\x00\x00\x00', 0xfffffffffffffffe) [ 980.402559][ T8969] loop4: detected capacity change from 0 to 16 [ 980.404949][ T8943] EXT4-fs (loop1): Invalid log block size: 64 [ 980.450723][ C1] scsi_io_completion_action: 1 callbacks suppressed [ 980.450748][ C1] sd 0:0:1:0: [sg0] tag#5643 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 980.467718][ C1] sd 0:0:1:0: [sg0] tag#5643 CDB: opcode=0xe5 (vendor) [ 980.474585][ C1] sd 0:0:1:0: [sg0] tag#5643 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 980.484143][ C1] sd 0:0:1:0: [sg0] tag#5643 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 980.493692][ C1] sd 0:0:1:0: [sg0] tag#5643 CDB[20]: ba 07:15:10 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x06\x00\x00\x00', 0xfffffffffffffffe) 07:15:10 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\a\x00\x00\x00', 0xfffffffffffffffe) 07:15:10 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x100, 0x0}) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x28000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_config_ext={0x5, 0x8}, 0x4000, 0x0, 0x9, 0x7, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000001440)) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r1, 0xd000943e, 0x0) clone(0x40808000, 0x0, 0x0, 0x0, 0x0) r2 = gettid() tkill(r2, 0x1e) r3 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r3, 0x0) ptrace$cont(0x18, 0x0, 0x0, 0x1) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ptrace$cont(0x7, 0x0, 0x0, 0x10001) openat$full(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x2, 0x80, 0x4, 0x4, 0xe0, 0xb, 0x0, 0x0, 0x8000, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x8004, 0x2, @perf_bp={0x0}, 0x4000, 0x8000, 0xfffffff9, 0x7, 0x80000001, 0x8, 0x0, 0x0, 0xa, 0x0, 0x100000000}, r2, 0x8, 0xffffffffffffffff, 0x6ee4ca8bd5713173) [ 980.596926][ C1] sd 0:0:1:0: [sg0] tag#5633 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 980.607355][ C1] sd 0:0:1:0: [sg0] tag#5633 CDB: opcode=0xe5 (vendor) [ 980.614241][ C1] sd 0:0:1:0: [sg0] tag#5633 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 980.623795][ C1] sd 0:0:1:0: [sg0] tag#5633 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 980.633341][ C1] sd 0:0:1:0: [sg0] tag#5633 CDB[20]: ba 07:15:11 executing program 0: syz_mount_image$vfat(&(0x7f00000002c0), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f736617e43c00088020000200000004f8000020004000000000000000000001", 0x25}, {0x0, 0x0, 0x200000000011000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6900) ftruncate(r0, 0x800) lseek(r0, 0x1200, 0x0) write$binfmt_elf64(0xffffffffffffffff, &(0x7f0000000440)=ANY=[@ANYBLOB="7f454c46ff7c030180000000000000000300060004000000b1000000000000004000000000000000650300000000000000000000010038000200090080000700d746d086050000001f000000000000000700000000000000000000000000000055890000000000000300000000000000380000000000000000000070ffffffff020000000000000003000000000000003c00000000000000060000000000000040000000000000000600000000000000e21d443cc5bd39b53dbeeaa364fe80fe1aa60ffc8b3db0173a24094f8f7e83ad96996675861e75885ed0b0b55731b51462ddc5e8d13af270dae8d410274470e6e04509f9fc0989cb7349447edc81760ce4d3c323d7b80a239512f63a02db529a4a68073f68ad927042a557496b7aa3ae26c8a5f4d43ceb803428d0aa4864cc661aa86a4a80ce802f6b670ddd6d7ce7ecb258e99787f41bd04524739d6b85548ba7dbf6c6c5fb39c33dce5b66740bfc6d6b8a2443098fa22ac26080e0ad6f84d498277319a35f5746e96196679cecec01b0e265ab1812a189d3df973be8ec45bf0834552b821c34e396315b9c5a5175220dbb309d55eba119da39914c27c4ce41dd7c502b833dbceeca3be1664e08c0d90635dcca565870cc361d43813883bc5480060f15d4d79513603eed47bee880dc5b6ccc87e5407160d6dfebfb87a3a2e1d3b27461b0757d8e45e0b30da9b8c0cc86eddff9a861a312360d909f9a2c1e732589a17fe02c5cac8ab0c5080fc6749eeca2d56b9be795f2ee566729d156d40f50374cbd86a57a4ea246679ecf92570f2f0c2fdbec89da7aaafebb736adc7833678727667e0aefac6a34e0f340996d5dece829fe1d464c0a9dbfc1f0859e825745634b656e4e6274242dca2594cb4a232d87ec44eb40b53ad42cf94b8210e86ffbe1fa04d3eeccfa5d78634574c3dc58d2b48c4ed7dd97cd7bb4dc0296fe785ebd22ec842eb0ed9d451f639bbd554e23ae062b2aea6fb4f8492a80f4154dec22e0a283bf3d9ef1a08085fe5d9ac3b284e4b9d5e9a1b100a8196ccf1d42699e59b04e08b6eea6d6ff47782d1e56ac52a7621f2411f475113d321d59237027b4a3eaca2aa5b6e217e0d120b1f49d1b2b391934862cbc904396d19300558792740b3852185c8a116ff3c29f0bbe5a876b37ec15201ef87916553676578fe24079385539052ce475544dc4ef7c97f5e1e85c062baafe1f892d84be606ee2cf9334b8c6f32792acafb78eb0f4092c6b284da820ea581fa25acf969df4d71289613264cc98d16d126c6f21a2e20a66c86afd9bc8e57981f8efbe111fd115cecbc84f8333c87b514a11a0d59bd61b500d926ce4e8e265f613d1daaffec600100a4129e64a2120ce8a42b59d5ae0921de0014e9d05464e9cd1df28c58017c0e74ae082bbb83ae45706d59596da75092a6fb78bac15e1eb5ea18fbfb038d9c555e325ee3024b24ba84eb064dc781484a82c3101bbd8c69580fd26af4dfe14a2e9785970ab4028495a0352a4a4d4bedabe3d086ecf7705dafd9cfb7146d3ae9a9362fd683fe96176d09375075c35e9830047a30d00263532ae8d88878a5b548e17c314540de6a7ab8a2b7b35b73484697da94331205a9b5fc37941a1a6e5171dda8340389de06ca8dec51ca871dd0593a7a5e1716270fb74bef6ede6191f5d567442409d6523f04bf88be89b2946ffc5566738263b6c5dc79898961b3e955dc7a0ef8fe9b1483448d4457545feddc8ec95dc5465576e37650c0e407c8aca532b152ec9714a7eff4a228a9dda863de35d34aa263855704489bc349da2114bb6779f28e71649cf01661a0e8f2d05d09b7482aa31489c364fdc351703a9ae07f90899f61953e15e5c85d31fefc62fd2fd713cac2ade54651512ea0c03fbbd11a4dc1d27dc611f1d80bbc8a472fab9be00ccf03fb4a4ca5e0e726b46a5b339798f0df428fc46f7ca50dae891a46858ab0c492b32ee4d6e416dd4671b6e12074a34d9f0101d4f6a7372f7e9d5e9346445f1d67862ee7724b3008aa057db71dfe8359475e81e1ac79b762758334a3baa089bf44b552b9da490ceef6b81b86c598ab4e194e99bf1ec2f94ef73484f25cb329e8a33c83d38099ca054ea2f140ce3f3b5da76f60eb831f040a478787e611f6cd4baf47f2b653a30f881431148affa5752b128fdf9aa6b1eeb96d3cdd5733ee86607843295ccfe2b34f779ebe83f2bcbd0ac7fc4d41892bd571d6777cda1048e9916e89b45b65928acf856b348b4464793e4bc1d2fe6978f496c18bfa29ad5321ace4bd5b388760108de5c57632332938355af152de4c87ca9b6c11caa812b4dfe38392529b81ebe60d1d70f40f2676d4df5c185a39a8d978ac8d7babf12e7c525f317f87eedc66f4d7094e4462f0712df843875cb2d61862ad11e165f37a7c96b36dc18f61e40fcce24b5e0bbd596ff96b2b85faa38834b3b591ae7b770a1def3328bd81bbc4b878e5869b4eaf60be350790d7300db1876447e1907d786eae8865d7f576870292d64fe9a665f98807cc248fd341c90892a7cf00d2bac72f5f91ca91961233517c9e5842e6ae913089baf06f7141b46143374093cef30e71cf3b76588d3292b86ca23632ca7f4576b57baae45b20d8f355873ce83f48dcef129a5c88ee2558556dc1806a1b662b4e68baabaf633ebfc57786723ecec8468f3ce080600e15dc91b1759dfcdc4c558882456982e53790b167b4333f0c7d570c564df8aa2ec64f7ffa3a975d5dbb57d248ba1431bf35a9e0a462a151406de00ee08dfcfc4ed19958b6ff89517c3c999b136d65f5fd85feee990d6b6b55a491380a348c2e5a6ad187af120a37488f9bebad6b7e442a827852fbe7f772d52e84e3bfdbac8dbfceb258e1901e5d6f578b66e207cfb459e712f0c9f55bd31e5a109a01b700e9e28d1c1215719e771c59806fcaadbb192b5520f64acb858cc7e90b446a626e3cf344c25e3b4875e3851fc14dad2ce2d5c978c5b1cc66e9cdcab0813c43f11ae2d701747bf2dd9b6e0cca3872544dbcdc6888dc1a34272ebd37629a09c4c922fec8bffea288c6fe10ed52bb034c47a87cad4f9f0877335c0569b65cae6213b3f34730ad233c2739ae6387b1cb859489ba7d2d2fb87490fc23578768bb03e59ec18ce7bd09f1325876c78291193725d8fe5f2d2e2123525bab1c144f5e7b06e108589907eac4a62aec5f64db081cd99094888413baf05b9f75e349be084e0caceddc196edf47c2e135b7482f0611a81f33ea62a4cabb8ea1ffc362d1f7fd95759143cbdb22cdac40b9eedba380937ce286d4961550c5db034ce29363ae5efdc6689ae719e97f204210cb6749b9897203456cf0f659c2832a16610d7e6fd602f4e85c407b68980c409033b43889087880fe34a01a0723c1de6e28d3e988142edf52fe9bea48a88c6a056bc8a323c4c53894308d2131d9d96acd03fbc48a3eb29035bf3007fbbabd662674bf2d021a1d081f14103402ba691f78e74076c465d22d77efd5729d79f4fb078972c5c165af9502004cbd34806371273f1e11de09c785e7043bcedfa6c14f37f771acd1a3d489c63ff94a7f9f07d52759b67121460583cf6ac8040de597a8ed313b1bf6b2623e5c1375fa1341f9143193a7471f840ea46e0583cb5bba44e01e3c5cfdf565639b632742aa74302907a65e8013bdc51fab4cf1a61dc472d0125bdc7e8f0119cd41f0fb033a15c166a3174f504af985260fb3041f59e7e9e0d0997dfc74507795c75ecf7f41355de3ef6eea444e4a400952737b50b22f88c238fac7b943a435cf380aa81f9225043e1921ee671d0d9622f22be902db6c7a5fbcffdcc53971a7219869ae74f1c452948b20d705fb710334ffef10988c36d055d72c332fb2cb0212ae85f0bbefb6b498b2327a238c8a8a989e6dc1feef360b8e745e79fa115e15a2343326a344461302d6a8ee54101ef567c7c106ed1c86a6d8b648bf1b71f6c5dfbff0fc9a70789ed1cb006499f61fec4133cb43d07ffb559a6febb434c08e356d0cf38b23a4feae15effc328bbb68fc467be3fc3f3d6f1a5b15671b2988209755a423c115511e100245f5958a86dd1db6bb1e1a59e281d8a2ac6a6f7e566ca1a459ea25a8ea05768be093fc4ff471e5ed271b1aaa920ed1ae9dce3a9dd4e1c73290270990a1880a9c0f1b9e2b5792a20c27c2e1c2090155565ee4892820968f99686f2cef6cadefa4662e0d5b350f849c09e4ba19dd89d0a324bed51f9ef3e98423248f3aafaff8bec3fff02cb7c6f9e165ad21eaf498331eae1dfb2d47415fc33cdeeae320c90f764b884a4e744000b5e7f3733e9efef389295b681b663a2bfd76ebd13aefd6ffb6419d8935dfe7c8e3479fc67f27fa7d99e954833a5b6bbf81533407f115005ec6b1aef9c612ca45cb44113f5a035bbffd4de76ddf5d5f4d861cbbdd46aecc76ff827f2d8c5ade261b251eebd51336b5c8ff7720a181393f5c12de94146d247afce43001a68dea7b56126f6de104944a56aa1cf0ea4559d581405e5db52ed237e944fc4e4e4b99f1627f91dd275514581ce7db9a1d3c716fe40d12d62bd7ca77f87d9e34d421b5cc8f4c7c7e76c7568ec03de41a71abaca54bfad953fb5f3b7db0121f032359defd3c07ae75416a286221b98bb933c0ed9621fc1dccb40008c65c308c75182add7451ef15e1c65f9b18cc66284d83c01b71a92f86686502f1838eaa0051538c696f2bdc97846d61c02cc6d284cd4bf0e1fa7779484bb625dc932fcc63780fc4e5f45def1522f737208ed3153ba90b14387c89fe7ab47390265e96963c3b7dfe42b715572398f9dd45a52d38419aaf8320bdd61c11a96c4db21870c9641126c17d8a732766bf140fb2ceead89874d224c3477859ad8312efb2ba3a52ec98ac5341a051754c8d8b24392d5d505025d67ed2ffa58640a72e457526ae027d6620ea5a381b02177cb8bdb07d1452dd1c9b30c35a16697215587c4de26f642a340ee39189dc570573f60a30da1b8e4cacd80511119d53014f26d964b4714d47b710c672e9cdf4eddfc5c5555f2530c9b495beba76ecb10c055e643f3f8efa6383829344b77b8dd9a045fed3a4b84d8f1fe04765fd92406bc2241d6a7ee0c6d2a17512fad360149b23404e68fb313dc780cf5114a9313cda0853b04696da5b5f8a1d5b24fe547d71a9536293af87e20e4791b81a403e01386e78d0ccfbe6cac1777a874c03f575d290c156bb4c01c54c9e6c82810edda73f67c4146e798099d26e879c7a8e8b8988f7966eafa00811b0bbe60ba0c7bd0d52932c579b38afdc7dec70b494fe14b47225ca64fb3e1625332ef75a29a64af9962bd9dd28ad515464739a85ac297c75d76329fcc6948c8c55147958c912da2ab4ca92c8322a2f07dc9ae8720683913f3038a44b3171ac4ce764f3822656e6e0cb09b7804d5dccc375add64b7b39c3592f82cca4f2ff7d7304e52f2f3880a244e1d50f716c93b6c740b279cf4491f540c5bd2c5c8f8c387c70067252a92ccf8dd15f335914b53bbda2dfbbacd56688572e9057eed9130d02a8e34a28ccce1ddae5d6ac44f61249883351d3fb27362cc58595c048fd93de7b880d786c81c38d4dc188b6adf9eb18754d5c534276eeede2da26aef4a3318ebc32dd82c019048cf64dfc87bcbd3646344d3eaa38c2b61ee0a65c7061fcc870f1672d6f91627b0a365dee738c8d7c078a3659e064e49ccdb1a8aa3b8cac1375f9d936a85dcd24731a08ea42dcb6f0e769150177baf92a8826a84ffedbe58f7a8f2db309cb61ac19d1d65e7e1971df7429a3085f4dba41590e5d73b7680d51b099d010eea9a591a3357e87ff0a87526397a703d8b0b914e7b7c8e7df305b7812036428c78ae0e1f5069ffc868110f0d9803390dce54c7711ad6da72498b839e5f572489e6613b217945c8d04972e680d70862b768ee0485be78b2bc58fe9ae5fd8a823a939f8b9868887a9b32ab7ee6aa12cfd20633ff1e8186111d72f992b18d0060cad77fba82bc7fb2de6e58b7000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f6ffffff00"/5296], 0x14b0) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, r1, 0x0, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @private2}, 0x1c) sendfile(r0, r1, 0x0, 0x108d1521) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_BEARER_ADD(r0, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000140)={&(0x7f0000000300)={0x110, 0x0, 0x10, 0x70bd2d, 0x25dfdbfd, {}, [@TIPC_NLA_SOCK={0x10, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_CON={0xc, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_NODE={0x8, 0x2, 0x200}]}]}, @TIPC_NLA_BEARER={0xe4, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x4e22, @broadcast}}, {0x20, 0x2, @in6={0xa, 0x4e20, 0x1, @loopback, 0x3}}}}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x977e}, @TIPC_NLA_BEARER_PROP={0x44, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x3}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xffffffff}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x2}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xf15f}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x6}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xffff}]}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x2}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7fffffff}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x3f}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xa19}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1a}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7}]}, @TIPC_NLA_BEARER_NAME={0xd, 0x1, @l2={'ib', 0x3a, 'team0\x00'}}]}, @TIPC_NLA_SOCK={0x8, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_HAS_PUBL={0x4}]}]}, 0x110}, 0x1, 0x0, 0x0, 0x44080}, 0x20040000) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_FEATURES_SET(r2, 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHGPRL(0xffffffffffffffff, 0x89f7, &(0x7f00000001c0)={'ip6tnl0\x00', 0x0}) sendmsg$ETHTOOL_MSG_LINKINFO_GET(0xffffffffffffffff, 0x0, 0x0) sendfile(r0, r1, 0x0, 0x8400fffffffa) close(0xffffffffffffffff) 07:15:11 executing program 3: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000, 0x0, 0x0, 0x1d00}]) 07:15:11 executing program 1: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000180)='./file1\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="20000000360000001900000060008f000ff68f010000ffffe000000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}], 0x0, &(0x7f0000000140)={[{@jqfmt_vfsv0}]}) 07:15:11 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\b\x00\x00\x00', 0xfffffffffffffffe) 07:15:11 executing program 4: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16002, 0x401000}]) 07:15:11 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x100, 0x0}) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x28000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_config_ext={0x5, 0x8}, 0x4000, 0x0, 0x9, 0x7, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000001440)) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r1, 0xd000943e, 0x0) clone(0x40808000, 0x0, 0x0, 0x0, 0x0) r2 = gettid() tkill(r2, 0x1e) r3 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r3, 0x0) ptrace$cont(0x18, 0x0, 0x0, 0x1) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ptrace$cont(0x7, 0x0, 0x0, 0x10001) openat$full(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x2, 0x80, 0x4, 0x4, 0xe0, 0xb, 0x0, 0x0, 0x8000, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x8004, 0x2, @perf_bp={0x0}, 0x4000, 0x8000, 0xfffffff9, 0x7, 0x80000001, 0x8, 0x0, 0x0, 0xa, 0x0, 0x100000000}, r2, 0x8, 0xffffffffffffffff, 0x6ee4ca8bd5713173) 07:15:11 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\t\x00\x00\x00', 0xfffffffffffffffe) [ 981.182665][ C1] sd 0:0:1:0: [sg0] tag#5634 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 981.193030][ C1] sd 0:0:1:0: [sg0] tag#5634 CDB: opcode=0xe5 (vendor) [ 981.194443][ T9017] loop1: detected capacity change from 0 to 4 [ 981.199883][ C1] sd 0:0:1:0: [sg0] tag#5634 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 981.199904][ C1] sd 0:0:1:0: [sg0] tag#5634 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 981.225049][ C1] sd 0:0:1:0: [sg0] tag#5634 CDB[20]: ba [ 981.239071][ T9016] loop3: detected capacity change from 0 to 16 [ 981.256976][ T9017] EXT4-fs (loop1): Invalid log block size: 224 07:15:11 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x100, 0x0}) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x28000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_config_ext={0x5, 0x8}, 0x4000, 0x0, 0x9, 0x7, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000001440)) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r1, 0xd000943e, 0x0) clone(0x40808000, 0x0, 0x0, 0x0, 0x0) r2 = gettid() tkill(r2, 0x1e) r3 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r3, 0x0) ptrace$cont(0x18, 0x0, 0x0, 0x1) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ptrace$cont(0x7, 0x0, 0x0, 0x10001) openat$full(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x2, 0x80, 0x4, 0x4, 0xe0, 0xb, 0x0, 0x0, 0x8000, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x8004, 0x2, @perf_bp={0x0}, 0x4000, 0x8000, 0xfffffff9, 0x7, 0x80000001, 0x8, 0x0, 0x0, 0xa, 0x0, 0x100000000}, r2, 0x8, 0xffffffffffffffff, 0x6ee4ca8bd5713173) 07:15:11 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\n\x00\x00\x00', 0xfffffffffffffffe) [ 981.306943][ T9016] attempt to access beyond end of device [ 981.306943][ T9016] loop3: rw=34817, want=184, limit=16 [ 981.328608][ T9017] loop1: detected capacity change from 0 to 4 [ 981.347788][ T9017] EXT4-fs (loop1): Invalid log block size: 224 [ 981.353820][ T9046] loop4: detected capacity change from 0 to 16 [ 981.378521][ C0] sd 0:0:1:0: [sg0] tag#5638 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 981.388910][ C0] sd 0:0:1:0: [sg0] tag#5638 CDB: opcode=0xe5 (vendor) [ 981.395786][ C0] sd 0:0:1:0: [sg0] tag#5638 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 981.405338][ C0] sd 0:0:1:0: [sg0] tag#5638 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 981.414894][ C0] sd 0:0:1:0: [sg0] tag#5638 CDB[20]: ba 07:15:11 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\v\x00\x00\x00', 0xfffffffffffffffe) 07:15:11 executing program 1: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000180)='./file1\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="20000000360000001900000060008f000ff68f01000000000001000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}], 0x0, &(0x7f0000000140)={[{@jqfmt_vfsv0}]}) 07:15:11 executing program 3: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000, 0x0, 0x0, 0x1e00}]) [ 981.548170][ T9078] loop1: detected capacity change from 0 to 4 [ 981.563487][ T9083] loop3: detected capacity change from 0 to 16 [ 981.589437][ T9078] EXT4-fs (loop1): Invalid log block size: 256 [ 981.617319][ T9083] attempt to access beyond end of device [ 981.617319][ T9083] loop3: rw=34817, want=184, limit=16 [ 981.653484][ T9078] loop1: detected capacity change from 0 to 4 [ 981.681837][ T9078] EXT4-fs (loop1): Invalid log block size: 256 07:15:12 executing program 0: syz_mount_image$vfat(&(0x7f00000002c0), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f736617e43c00088020000200000004f8000020004000000000000000000001", 0x25}, {0x0, 0x0, 0x200000000011000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6900) ftruncate(r0, 0x800) lseek(r0, 0x1200, 0x0) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, r1, 0x0, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @private2}, 0x1c) sendfile(r0, r1, 0x0, 0x108d1521) r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_FEATURES_SET(r2, 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHGPRL(0xffffffffffffffff, 0x89f7, &(0x7f00000001c0)={'ip6tnl0\x00', 0x0}) sendmsg$ETHTOOL_MSG_LINKINFO_GET(0xffffffffffffffff, 0x0, 0x0) sendfile(r0, r1, 0x0, 0x8400fffffffa) prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) gettid() 07:15:12 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\f\x00\x00\x00', 0xfffffffffffffffe) 07:15:12 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x100, 0x0}) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x28000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_config_ext={0x5, 0x8}, 0x4000, 0x0, 0x9, 0x7, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000001440)) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r1, 0xd000943e, 0x0) clone(0x40808000, 0x0, 0x0, 0x0, 0x0) r2 = gettid() tkill(r2, 0x1e) r3 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r3, 0x0) ptrace$cont(0x18, 0x0, 0x0, 0x1) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ptrace$cont(0x7, 0x0, 0x0, 0x10001) openat$full(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x2, 0x80, 0x4, 0x4, 0xe0, 0xb, 0x0, 0x0, 0x8000, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x8004, 0x2, @perf_bp={0x0}, 0x4000, 0x8000, 0xfffffff9, 0x7, 0x80000001, 0x8, 0x0, 0x0, 0xa, 0x0, 0x100000000}, r2, 0x8, 0xffffffffffffffff, 0x6ee4ca8bd5713173) 07:15:12 executing program 4: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16002, 0x4af000}]) 07:15:12 executing program 3: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000, 0x0, 0x0, 0x1f00}]) 07:15:12 executing program 1: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000180)='./file1\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="20000000360000001900000060008f000ff68f01000000000002000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}], 0x0, &(0x7f0000000140)={[{@jqfmt_vfsv0}]}) [ 982.141329][ C0] sd 0:0:1:0: [sg0] tag#5680 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 982.144667][ T9115] loop1: detected capacity change from 0 to 4 [ 982.151707][ C0] sd 0:0:1:0: [sg0] tag#5680 CDB: opcode=0xe5 (vendor) [ 982.159710][ T9116] loop3: detected capacity change from 0 to 16 [ 982.164599][ C0] sd 0:0:1:0: [sg0] tag#5680 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 982.164626][ C0] sd 0:0:1:0: [sg0] tag#5680 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d 07:15:12 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\r\x00\x00\x00', 0xfffffffffffffffe) [ 982.189804][ C0] sd 0:0:1:0: [sg0] tag#5680 CDB[20]: ba [ 982.197449][ T9115] EXT4-fs (loop1): Invalid log block size: 512 07:15:12 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x100, 0x0}) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x28000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_config_ext={0x5, 0x8}, 0x4000, 0x0, 0x9, 0x7, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000001440)) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r1, 0xd000943e, 0x0) clone(0x40808000, 0x0, 0x0, 0x0, 0x0) r2 = gettid() tkill(r2, 0x1e) r3 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r3, 0x0) ptrace$cont(0x18, 0x0, 0x0, 0x1) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ptrace$cont(0x7, 0x0, 0x0, 0x10001) openat$full(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x2, 0x80, 0x4, 0x4, 0xe0, 0xb, 0x0, 0x0, 0x8000, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x8004, 0x2, @perf_bp={0x0}, 0x4000, 0x8000, 0xfffffff9, 0x7, 0x80000001, 0x8, 0x0, 0x0, 0xa, 0x0, 0x100000000}, r2, 0x8, 0xffffffffffffffff, 0x6ee4ca8bd5713173) [ 982.237652][ T9116] attempt to access beyond end of device [ 982.237652][ T9116] loop3: rw=34817, want=184, limit=16 07:15:12 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x0e\x00\x00\x00', 0xfffffffffffffffe) 07:15:12 executing program 1: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000180)='./file1\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="20000000360000001900000060008f000ff68f01000000000402000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}], 0x0, &(0x7f0000000140)={[{@jqfmt_vfsv0}]}) [ 982.285028][ T9137] loop4: detected capacity change from 0 to 16 [ 982.324977][ C1] sd 0:0:1:0: [sg0] tag#5692 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 982.335372][ C1] sd 0:0:1:0: [sg0] tag#5692 CDB: opcode=0xe5 (vendor) [ 982.342234][ C1] sd 0:0:1:0: [sg0] tag#5692 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 982.351789][ C1] sd 0:0:1:0: [sg0] tag#5692 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 982.356767][ T9148] loop1: detected capacity change from 0 to 4 [ 982.361343][ C1] sd 0:0:1:0: [sg0] tag#5692 CDB[20]: ba 07:15:12 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x0f\x00\x00\x00', 0xfffffffffffffffe) [ 982.381664][ T9148] EXT4-fs (loop1): Invalid log block size: 516 07:15:12 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x100, 0x0}) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x28000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_config_ext={0x5, 0x8}, 0x4000, 0x0, 0x9, 0x7, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000001440)) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r1, 0xd000943e, 0x0) clone(0x40808000, 0x0, 0x0, 0x0, 0x0) r2 = gettid() tkill(r2, 0x1e) r3 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r3, 0x0) ptrace$cont(0x18, 0x0, 0x0, 0x1) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ptrace$cont(0x7, 0x0, 0x0, 0x10001) openat$full(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x2, 0x80, 0x4, 0x4, 0xe0, 0xb, 0x0, 0x0, 0x8000, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x8004, 0x2, @perf_bp={0x0}, 0x4000, 0x8000, 0xfffffff9, 0x7, 0x80000001, 0x8, 0x0, 0x0, 0xa, 0x0, 0x100000000}, r2, 0x8, 0xffffffffffffffff, 0x6ee4ca8bd5713173) [ 982.454488][ T9148] loop1: detected capacity change from 0 to 4 [ 982.473553][ T9148] EXT4-fs (loop1): Invalid log block size: 516 [ 982.486410][ C0] sd 0:0:1:0: [sg0] tag#5653 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 982.496776][ C0] sd 0:0:1:0: [sg0] tag#5653 CDB: opcode=0xe5 (vendor) [ 982.503646][ C0] sd 0:0:1:0: [sg0] tag#5653 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 982.513192][ C0] sd 0:0:1:0: [sg0] tag#5653 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 982.522746][ C0] sd 0:0:1:0: [sg0] tag#5653 CDB[20]: ba 07:15:13 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x10\x00\x00\x00', 0xfffffffffffffffe) 07:15:13 executing program 3: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000, 0x0, 0x0, 0x2200}]) 07:15:13 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x100, 0x0}) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x28000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_config_ext={0x5, 0x8}, 0x4000, 0x0, 0x9, 0x7, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000001440)) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r1, 0xd000943e, 0x0) clone(0x40808000, 0x0, 0x0, 0x0, 0x0) r2 = gettid() tkill(r2, 0x1e) r3 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r3, 0x0) ptrace$cont(0x18, 0x0, 0x0, 0x1) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ptrace$cont(0x7, 0x0, 0x0, 0x10001) openat$full(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x2, 0x80, 0x4, 0x4, 0xe0, 0xb, 0x0, 0x0, 0x8000, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x8004, 0x2, @perf_bp={0x0}, 0x4000, 0x8000, 0xfffffff9, 0x7, 0x80000001, 0x8, 0x0, 0x0, 0xa, 0x0, 0x100000000}, r2, 0x8, 0xffffffffffffffff, 0x6ee4ca8bd5713173) 07:15:13 executing program 1: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000180)='./file1\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="20000000360000001900000060008f000ff68f01000000000003000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}], 0x0, &(0x7f0000000140)={[{@jqfmt_vfsv0}]}) 07:15:13 executing program 0: syz_mount_image$vfat(&(0x7f00000002c0), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f736617e43c00088020000200000004f8000020004000000000000000000001", 0x25}, {0x0, 0x0, 0x200000000011000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f00000000c0)='./bus\x00', 0x119) fcntl$setstatus(r0, 0x4, 0x6900) ftruncate(r0, 0x800) lseek(r0, 0x1200, 0x0) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, r1, 0x0, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @private2}, 0x1c) sendfile(r0, r1, 0x0, 0x108d1521) getsockopt$inet_buf(0xffffffffffffffff, 0x0, 0x50, &(0x7f0000001280)=""/4068, &(0x7f0000000040)=0xfe4) ppoll(&(0x7f0000000140)=[{0xffffffffffffffff, 0x420}, {0xffffffffffffffff, 0x8}, {r1, 0x8042}, {r0, 0x85c3}, {0xffffffffffffffff, 0x40e8}], 0x5, &(0x7f0000000180), &(0x7f0000000240)={[0x1]}, 0x8) r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_FEATURES_SET(r2, 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHGPRL(0xffffffffffffffff, 0x89f7, &(0x7f00000001c0)={'ip6tnl0\x00', 0x0}) sendmsg$ETHTOOL_MSG_LINKINFO_GET(0xffffffffffffffff, 0x0, 0x0) sendfile(r0, r1, 0x0, 0x8400fffffffa) close(0xffffffffffffffff) 07:15:13 executing program 4: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16002, 0x4fc000}]) [ 983.174566][ C1] sd 0:0:1:0: [sg0] tag#5663 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 983.184945][ C1] sd 0:0:1:0: [sg0] tag#5663 CDB: opcode=0xe5 (vendor) [ 983.191835][ C1] sd 0:0:1:0: [sg0] tag#5663 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 983.201390][ C1] sd 0:0:1:0: [sg0] tag#5663 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 983.210952][ C1] sd 0:0:1:0: [sg0] tag#5663 CDB[20]: ba [ 983.216562][ T9201] loop4: detected capacity change from 0 to 16 07:15:13 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x11\x00\x00\x00', 0xfffffffffffffffe) [ 983.230493][ T9196] loop1: detected capacity change from 0 to 4 [ 983.238574][ T9203] loop3: detected capacity change from 0 to 16 [ 983.258549][ T9196] EXT4-fs (loop1): Invalid log block size: 768 [ 983.300992][ T9203] attempt to access beyond end of device [ 983.300992][ T9203] loop3: rw=34817, want=184, limit=16 07:15:13 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x100, 0x0}) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x28000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_config_ext={0x5, 0x8}, 0x4000, 0x0, 0x9, 0x7, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000001440)) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r1, 0xd000943e, 0x0) clone(0x40808000, 0x0, 0x0, 0x0, 0x0) r2 = gettid() tkill(r2, 0x1e) r3 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r3, 0x0) ptrace$cont(0x18, 0x0, 0x0, 0x1) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ptrace$cont(0x7, 0x0, 0x0, 0x10001) openat$full(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x2, 0x80, 0x4, 0x4, 0xe0, 0xb, 0x0, 0x0, 0x8000, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x8004, 0x2, @perf_bp={0x0}, 0x4000, 0x8000, 0xfffffff9, 0x7, 0x80000001, 0x8, 0x0, 0x0, 0xa, 0x0, 0x100000000}, r2, 0x8, 0xffffffffffffffff, 0x6ee4ca8bd5713173) 07:15:13 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x12\x00\x00\x00', 0xfffffffffffffffe) 07:15:13 executing program 3: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000, 0x0, 0x0, 0x3f00}]) [ 983.346539][ T9196] loop1: detected capacity change from 0 to 4 [ 983.382308][ T9196] EXT4-fs (loop1): Invalid log block size: 768 07:15:13 executing program 1: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000180)='./file1\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="20000000360000001900000060008f000ff68f01000000000004000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}], 0x0, &(0x7f0000000140)={[{@jqfmt_vfsv0}]}) [ 983.454468][ C0] sd 0:0:1:0: [sg0] tag#5655 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 983.464878][ C0] sd 0:0:1:0: [sg0] tag#5655 CDB: opcode=0xe5 (vendor) [ 983.471749][ C0] sd 0:0:1:0: [sg0] tag#5655 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 983.481310][ C0] sd 0:0:1:0: [sg0] tag#5655 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 983.490865][ C0] sd 0:0:1:0: [sg0] tag#5655 CDB[20]: ba 07:15:13 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00H\x00\x00\x00', 0xfffffffffffffffe) [ 983.518177][ T9245] loop3: detected capacity change from 0 to 16 [ 983.540768][ T9249] loop1: detected capacity change from 0 to 4 [ 983.555748][ T9249] EXT4-fs (loop1): Invalid log block size: 1024 07:15:13 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00L\x00\x00\x00', 0xfffffffffffffffe) [ 983.573101][ T9245] attempt to access beyond end of device [ 983.573101][ T9245] loop3: rw=34817, want=184, limit=16 07:15:13 executing program 1: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000180)='./file1\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="20000000360000001900000060008f000ff68f01000000000005000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}], 0x0, &(0x7f0000000140)={[{@jqfmt_vfsv0}]}) 07:15:13 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x100, 0x0}) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x28000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_config_ext={0x5, 0x8}, 0x4000, 0x0, 0x9, 0x7, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000001440)) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r1, 0xd000943e, 0x0) clone(0x40808000, 0x0, 0x0, 0x0, 0x0) r2 = gettid() tkill(r2, 0x1e) r3 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r3, 0x0) ptrace$cont(0x18, 0x0, 0x0, 0x1) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ptrace$cont(0x7, 0x0, 0x0, 0x10001) openat$full(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x2, 0x80, 0x4, 0x4, 0xe0, 0xb, 0x0, 0x0, 0x8000, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x8004, 0x2, @perf_bp={0x0}, 0x4000, 0x8000, 0xfffffff9, 0x7, 0x80000001, 0x8, 0x0, 0x0, 0xa, 0x0, 0x100000000}, r2, 0x8, 0xffffffffffffffff, 0x6ee4ca8bd5713173) 07:15:13 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00h\x00\x00\x00', 0xfffffffffffffffe) [ 983.692224][ T9278] loop1: detected capacity change from 0 to 4 [ 983.693439][ C1] sd 0:0:1:0: [sg0] tag#5695 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 983.708689][ C1] sd 0:0:1:0: [sg0] tag#5695 CDB: opcode=0xe5 (vendor) [ 983.715105][ T9278] EXT4-fs (loop1): Invalid log block size: 1280 [ 983.715550][ C1] sd 0:0:1:0: [sg0] tag#5695 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 983.731305][ C1] sd 0:0:1:0: [sg0] tag#5695 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 983.740910][ C1] sd 0:0:1:0: [sg0] tag#5695 CDB[20]: ba [ 983.840513][ T9278] loop1: detected capacity change from 0 to 4 [ 983.854295][ T9278] EXT4-fs (loop1): Invalid log block size: 1280 07:15:14 executing program 0: syz_mount_image$vfat(&(0x7f00000002c0), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f736617e43c00088020000200000004f8000020004000000000000000000001", 0x25}, {0x0, 0x0, 0x200000000011000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000080)='./bus\x00') r0 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6900) ftruncate(r0, 0x800) lseek(r0, 0x1200, 0x0) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, r1, 0x0, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @private2}, 0x1c) sendfile(r0, r1, 0x0, 0x108d1521) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$FIDEDUPERANGE(0xffffffffffffffff, 0xc0189436, &(0x7f0000001540)=ANY=[@ANYBLOB="090000000000000008000000000000000400000000000000", @ANYRES32=r1, @ANYBLOB="0000000004000000000000000000000000000000000000000000009a5cc5ff7a4e9301ab40926870000c49300516ed1e12cebad579abb2872d854686e5d01e0ddd484e3ca6f729364af21262325759b93cb8b34d328ec280f986eac9b38bfa0d4a43cc9141411509cd66184b6355f7f2437d80de6ce8766550284ec576d2126ae0e6ba1626d9dfa451a147f0112806c8f3c5d59a91c905cff254722755b4b507ad9bc8c1a1d035ef6645dc3574679776d1a6b6db9b98d5ce3b17180ee06e7902573d7f9008d04759eb241984f22b960758", @ANYRES32, @ANYBLOB="00000000fbffffffffffffff00"/28, @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\b\x00'/28, @ANYRES32=r0, @ANYBLOB="00000000f68700"/28]) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_FEATURES_SET(r2, 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHGPRL(0xffffffffffffffff, 0x89f7, &(0x7f00000001c0)={'ip6tnl0\x00', 0x0}) sendmsg$ETHTOOL_MSG_LINKINFO_GET(0xffffffffffffffff, 0x0, 0x0) write$binfmt_misc(0xffffffffffffffff, &(0x7f0000000300)=ANY=[@ANYBLOB="73797a311b950ce01fbbfe92109abb6135148e7f9b0f8e00bfc2002d247c1621a8e1dd54c2b88ad138219b299110d4abd07413276adbaed87a85c3e917e1b25845de2b04098ac17d76efc6d191f5bfafecb0245bd7b7a970a3145f300a99889049789a65f718a7ceccc7863017ef71eb5ec94e88f6d472050c815d03c71b05992ff6f6b6c14e851d71fcf4b18001a1b96df62e58fed3534d216406ad72e662af8565c07db1e41edb84906a0997a96fa174a117a6e528f1c6a73e803757c373ec99879bca704ef6ea162d90390d260bcfa517c505a0469a769e5ac25eab8dfba4431bc3cf578e6208c2b1590082882f5b72a183fa6fefcf0e5c369516af5f9df95ce3cf16b9efabf17a670da96cdf52938e2cd9b0c3537ab2ad74799c15527ba2483895aa429ec62e414ba2354f1c711c40bd53fcd6c75823c8a99cc92146e41248dde026ef7a00e174665568bdefc0d729f610df302b495b36ff941aa9cc65fa98a8893a8b6faad31ae97b6f93878b9ab52f446f65811a73dc4e8f31135411eb4cdaf8e5da4d0a549f19e238b6197e20cb8f98f4f998a24a855495c2a83f3c8b09b806a3a6cb400e91267bd32e9947a76989aeccae02a74eee9af5844898d8fa760c092e961ab54da0c968991123e00c7b53e139274cd76a98c333d6e73791f957206e675e8ab5709601d9c2f68d94c400827d15daed7760c11478ef79d8fde4b33018a3c32f97001ce5c4341989c1368da9854b614e6e68b42c39860c981197ea86f0f47965383e07bc9a41297fc784ac0e58a8419eac7568cb1e43fe0681fc06545074dbc78121c625a33d4497a6a37d7c82fe6c646fd2f6dd879ba8ea9ad4d2569cadc8a23a5eab4af7cc2b743d0b68163592a5b4652e9b0e2628244a1a6f6a951a179feca9a8337b92830728ef53539477772141e8ffe2605f0162c0882585da6303f9196971c4fff693a27fbb15193a4c2527b768ef293c2d13de5b503ce422f156866cb72a912003efa5e555d1741674cb0c74b98336c4c595ff020820c1cffecd2fb517bc10037109a288ac6949678c75b4d889f0ffef86786d3bb1d7d6d49caf4ba9583d192ac1002ef9f9c9fcf02c1d1098e8797285cad6feccb4f63f3f9c1c1cf88c755abd2974f69958388596446647ad1868b6aeb08b903a13dbd698ca1b46cf25230a9f70deaf36a3a76e26c2cba1cb2d61f39e894ebf63aad6de585c3b539ce29002864c933ced1755e93a644519a8f5ceedd824a8907feeefb9dd90d2a8f62f0776d3a4d06ac31048b0b5384f66bc5ec6e9f0cf8f5acf80121bfc3141986726fa48bf4086f1ddc16a9aec30ccc0e9da409aba10d6c4cdc8164c18ce66cff41d6287d1c5689f4d052356cd9d60ea0df751dfc06573542700c9adc2a6a6de6085a5cf10bcaa6f4c0d5dbfdbb1368349343887a09b66033b2af7ef9dfc4f1df31414f9b7f6291f397cbf69fd506fdde5f100a7a3d88eae31a148b897e5b066a871e2f07f8ff86c1881029609a7362e3fd999f0ad9f629b4270c2d049c91a4d7e3f11bfd71d18e91aef8471d7718d11d363e9248d1c85b99cae0468839fb14479c9121523b62d11effbaaf2c41d9054dc5e181eac0c97f48a5c800a1573eb52b1b98cb973c81821f5b72cf77678d2fb27bdb3b4852c4c12096f86b07bd47b4d6c3d5acc3e41436a2150a2d940a06f86300dc977c5423ef2564c93c1369af86ffb48868b92873b4a01d9312d82ab731b3522b971adf9e9b2b9bd6fb971e53d4d94b62bcd72446d9b447a535d2439c7e7c66068052f121f6af872923723deab50ecbaf8377e333de5be5043313bc3240786e23d5127cbd484707560e25a54d7dc950f8220ab937e730402155e2d62f124202ba7a6b5148efb753843d194d6d7ec45fbe99c62b741ea48abb92a5dbe7df3d76f3e0046508b539bf2c6580e87bd3669117d13e58d4b7eb266aaf494a1af4a2cf33b98dffab4f9c6e63be98fe03989e151b8d6472002314dc2e2174e7bba986a1a703b69ff595335d18dc5c291bea1204bc8532464db83b6b0dead724776477bce31f8568c00a614f82ffa357cf30b68c11050c4587e2c0aab35cd267cb3a164c9365fb03a17ba39f1920fbd5453694b3d998d157e64acc3026d25f2c14bf9ab5aa01b9d019e3c1b5696508f66d22e0dc0a82746b604fd2c630d7e67ef9f952a2d55b34754f80baed49d5cffa2931924e9690f168f6a218993cb2e80bb3fe5d3e7ef42851ee7a574cdafd704d34152aac5fbb8626083db08d2f81f83cb5a20207e838937c8ba7d15409b5726acdb7107ec69f6f76f6fc4cf5a5bc4a97d65a22769b821ec733c7c20fa1e42d9450758bb0ee4ba27d867cd7ac87d4491c50f79627a426675aabc45a10f922be169c939d77cda475981e97443b94265374fa292040a6f566faa1d7831ba18614d248bf0118ee455af839df0a2bfeaf317c6d1cf6a81dfbd5d5c4d08888ab54b4111ce655bf182aa28c95b0d7266e909878f4f7b27fff11fb961906d1c4ab2e9fa6d0eb8370527de5ce06bc08dbe30d7f0feec033cd7386e6985a85a49c0244418605e9addb1b8e83a839ffae4e0011f0872bdc83bdd5a1608004224def94d3d13bd08d39cfeb56187f2ba2b20c82bd411cbbb07b212cb2bcb82cb7c4d9b091bfe2e1b46db18b601bd75ae78cd5971d61b4bb36253453d90c1cbf4df39303db6188159fab2a98963b46ae7407e35584ca5cb6a278363b599cfb5d3dc05bd9a121b69b155754c17a41db79505f15b39efe95f5ca1a8167c2097e4d58466091250ecf4850ca3821e55e4bb29d0dedcaead02fc6eb7e34c26c34f637d64d6dda879d45150b221225727dd608d9acb6ba204c7fca9397fcb2ceca9811c90deff2bab9a453070c6f052168394e4461dfaf7253070b58a8769fe7e6b5d8780b9bcb86654e40a54c44c28fdc6e8b1b2067f8e4bc0cc02c26413106922523ed8eb77efbf745bdc0905d56b6f956cad06264c1e3ffe5eb7b32e3d1a5262252fd682b618ba3ae4fac8c85b3a11e1cf7ff7df5b19710b9dc3467330cbfd56b5805c4d6bb67178ae64d84bbc5453202ced7e73055ebd7257672de1a1ec0f829c105b0e2d0d5d1fe61d15ec7f1b18fa5290dcaefedd1edd7689d2d3f8d64e6dd834ab458cb3609cc5d0648d110c748f07a8a5dfc2cdbbce5197ac755ca30ac8213749cafd1e87f30a542ac6c8074e9cb630f72c53223a3fe3cab32d6388cdd19aa52fa95d96836e913581b55a13856e92f55f4a216563fa3dd7357a3647c2c0a10c1600355c444abc60c6196bbeae02094d293fa3b0cf2d25b474d5a409855913f03a3dbccacf5c8e325db4e7bd39327e60b03fd480764ec4d60408f7f524d125d9c950d93618ad0d17efb9561b7733cee6bc94b38e08b926e836a000c9a4968a29c9b7039f32d26938a1f72c180681f5b0653d4f8bbfe33677a0b6a5d35d546350cc77c142717b7a2b042c960273013dc8312339021f28daedd028b8abe69ac5cfde77b81adb4cf8bc65ea89fa93c41b500204b763ceac502723aacaa2cd3f84e7e1d51c79e63d284c4956ffc05875b061b67f2349c4535e31d88d7b61d6036f9236b5c7653ea3f1383fff4408a68567a0978be34d80e2cb32de97327aab6a43175c695c7251577f497bb8988c2b7dea71eaf2afe35f41b87344133f2f0d117f6d2407e81d84217ed8d5972ccce7e5e7adbba5dfc091cb06c7b229e0d367bb4e0f3faf6a7f1abc7f349df45a0e78b8b66cf6c448fe678963979e58b8d487d5bb4e9f794d1ae2ecc47aac83c8fd908c483d3048454f5fffd52c9cb508953b59bfce9bdc2c0eff1ac0407d76211569c9016a7619960040d0332e5a4147e9659930144be83cf43c0423a3b52c62c98db61abcae39912a2578103f3095b687504945779e6ebb28dc7d112973e0ff1ec3fa2c025ae633daeb3da5562deb420e42f4860b6fe48c8100010000000000005c29944c413592e542b42dc30c38d693757eba12e5233e44ea45b22fbfefa3a609b312e8f61f371841a3ef2cbfd75ba3544db5333be71137d66996e33a0c1a8ecbc442779a7729225d67eb31063920fa9d828a1657193c632f2201887c0c3d6641f9b0ae596015cd7a5793b5aed43b1dce19c4cd6d2c208d4923ea29b1091666d69022e48e43191d4707a03950518d4d57a37d827bec1215acee3132e0837242c8b9b96f0d705ca25cc4f1c448746b45e78ea3cabb504fafae4de723e8b05dbf1c337feda8ff7644ad62ec5a43b6f6076017e0e374b2d9c4fc8fb1b2365daebd0946f9aab5edfa7a0c13f4b1e019b45c72264af97a1b29a5566669a982c4edb51080bdb82fa9e6aca94398409bd6048f2e21f873c3f94f6d323b7092ae9532695890cfbd179c870df13b6dd6da8a9271e58d9af4bd13981d5569ef3983be97b31805ae6bb35f31d68a359b6e70b66ef1923b57792c61dd67c64ea02b314b41c67f052222a23b67bc45fa54df1faf86e9d084110d18b5d36725faa10f6d4760679ab98bafc01c107fce01972f3cf139247856fd46ec7661ad3ec5e076d07d1d75333e5039285aada4e1b3b6e45cc157d9fd16c8f91f78f0775edcf88fb8a382e4fe9efa9a8e034fb73911e5867ca085e494d7811f66f519593172dd99dd0cb48694a83ff3e916c8149587e1fbf995cc537128022f1d257390c112101c69768a94c4eacaad534e409408a06b9d22b0cde74e6dfea0914648dea6ad552375e6437aa128641d83b39e086d2bd2c5638a0264e0b7d9a8556b1290f5dbf1ed835bfabf1d24c5cddaa89f111e5040e09a80fba8b9c7194acb1a268798aebf471f1cf312ac6407deb7453a170846e0805201f82a14cfc355909ce36d072c4fcd140a152660e6c9eab5b450ecc697d253e7e864e5d23c577f04e8bacd97be1699be152af7e6b0f077bbf7bd54a85364bddcc7e23b32f1992898d3aec5225934466acef291a764f4c051fec26c67c6af9198db233a969092075c74b6bc0f6390126161d2ab2deb6b5a0b29112bd0fd3ed0ad27f5049dd1da81bba3d0382205e38458bd87909ce6934717acc93e4b1162c0cab65ead7c744789c986ce2d3d0717b04b859d272b05630600a8262b53588619200597f5b1fed62126caac48bd5a254dd1767fb444fa6c351b7bb60b0a10049744e9c5a442e1127bdd5a655740c837ec8ade183c4490cba978ec139a4a91fd2d795b8c86c0429771374714f72ea5cded718d6fce049e61353a1e36d82a1ac46d237efa4ea91f7e7d03ba63bb9f26c8a8de1c84d35588ab48113f4033faf99b7e5f0db5552831f2b7f7c01ae0f6e3ba2003d71cc15be17783f91de4bbded72d9c6c646f01ffeec45c5b0a89712c84d72e5f9a73537787c9b77fb271fda886c43e502741497caa08e08d4a7a4a532aaae2b160ddda605f28b37ed26cc9579bf65ae335b616493f697845b5a763cd4f6019f9db9be5291dfa2c1da108ee94322070e2bd63370437b9e99aa8fd37570d59bfddf2c2e55cf1f2c038efde41d09e561fe29dc9f1dc4629895b8f0c781d1b2d6e0dce7e898e0c8f65c91eee6ef8ac655a9d57c567a943305cefc1cbb947a0b57314bdd62eae245f1a24d5508223006a307874f15086dd47b6a14daf2bb31c0848c81e3e17736fec5825a2cc820cdf076328d9c53d9b6fd2766338c7d8e2b940bb9a531f61ba3010a9fd31d72226d7640c22fb0130911f37081fdc8aece82da442a7818bd0e8c8d97a10abf75009fed8be17c47f458f00"/4100], 0x1004) sendfile(r0, r1, 0x0, 0x8400fffffffa) close(0xffffffffffffffff) 07:15:14 executing program 4: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16002, 0x540000}]) 07:15:14 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00l\x00\x00\x00', 0xfffffffffffffffe) 07:15:14 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x100, 0x0}) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x28000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_config_ext={0x5, 0x8}, 0x4000, 0x0, 0x9, 0x7, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000001440)) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r1, 0xd000943e, 0x0) clone(0x40808000, 0x0, 0x0, 0x0, 0x0) r2 = gettid() tkill(r2, 0x1e) r3 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r3, 0x0) ptrace$cont(0x18, 0x0, 0x0, 0x1) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ptrace$cont(0x7, 0x0, 0x0, 0x10001) openat$full(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x2, 0x80, 0x4, 0x4, 0xe0, 0xb, 0x0, 0x0, 0x8000, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x8004, 0x2, @perf_bp={0x0}, 0x4000, 0x8000, 0xfffffff9, 0x7, 0x80000001, 0x8, 0x0, 0x0, 0xa, 0x0, 0x100000000}, r2, 0x8, 0xffffffffffffffff, 0x6ee4ca8bd5713173) 07:15:14 executing program 3: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000, 0x0, 0x0, 0x4000}]) 07:15:14 executing program 1: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000180)='./file1\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="20000000360000001900000060008f000ff68f01000000000006000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}], 0x0, &(0x7f0000000140)={[{@jqfmt_vfsv0}]}) [ 984.172121][ T9307] loop3: detected capacity change from 0 to 16 [ 984.186030][ T9311] loop1: detected capacity change from 0 to 4 07:15:14 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00t\x00\x00\x00', 0xfffffffffffffffe) [ 984.215810][ T9311] EXT4-fs (loop1): Invalid log block size: 1536 [ 984.237097][ T9307] attempt to access beyond end of device [ 984.237097][ T9307] loop3: rw=34817, want=184, limit=16 [ 984.260099][ T9329] loop4: detected capacity change from 0 to 16 07:15:14 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00z\x00\x00\x00', 0xfffffffffffffffe) 07:15:14 executing program 3: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000, 0x0, 0x0, 0x5400}]) 07:15:14 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x100, 0x0}) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x28000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_config_ext={0x5, 0x8}, 0x4000, 0x0, 0x9, 0x7, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000001440)) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r1, 0xd000943e, 0x0) clone(0x40808000, 0x0, 0x0, 0x0, 0x0) r2 = gettid() tkill(r2, 0x1e) r3 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r3, 0x0) ptrace$cont(0x18, 0x0, 0x0, 0x1) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ptrace$cont(0x7, 0x0, 0x0, 0x10001) openat$full(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x2, 0x80, 0x4, 0x4, 0xe0, 0xb, 0x0, 0x0, 0x8000, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x8004, 0x2, @perf_bp={0x0}, 0x4000, 0x8000, 0xfffffff9, 0x7, 0x80000001, 0x8, 0x0, 0x0, 0xa, 0x0, 0x100000000}, r2, 0x8, 0xffffffffffffffff, 0x6ee4ca8bd5713173) [ 984.303116][ T9311] loop1: detected capacity change from 0 to 4 [ 984.326606][ T9311] EXT4-fs (loop1): Invalid log block size: 1536 07:15:14 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\x03\x00\x00', 0xfffffffffffffffe) 07:15:14 executing program 1: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000180)='./file1\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="20000000360000001900000060008f000ff68f01000000000406000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}], 0x0, &(0x7f0000000140)={[{@jqfmt_vfsv0}]}) [ 984.426741][ T9361] loop3: detected capacity change from 0 to 16 [ 984.469055][ T9361] attempt to access beyond end of device [ 984.469055][ T9361] loop3: rw=34817, want=184, limit=16 [ 984.488742][ T9369] loop1: detected capacity change from 0 to 4 [ 984.517723][ T9369] EXT4-fs (loop1): Invalid log block size: 1540 [ 984.561495][ T9369] loop1: detected capacity change from 0 to 4 [ 984.583064][ T9369] EXT4-fs (loop1): Invalid log block size: 1540 07:15:15 executing program 0: syz_mount_image$vfat(&(0x7f00000002c0), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f0000010000)="601c6d6b646f736617e43c00088020000200000004f8000020004000000000000000000001", 0x25}, {0x0, 0x0, 0x200000000011000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6900) ftruncate(r0, 0x800) lseek(r0, 0x1200, 0x0) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) getsockopt$inet_buf(0xffffffffffffffff, 0x0, 0x50, &(0x7f0000001280)=""/4068, &(0x7f0000000040)=0xfe4) fallocate(0xffffffffffffffff, 0x20, 0x1000, 0xcd) sendfile(0xffffffffffffffff, r1, 0x0, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @private2}, 0x1c) sendfile(r0, r1, 0x0, 0x108d1521) r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_FEATURES_SET(r2, 0x0, 0x20000041) ioctl$sock_ipv6_tunnel_SIOCCHGPRL(0xffffffffffffffff, 0x89f7, &(0x7f00000001c0)={'ip6tnl0\x00', 0x0}) sendmsg$ETHTOOL_MSG_LINKINFO_GET(0xffffffffffffffff, 0x0, 0x0) sendfile(0xffffffffffffffff, r1, 0x0, 0x8400fffffffc) close(0xffffffffffffffff) 07:15:15 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\x05\x00\x00', 0xfffffffffffffffe) 07:15:15 executing program 4: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16002, 0x800000}]) 07:15:15 executing program 3: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000, 0x0, 0x0, 0x60ff}]) 07:15:15 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x100, 0x0}) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x28000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_config_ext={0x5, 0x8}, 0x4000, 0x0, 0x9, 0x7, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000001440)) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r1, 0xd000943e, 0x0) clone(0x40808000, 0x0, 0x0, 0x0, 0x0) r2 = gettid() tkill(r2, 0x1e) r3 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r3, 0x0) ptrace$cont(0x18, 0x0, 0x0, 0x1) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ptrace$cont(0x7, 0x0, 0x0, 0x10001) openat$full(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x2, 0x80, 0x4, 0x4, 0xe0, 0xb, 0x0, 0x0, 0x8000, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x8004, 0x2, @perf_bp={0x0}, 0x4000, 0x8000, 0xfffffff9, 0x7, 0x80000001, 0x8, 0x0, 0x0, 0xa, 0x0, 0x100000000}, r2, 0x8, 0xffffffffffffffff, 0x6ee4ca8bd5713173) 07:15:15 executing program 1: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000180)='./file1\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="20000000360000001900000060008f000ff68f01000000000007000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}], 0x0, &(0x7f0000000140)={[{@jqfmt_vfsv0}]}) 07:15:15 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\x06\x00\x00', 0xfffffffffffffffe) [ 985.164267][ T9399] loop3: detected capacity change from 0 to 16 [ 985.180290][ T9402] loop1: detected capacity change from 0 to 4 07:15:15 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\a\x00\x00', 0xfffffffffffffffe) [ 985.214296][ T9402] EXT4-fs (loop1): Invalid log block size: 1792 07:15:15 executing program 3: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000, 0x0, 0x0, 0x8008}]) 07:15:15 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\t\x00\x00', 0xfffffffffffffffe) [ 985.284776][ T9402] loop1: detected capacity change from 0 to 4 [ 985.300226][ T9402] EXT4-fs (loop1): Invalid log block size: 1792 07:15:15 executing program 1: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000180)='./file1\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="20000000360000001900000060008f000ff68f01000000000008000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}], 0x0, &(0x7f0000000140)={[{@jqfmt_vfsv0}]}) 07:15:15 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\n\x00\x00', 0xfffffffffffffffe) [ 985.383545][ T9444] loop3: detected capacity change from 0 to 16 [ 985.448299][ T9444] attempt to access beyond end of device [ 985.448299][ T9444] loop3: rw=34817, want=184, limit=16 [ 985.454686][ T9452] loop1: detected capacity change from 0 to 4 [ 985.474179][ T9457] loop4: detected capacity change from 0 to 16 [ 985.534922][ T9452] EXT4-fs (loop1): Invalid log block size: 2048 [ 985.603276][ T9452] loop1: detected capacity change from 0 to 4 [ 985.616165][ T9452] EXT4-fs (loop1): Invalid log block size: 2048 07:15:16 executing program 0: syz_mount_image$vfat(&(0x7f00000002c0), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f736617e43c00088020000200000004f8000020004000000000000000000001", 0x25}, {0x0, 0x0, 0x200000000011000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6900) ftruncate(r0, 0x800) lseek(r0, 0x1200, 0x0) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, r1, 0x0, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @private2}, 0x1c) sendfile(r0, r1, 0x0, 0x108d1521) r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_FEATURES_SET(r2, 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHGPRL(0xffffffffffffffff, 0x89f7, &(0x7f00000001c0)={'ip6tnl0\x00', 0x0}) sendmsg$ETHTOOL_MSG_LINKINFO_GET(0xffffffffffffffff, 0x0, 0x0) sendfile(r0, r1, 0x0, 0x8400fffffffa) close(0xffffffffffffffff) 07:15:16 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x100, 0x0}) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x28000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_config_ext={0x5, 0x8}, 0x4000, 0x0, 0x9, 0x7, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000001440)) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r1, 0xd000943e, 0x0) clone(0x40808000, 0x0, 0x0, 0x0, 0x0) r2 = gettid() tkill(r2, 0x1e) r3 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r3, 0x0) ptrace$cont(0x18, 0x0, 0x0, 0x1) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ptrace$cont(0x7, 0x0, 0x0, 0x10001) openat$full(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x2, 0x80, 0x4, 0x4, 0xe0, 0xb, 0x0, 0x0, 0x8000, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x8004, 0x2, @perf_bp={0x0}, 0x4000, 0x8000, 0xfffffff9, 0x7, 0x80000001, 0x8, 0x0, 0x0, 0xa, 0x0, 0x100000000}, r2, 0x8, 0xffffffffffffffff, 0x6ee4ca8bd5713173) 07:15:16 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\v\x00\x00', 0xfffffffffffffffe) 07:15:16 executing program 3: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000, 0x0, 0x0, 0x9700}]) 07:15:16 executing program 1: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000180)='./file1\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="20000000360000001900000060008f000ff68f01000000000009000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}], 0x0, &(0x7f0000000140)={[{@jqfmt_vfsv0}]}) 07:15:16 executing program 4: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16002, 0x970000}]) [ 986.101737][ T9487] loop3: detected capacity change from 0 to 16 [ 986.109989][ C1] scsi_io_completion_action: 3 callbacks suppressed [ 986.110015][ C1] sd 0:0:1:0: [sg0] tag#5686 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 986.110330][ T9489] loop1: detected capacity change from 0 to 4 [ 986.116649][ C1] sd 0:0:1:0: [sg0] tag#5686 CDB: opcode=0xe5 (vendor) [ 986.140128][ C1] sd 0:0:1:0: [sg0] tag#5686 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c 07:15:16 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\f\x00\x00', 0xfffffffffffffffe) [ 986.149757][ C1] sd 0:0:1:0: [sg0] tag#5686 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 986.154070][ T9495] loop4: detected capacity change from 0 to 16 [ 986.159308][ C1] sd 0:0:1:0: [sg0] tag#5686 CDB[20]: ba [ 986.169965][ T9489] EXT4-fs (loop1): Invalid log block size: 2304 07:15:16 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\r\x00\x00', 0xfffffffffffffffe) 07:15:16 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x100, 0x0}) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x28000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_config_ext={0x5, 0x8}, 0x4000, 0x0, 0x9, 0x7, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000001440)) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r1, 0xd000943e, 0x0) clone(0x40808000, 0x0, 0x0, 0x0, 0x0) r2 = gettid() tkill(r2, 0x1e) r3 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r3, 0x0) ptrace$cont(0x18, 0x0, 0x0, 0x1) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ptrace$cont(0x7, 0x0, 0x0, 0x10001) openat$full(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x2, 0x80, 0x4, 0x4, 0xe0, 0xb, 0x0, 0x0, 0x8000, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8004, 0x2, @perf_bp={0x0}, 0x4000, 0x8000, 0xfffffff9, 0x7, 0x80000001, 0x8, 0x0, 0x0, 0xa, 0x0, 0x100000000}, r2, 0x8, 0xffffffffffffffff, 0x6ee4ca8bd5713173) 07:15:16 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\x0e\x00\x00', 0xfffffffffffffffe) 07:15:16 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\x0f\x00\x00', 0xfffffffffffffffe) [ 986.294408][ C1] sd 0:0:1:0: [sg0] tag#5664 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 986.305242][ C1] sd 0:0:1:0: [sg0] tag#5664 CDB: opcode=0xe5 (vendor) [ 986.312123][ C1] sd 0:0:1:0: [sg0] tag#5664 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 986.321695][ C1] sd 0:0:1:0: [sg0] tag#5664 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 986.331248][ C1] sd 0:0:1:0: [sg0] tag#5664 CDB[20]: ba 07:15:16 executing program 1: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000180)='./file1\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="20000000360000001900000060008f000ff68f0100000000000a000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}], 0x0, &(0x7f0000000140)={[{@jqfmt_vfsv0}]}) [ 986.430061][ T9546] loop1: detected capacity change from 0 to 4 [ 986.453797][ T9546] EXT4-fs (loop1): Invalid log block size: 2560 [ 986.514667][ T9546] loop1: detected capacity change from 0 to 4 [ 986.531695][ T9546] EXT4-fs (loop1): Invalid log block size: 2560 07:15:17 executing program 0: r0 = syz_mount_image$vfat(&(0x7f00000002c0), &(0x7f0000000180)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f736617e43c00088020000200000004f8000020004000000000000000000001", 0x25}, {0x0, 0x0, 0x200000000011000}], 0x1100000, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r1 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) fcntl$setstatus(r1, 0x4, 0x6900) ftruncate(r1, 0x800) lseek(0xffffffffffffffff, 0x5, 0x3) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, 0x0, 0x0) r2 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) io_submit(0x0, 0x2, &(0x7f00000003c0)=[&(0x7f0000000140)={0x0, 0x0, 0x0, 0x7, 0x400, 0xffffffffffffffff, &(0x7f0000000300)="05988c80c4cd7f370bc80dbbcb77bb24a2e59d9b5be43772f6aec8b4ba48bad689af81282b40afbc5ba40d04555c756cb010a6a9ca63410de68bc7184f726dbbd8d6fa18e28a43a4d7e325027c7c174d2dd6bbf1fac89e127f0a2e8790bff7c4e87bf55a6842abaa1aebb2e5f5f22a699c3c9f151c9f9ace114e1283d5ba7cae06c1dad2f48ea6db9b83bdd140f7a7d2bed345b3d8eac14c1939c7e215be6fa677f16cd62a", 0xa5, 0x80000000, 0x0, 0x1}, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x6, 0x400, 0xffffffffffffffff, &(0x7f0000000240)="98", 0x1, 0x100000001, 0x0, 0x2, r2}]) sendfile(0xffffffffffffffff, r2, 0x0, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @private2}, 0x1c) sendfile(r1, r2, 0x0, 0x108d1521) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000080)=0x80) sendmsg$ETHTOOL_MSG_FEATURES_SET(r3, 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHGPRL(0xffffffffffffffff, 0x89f7, &(0x7f00000001c0)={'ip6tnl0\x00', 0x0}) sendmsg$ETHTOOL_MSG_LINKINFO_GET(0xffffffffffffffff, 0x0, 0x0) sendfile(r1, r2, 0x0, 0x8400fffffffa) close(0xffffffffffffffff) 07:15:17 executing program 3: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000, 0x0, 0x0, 0xb000}]) 07:15:17 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x100, 0x0}) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x28000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_config_ext={0x5, 0x8}, 0x4000, 0x0, 0x9, 0x7, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000001440)) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r1, 0xd000943e, 0x0) clone(0x40808000, 0x0, 0x0, 0x0, 0x0) r2 = gettid() tkill(r2, 0x1e) r3 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r3, 0x0) ptrace$cont(0x18, 0x0, 0x0, 0x1) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ptrace$cont(0x7, 0x0, 0x0, 0x10001) openat$full(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x2, 0x80, 0x4, 0x4, 0xe0, 0xb, 0x0, 0x0, 0x8000, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8004, 0x2, @perf_bp={0x0}, 0x4000, 0x8000, 0xfffffff9, 0x7, 0x80000001, 0x8, 0x0, 0x0, 0xa, 0x0, 0x100000000}, r2, 0x8, 0xffffffffffffffff, 0x6ee4ca8bd5713173) 07:15:17 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\x11\x00\x00', 0xfffffffffffffffe) 07:15:17 executing program 4: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16002, 0xc04a01}]) 07:15:17 executing program 1: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000180)='./file1\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="20000000360000001900000060008f000ff68f0100000000050a000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}], 0x0, &(0x7f0000000140)={[{@jqfmt_vfsv0}]}) [ 987.086035][ T9569] loop3: detected capacity change from 0 to 16 [ 987.092843][ C0] sd 0:0:1:0: [sg0] tag#5672 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 987.098164][ T9571] loop1: detected capacity change from 0 to 4 [ 987.103229][ C0] sd 0:0:1:0: [sg0] tag#5672 CDB: opcode=0xe5 (vendor) [ 987.116125][ C0] sd 0:0:1:0: [sg0] tag#5672 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 987.118675][ T9571] EXT4-fs (loop1): Invalid log block size: 2565 07:15:17 executing program 0: syz_mount_image$vfat(&(0x7f00000002c0), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f736617e43c00088020000200000004f8000020004000000000000000000001", 0x25}, {0x0, 0x0, 0x200000000011000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6900) ftruncate(r0, 0x800) lseek(r0, 0x1200, 0x0) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, r1, 0x0, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @private2}, 0x1c) sendfile(r0, r1, 0x0, 0x108d1521) r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_FEATURES_SET(r2, 0x0, 0x0) close(r2) ioctl$sock_ipv6_tunnel_SIOCCHGPRL(0xffffffffffffffff, 0x89f7, &(0x7f00000001c0)={'ip6tnl0\x00', 0x0}) sendmsg$ETHTOOL_MSG_LINKINFO_GET(0xffffffffffffffff, 0x0, 0x0) sendfile(r0, r1, 0x0, 0x8400fffffffa) sendmsg$ETHTOOL_MSG_TSINFO_GET(0xffffffffffffffff, &(0x7f0000001080)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000001040)={&(0x7f0000000d40)={0x2d0, 0x0, 0x2, 0x70bd2a, 0x25dfdbfc, {}, [@HEADER={0x88, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'bond_slave_1\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ipvlan0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'lo\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_to_bridge\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'hsr0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8}]}, @HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8}]}, @HEADER={0x24, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}]}, @HEADER={0x3c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'macvlan1\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'batadv0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}]}, @HEADER={0x4c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'geneve1\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'bond0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}]}, @HEADER={0x3c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'team0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_to_hsr\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8}]}, @HEADER={0x4c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x4}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}]}, @HEADER={0x7c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ip6erspan0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth1_virt_wifi\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'geneve0\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth1\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}]}, @HEADER={0x78, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_to_bridge\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'vcan0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'gre0\x00'}]}]}, 0x2d0}, 0x1, 0x0, 0x0, 0x20004885}, 0x2040090) close(0xffffffffffffffff) [ 987.125681][ C0] sd 0:0:1:0: [sg0] tag#5672 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 987.141448][ C0] sd 0:0:1:0: [sg0] tag#5672 CDB[20]: ba 07:15:17 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\x12\x00\x00', 0xfffffffffffffffe) [ 987.180706][ T9583] loop4: detected capacity change from 0 to 16 [ 987.219968][ T9569] attempt to access beyond end of device [ 987.219968][ T9569] loop3: rw=34817, want=184, limit=16 07:15:17 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00H\x00\x00', 0xfffffffffffffffe) [ 987.239905][ T9571] loop1: detected capacity change from 0 to 4 [ 987.256493][ T9571] EXT4-fs (loop1): Invalid log block size: 2565 07:15:17 executing program 1: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000180)='./file1\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="20000000360000001900000060008f000ff68f0100000000000b000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}], 0x0, &(0x7f0000000140)={[{@jqfmt_vfsv0}]}) 07:15:17 executing program 3: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000, 0x0, 0x0, 0xeffd}]) 07:15:17 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x100, 0x0}) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x28000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_config_ext={0x5, 0x8}, 0x4000, 0x0, 0x9, 0x7, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000001440)) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r1, 0xd000943e, 0x0) clone(0x40808000, 0x0, 0x0, 0x0, 0x0) r2 = gettid() tkill(r2, 0x1e) r3 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r3, 0x0) ptrace$cont(0x18, 0x0, 0x0, 0x1) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ptrace$cont(0x7, 0x0, 0x0, 0x10001) openat$full(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x2, 0x80, 0x4, 0x4, 0xe0, 0xb, 0x0, 0x0, 0x8000, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8004, 0x2, @perf_bp={0x0}, 0x4000, 0x8000, 0xfffffff9, 0x7, 0x80000001, 0x8, 0x0, 0x0, 0xa, 0x0, 0x100000000}, r2, 0x8, 0xffffffffffffffff, 0x6ee4ca8bd5713173) [ 987.341544][ T9613] loop1: detected capacity change from 0 to 4 [ 987.367599][ T9613] EXT4-fs (loop1): Invalid log block size: 2816 07:15:17 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00L\x00\x00', 0xfffffffffffffffe) [ 987.388371][ C1] sd 0:0:1:0: [sg0] tag#5694 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 987.398757][ C1] sd 0:0:1:0: [sg0] tag#5694 CDB: opcode=0xe5 (vendor) [ 987.405723][ C1] sd 0:0:1:0: [sg0] tag#5694 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 987.415300][ C1] sd 0:0:1:0: [sg0] tag#5694 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 987.424856][ C1] sd 0:0:1:0: [sg0] tag#5694 CDB[20]: ba [ 987.462048][ T9613] loop1: detected capacity change from 0 to 4 [ 987.477711][ T9613] EXT4-fs (loop1): Invalid log block size: 2816 07:15:17 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00h\x00\x00', 0xfffffffffffffffe) 07:15:17 executing program 1: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000180)='./file1\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="20000000360000001900000060008f000ff68f0100000000050b000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}], 0x0, &(0x7f0000000140)={[{@jqfmt_vfsv0}]}) [ 987.504358][ T9636] loop3: detected capacity change from 0 to 16 07:15:17 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00l\x00\x00', 0xfffffffffffffffe) [ 987.592380][ T9655] loop1: detected capacity change from 0 to 4 07:15:17 executing program 4: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16002, 0xc04f00}]) 07:15:17 executing program 3: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000, 0x0, 0x0, 0xefff}]) [ 987.656679][ T9655] EXT4-fs (loop1): Invalid log block size: 2821 [ 987.713018][ T9655] loop1: detected capacity change from 0 to 4 [ 987.730338][ T9655] EXT4-fs (loop1): Invalid log block size: 2821 [ 987.745706][ T9674] loop3: detected capacity change from 0 to 16 [ 987.819689][ T9687] loop4: detected capacity change from 0 to 16 07:15:18 executing program 0: syz_mount_image$vfat(&(0x7f00000002c0), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f736617e43c00088020000200000004f8000020004000000000000000000001", 0x25}, {0x0, 0x0, 0x200000000011000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6900) ftruncate(r0, 0x800) lseek(r0, 0x1200, 0x0) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, r1, 0x0, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @private2}, 0x1c) sendfile(r0, r1, 0x0, 0x108d1521) r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_FEATURES_SET(r2, 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHGPRL(0xffffffffffffffff, 0x89f7, &(0x7f00000001c0)={'ip6tnl0\x00', 0x0}) sendmsg$ETHTOOL_MSG_LINKINFO_GET(0xffffffffffffffff, 0x0, 0x0) recvmsg(r2, &(0x7f0000001580)={&(0x7f0000000140)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @private}}}, 0x80, &(0x7f0000001440)=[{&(0x7f0000000240)=""/90, 0x5a}, {&(0x7f0000000300)=""/213, 0xd5}, {&(0x7f0000000400)=""/4096, 0x1000}, {&(0x7f0000000080)=""/49, 0x31}, {&(0x7f0000001400)=""/15, 0xf}], 0x5, &(0x7f00000014c0)=""/161, 0xa1}, 0x2000) sendfile(r0, r1, 0x0, 0x8400fffffffa) close(0xffffffffffffffff) 07:15:18 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00t\x00\x00', 0xfffffffffffffffe) 07:15:18 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x100, 0x0}) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x28000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_config_ext={0x5, 0x8}, 0x4000, 0x0, 0x9, 0x7, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000001440)) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r1, 0xd000943e, 0x0) clone(0x40808000, 0x0, 0x0, 0x0, 0x0) r2 = gettid() tkill(r2, 0x1e) r3 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r3, 0x0) ptrace$cont(0x18, 0x0, 0x0, 0x1) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ptrace$cont(0x7, 0x0, 0x0, 0x10001) openat$full(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x2, 0x80, 0x4, 0x4, 0xe0, 0xb, 0x0, 0x0, 0x8000, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x2, @perf_bp={0x0}, 0x4000, 0x8000, 0xfffffff9, 0x7, 0x80000001, 0x8, 0x0, 0x0, 0xa, 0x0, 0x100000000}, r2, 0x8, 0xffffffffffffffff, 0x6ee4ca8bd5713173) 07:15:18 executing program 1: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000180)='./file1\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="20000000360000001900000060008f000ff68f0100000000000c000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}], 0x0, &(0x7f0000000140)={[{@jqfmt_vfsv0}]}) 07:15:18 executing program 3: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000, 0x0, 0x0, 0xf2ff}]) 07:15:18 executing program 4: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16002, 0xf04a00}]) [ 988.081880][ C1] sd 0:0:1:0: [sg0] tag#5648 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 988.090434][ T9709] loop1: detected capacity change from 0 to 4 [ 988.092253][ C1] sd 0:0:1:0: [sg0] tag#5648 CDB: opcode=0xe5 (vendor) [ 988.105147][ C1] sd 0:0:1:0: [sg0] tag#5648 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 988.112228][ T9706] loop3: detected capacity change from 0 to 16 [ 988.114727][ C1] sd 0:0:1:0: [sg0] tag#5648 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d 07:15:18 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00z\x00\x00', 0xfffffffffffffffe) [ 988.130376][ C1] sd 0:0:1:0: [sg0] tag#5648 CDB[20]: ba [ 988.155864][ T9709] EXT4-fs (loop1): Invalid log block size: 3072 07:15:18 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\xff\xff\xfe\x00', 0xfffffffffffffffe) 07:15:18 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x100, 0x0}) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x28000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_config_ext={0x5, 0x8}, 0x4000, 0x0, 0x9, 0x7, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000001440)) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r1, 0xd000943e, 0x0) clone(0x40808000, 0x0, 0x0, 0x0, 0x0) r2 = gettid() tkill(r2, 0x1e) r3 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r3, 0x0) ptrace$cont(0x18, 0x0, 0x0, 0x1) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ptrace$cont(0x7, 0x0, 0x0, 0x10001) openat$full(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x2, 0x80, 0x4, 0x4, 0xe0, 0xb, 0x0, 0x0, 0x8000, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x2, @perf_bp={0x0}, 0x4000, 0x8000, 0xfffffff9, 0x7, 0x80000001, 0x8, 0x0, 0x0, 0xa, 0x0, 0x100000000}, r2, 0x8, 0xffffffffffffffff, 0x6ee4ca8bd5713173) [ 988.203317][ T9709] loop1: detected capacity change from 0 to 4 [ 988.220442][ T9709] EXT4-fs (loop1): Invalid log block size: 3072 07:15:18 executing program 1: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000180)='./file1\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="20000000360000001900000060008f000ff68f0100000000000d000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}], 0x0, &(0x7f0000000140)={[{@jqfmt_vfsv0}]}) 07:15:18 executing program 3: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000, 0x0, 0x0, 0xf700}]) [ 988.256399][ C0] sd 0:0:1:0: [sg0] tag#5641 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 988.267379][ C0] sd 0:0:1:0: [sg0] tag#5641 CDB: opcode=0xe5 (vendor) [ 988.274250][ C0] sd 0:0:1:0: [sg0] tag#5641 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 988.283856][ C0] sd 0:0:1:0: [sg0] tag#5641 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 988.284022][ T9742] loop4: detected capacity change from 0 to 16 [ 988.293426][ C0] sd 0:0:1:0: [sg0] tag#5641 CDB[20]: ba 07:15:18 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0xfffffffffffffffe) [ 988.352502][ T9748] loop1: detected capacity change from 0 to 4 [ 988.398495][ T9748] EXT4-fs (loop1): Invalid log block size: 3328 [ 988.405512][ T9766] loop3: detected capacity change from 0 to 16 [ 988.455414][ T9766] attempt to access beyond end of device [ 988.455414][ T9766] loop3: rw=34817, want=184, limit=16 [ 988.472291][ T9748] loop1: detected capacity change from 0 to 4 [ 988.487282][ T9748] EXT4-fs (loop1): Invalid log block size: 3328 07:15:19 executing program 0: syz_mount_image$vfat(&(0x7f00000002c0), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f736617e43c00088020000200000004f8000020004000000000000000000001", 0x25}, {0x0, 0x0, 0x200000000011000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6900) ftruncate(r0, 0x800) lseek(r0, 0x8000, 0x4) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) preadv(r1, &(0x7f0000000140)=[{&(0x7f0000000300)=""/217, 0xd9}], 0x1, 0x7, 0x1642) r2 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, r2, 0x0, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @private2}, 0x1c) sendfile(r0, r2, 0x0, 0x108d1521) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(0x0, r0) sendmsg$ETHTOOL_MSG_FEATURES_SET(r3, 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHGPRL(0xffffffffffffffff, 0x89f7, &(0x7f00000001c0)={'ip6_vti0\x00', 0x0}) sendmsg$ETHTOOL_MSG_LINKINFO_GET(0xffffffffffffffff, 0x0, 0x0) sendfile(r0, r2, 0x0, 0x8400fffffffa) close(0xffffffffffffffff) 07:15:19 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0xfffffffffffffffe) 07:15:19 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x100, 0x0}) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x28000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_config_ext={0x5, 0x8}, 0x4000, 0x0, 0x9, 0x7, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000001440)) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r1, 0xd000943e, 0x0) clone(0x40808000, 0x0, 0x0, 0x0, 0x0) r2 = gettid() tkill(r2, 0x1e) r3 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r3, 0x0) ptrace$cont(0x18, 0x0, 0x0, 0x1) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ptrace$cont(0x7, 0x0, 0x0, 0x10001) openat$full(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x2, 0x80, 0x4, 0x4, 0xe0, 0xb, 0x0, 0x0, 0x8000, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x2, @perf_bp={0x0}, 0x4000, 0x8000, 0xfffffff9, 0x7, 0x80000001, 0x8, 0x0, 0x0, 0xa, 0x0, 0x100000000}, r2, 0x8, 0xffffffffffffffff, 0x6ee4ca8bd5713173) 07:15:19 executing program 1: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000180)='./file1\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="20000000360000001900000060008f000ff68f0100000000000e000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}], 0x0, &(0x7f0000000140)={[{@jqfmt_vfsv0}]}) 07:15:19 executing program 3: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000, 0x0, 0x0, 0xf800}]) 07:15:19 executing program 4: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16002, 0x1000000}]) [ 989.085202][ C0] sd 0:0:1:0: [sg0] tag#5692 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 989.090127][ T9800] loop1: detected capacity change from 0 to 4 [ 989.098192][ C0] sd 0:0:1:0: [sg0] tag#5692 CDB: opcode=0xe5 (vendor) [ 989.107053][ T9802] loop3: detected capacity change from 0 to 16 [ 989.111090][ C0] sd 0:0:1:0: [sg0] tag#5692 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c 07:15:19 executing program 0: syz_mount_image$vfat(&(0x7f00000002c0), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f736617e43c00088020000200000004f8000020004000000000000000000001", 0x25}, {0x0, 0x0, 0x200000000011000}], 0x180008, &(0x7f0000000840)=ANY=[@ANYRES16=0x0, @ANYRES16, @ANYRESOCT, @ANYRESOCT, @ANYRESOCT, @ANYRES16]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6900) ftruncate(r0, 0x800) lseek(r0, 0x1200, 0x0) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, r1, 0x0, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @private2}, 0x1c) sendfile(r0, r1, 0x0, 0x108d1521) r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_FEATURES_SET(r2, 0x0, 0x0) setsockopt$IP6T_SO_SET_ADD_COUNTERS(r0, 0x29, 0x41, &(0x7f0000000140)={'nat\x00', 0x4, [{}, {}, {}, {}]}, 0x68) ioctl$sock_ipv6_tunnel_SIOCCHGPRL(0xffffffffffffffff, 0x89f7, &(0x7f00000001c0)={'ip6tnl0\x00', 0x0}) sendmmsg$inet(r1, &(0x7f00000008c0)=[{{&(0x7f0000000080)={0x2, 0x4e22, @dev={0xac, 0x14, 0x14, 0x15}}, 0x10, &(0x7f00000004c0)=[{&(0x7f0000000300)="3414fe5537dd6722020e2667efa37c04a55f42fdb1e705aaebca0ba2009908e0904a10fff7d41519bf873010129e6267c5a555fa0bf5b40dd35f3930506ac04450830271eea26e92d0375b14994d83ae102298335ad6992daaf1f2eb838ec16d04945080af91795eeaca2507b48f6ef820e56375266205b4d89c657275fc5ebbf2b57ebeba4b490c53cc1cc9e737f7027455df93ff43bc809128baf46fc14006e28dc70b4503188054c777a394", 0xad}, {&(0x7f0000000240)="a544b67a4d0e1939947c6a2e417dc44d3d31214fd33c0e505f92263ba30918c34cdf7087c06bfd426a4eab58ef23309c8d85b5275895d916eccaa52d35a5d3b056b49995b785f2564fd6e645495222dd906dba1c68163561d5a6", 0x5a}, {&(0x7f00000003c0)="3c551e2d33960ca91bed378602cf0f0eca76c370249df0ab152c7c1c64edc5c7153133dc8875f60dd10d72704272a512250f81a3c5fe981bb35e2bb4cc52b255d6c6b0a85ffc3e39918621af6e15e2ef8da7e4f044892fe4c10bc011a487e59fe753debb8343b78a046a37ae8ccafd03b67417cbffccc9d28ad775974f262993b3986770e7a68451f5493242c6b54fcedeb5835fdf9605f2467d583929ca5cfcdd797f8a89af27487edc8145dd5e89e3e7418b2686f37dd6745014521b5c75090a75a1ea521ac9238b81c2bd5d2af7a89f09f1e179fdd0f93019bc6775", 0xdd}], 0x3, &(0x7f0000000500)=ANY=[@ANYBLOB="4400000000000000000000000700000044c8e893ffffffff000000037f00000100000001e0000001000000008317e3ac1e000107000000e000000100000000ac14141400000000001c000000000000000000000008000000", @ANYRES32=0x0, @ANYBLOB="6401010064010100000000001c000000000000000000000008004800", @ANYRES32=0x0, @ANYBLOB="ac1e0001ac1414bb0000000020000000000000000000000007000000830f5eac1414bbffffffffac1414bb001400000000000000000000000200"/68], 0xc0}}, {{&(0x7f00000005c0)={0x2, 0x4e23, @broadcast}, 0x10, &(0x7f0000000600)}}, {{&(0x7f0000000640)={0x2, 0x4e23, @multicast1}, 0x10, &(0x7f0000000800)=[{&(0x7f0000000680)="8657c98269e2493a7353f82dcd5a977a887ea6373ca8655e9386bca97113475d727f215b2690f694c3a2839e787717896d824238ace4f4a5f146221179794a43bf3c2f62f28c7e67450e16928a3e4b91469dc83e1e759d3fc1bcf52274eb771ecce27dc742550d578453087c81fd578c79e3ee75ec20783184f8950ced3b4d83e09c458b65225ec17e0e0dca65008f5476664108dde181dc989e493c1fccd581029344adc5ffc6aa84dad8dc6efaaff9611d24bd2e5ee785289b396ee8f734d1e9ff6878555b78cf", 0xc8}, {&(0x7f0000000780)="ff303fb511400c62b6d188cd0bed2da023a965fbf9e7e1b20d9c5b34780be06b2bb18f0639f3b12393a37e24f5656d915a0d06b48a0a060b27ffbac54b1d5ee0ef01c3e45a29d0e91fb5b82366e278dd161b538b1bbd8682", 0x58}], 0x2, &(0x7f0000000980)=[@ip_ttl={{0x14, 0x0, 0x2, 0x100}}, @ip_retopts={{0x54, 0x0, 0x7, {[@lsrr={0x83, 0x23, 0x5a, [@local, @initdev={0xac, 0x1e, 0x1, 0x0}, @dev={0xac, 0x14, 0x14, 0x24}, @remote, @broadcast, @broadcast, @multicast2, @loopback]}, @ra={0x94, 0x4}, @ra={0x94, 0x4, 0x1}, @rr={0x7, 0xf, 0x34, [@local, @dev={0xac, 0x14, 0x14, 0x3d}, @private=0xa010100]}, @timestamp={0x44, 0x8, 0xdf, 0x0, 0x1, [0x3]}]}}}], 0x70}}], 0x3, 0x800) sendmsg$ETHTOOL_MSG_LINKINFO_GET(0xffffffffffffffff, 0x0, 0x0) sendfile(r0, r1, 0x0, 0x8400fffffffa) close(0xffffffffffffffff) [ 989.126759][ C0] sd 0:0:1:0: [sg0] tag#5692 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 989.136336][ C0] sd 0:0:1:0: [sg0] tag#5692 CDB[20]: ba [ 989.151632][ T9802] attempt to access beyond end of device [ 989.151632][ T9802] loop3: rw=34817, want=184, limit=16 07:15:19 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\x00\x00\x03', 0xfffffffffffffffe) [ 989.182552][ T9800] EXT4-fs (loop1): Invalid log block size: 3584 [ 989.213709][ T9819] loop4: detected capacity change from 0 to 16 07:15:19 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\x00\x00\x04', 0xfffffffffffffffe) 07:15:19 executing program 3: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000, 0x0, 0x0, 0xfdef}]) [ 989.261763][ T9800] loop1: detected capacity change from 0 to 4 [ 989.273182][ T9800] EXT4-fs (loop1): Invalid log block size: 3584 07:15:19 executing program 1: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000180)='./file1\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="20000000360000001900000060008f000ff68f0100000000000f000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}], 0x0, &(0x7f0000000140)={[{@jqfmt_vfsv0}]}) 07:15:19 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\x00\x00\x05', 0xfffffffffffffffe) 07:15:19 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x100, 0x0}) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x28000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_config_ext={0x5, 0x8}, 0x4000, 0x0, 0x9, 0x7, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000001440)) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r1, 0xd000943e, 0x0) clone(0x40808000, 0x0, 0x0, 0x0, 0x0) r2 = gettid() tkill(r2, 0x1e) r3 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r3, 0x0) ptrace$cont(0x18, 0x0, 0x0, 0x1) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ptrace$cont(0x7, 0x0, 0x0, 0x10001) openat$full(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x2, 0x80, 0x4, 0x4, 0xe0, 0xb, 0x0, 0x0, 0x8000, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x8004, 0x0, @perf_bp={0x0}, 0x4000, 0x8000, 0xfffffff9, 0x7, 0x80000001, 0x8, 0x0, 0x0, 0xa, 0x0, 0x100000000}, r2, 0x8, 0xffffffffffffffff, 0x6ee4ca8bd5713173) [ 989.393969][ T9853] loop3: detected capacity change from 0 to 16 [ 989.411197][ T9851] loop1: detected capacity change from 0 to 4 [ 989.456736][ T9851] EXT4-fs (loop1): Invalid log block size: 3840 [ 989.469872][ C0] sd 0:0:1:0: [sg0] tag#5656 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 989.480703][ C0] sd 0:0:1:0: [sg0] tag#5656 CDB: opcode=0xe5 (vendor) [ 989.487752][ C0] sd 0:0:1:0: [sg0] tag#5656 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c 07:15:19 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\x00\x00\x06', 0xfffffffffffffffe) 07:15:19 executing program 4: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16002, 0x10099b8}]) 07:15:19 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\x00\x00\a', 0xfffffffffffffffe) [ 989.497537][ C0] sd 0:0:1:0: [sg0] tag#5656 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 989.507450][ C0] sd 0:0:1:0: [sg0] tag#5656 CDB[20]: ba 07:15:19 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x100, 0x0}) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x28000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_config_ext={0x5, 0x8}, 0x4000, 0x0, 0x9, 0x7, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000001440)) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r1, 0xd000943e, 0x0) clone(0x40808000, 0x0, 0x0, 0x0, 0x0) r2 = gettid() tkill(r2, 0x1e) r3 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r3, 0x0) ptrace$cont(0x18, 0x0, 0x0, 0x1) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ptrace$cont(0x7, 0x0, 0x0, 0x10001) openat$full(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x2, 0x80, 0x4, 0x4, 0xe0, 0xb, 0x0, 0x0, 0x8000, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x8004, 0x0, @perf_bp={0x0}, 0x4000, 0x8000, 0xfffffff9, 0x7, 0x80000001, 0x8, 0x0, 0x0, 0xa, 0x0, 0x100000000}, r2, 0x8, 0xffffffffffffffff, 0x6ee4ca8bd5713173) 07:15:19 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\x00\x00\b', 0xfffffffffffffffe) [ 989.563960][ T9851] loop1: detected capacity change from 0 to 4 [ 989.575039][ T9851] EXT4-fs (loop1): Invalid log block size: 3840 [ 989.626617][ C0] sd 0:0:1:0: [sg0] tag#5665 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 989.637086][ C0] sd 0:0:1:0: [sg0] tag#5665 CDB: opcode=0xe5 (vendor) [ 989.643984][ C0] sd 0:0:1:0: [sg0] tag#5665 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 989.653564][ C0] sd 0:0:1:0: [sg0] tag#5665 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 989.663116][ C0] sd 0:0:1:0: [sg0] tag#5665 CDB[20]: ba [ 989.804344][ T9903] loop4: detected capacity change from 0 to 16 07:15:20 executing program 1: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000180)='./file1\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="20000000360000001900000060008f000ff68f01000000000010000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}], 0x0, &(0x7f0000000140)={[{@jqfmt_vfsv0}]}) 07:15:20 executing program 3: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000, 0x0, 0x0, 0xffef}]) 07:15:20 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\x00\x00\t', 0xfffffffffffffffe) 07:15:20 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x100, 0x0}) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x28000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_config_ext={0x5, 0x8}, 0x4000, 0x0, 0x9, 0x7, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000001440)) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r1, 0xd000943e, 0x0) clone(0x40808000, 0x0, 0x0, 0x0, 0x0) r2 = gettid() tkill(r2, 0x1e) r3 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r3, 0x0) ptrace$cont(0x18, 0x0, 0x0, 0x1) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ptrace$cont(0x7, 0x0, 0x0, 0x10001) openat$full(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x2, 0x80, 0x4, 0x4, 0xe0, 0xb, 0x0, 0x0, 0x8000, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x8004, 0x0, @perf_bp={0x0}, 0x4000, 0x8000, 0xfffffff9, 0x7, 0x80000001, 0x8, 0x0, 0x0, 0xa, 0x0, 0x100000000}, r2, 0x8, 0xffffffffffffffff, 0x6ee4ca8bd5713173) 07:15:20 executing program 0: syz_mount_image$vfat(&(0x7f00000002c0), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f736617e43c00088020000200000004f8000020004000000000000000000001", 0x25}, {0x0, 0x0, 0x200000000011000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6900) ftruncate(r0, 0x800) lseek(r0, 0x1200, 0x0) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) write$binfmt_elf64(0xffffffffffffffff, &(0x7f0000000300)={{0x7f, 0x45, 0x4c, 0x46, 0x1f, 0x1a, 0x7, 0x40, 0x401, 0x3, 0x3e, 0x5, 0x142, 0x40, 0x1e3, 0x3ff, 0x4, 0x38, 0x1, 0x5, 0x3, 0xf8ea}, [{0x5, 0xffff9ae4, 0x10001, 0xf60, 0x9, 0x4, 0x2, 0xa910}], "cf877f9b3b1c7703605e69187f93020d0f292570d38c90ac3ae1093eaaeb42fd283347e5cf596c7757fabce5a4e3fda529b89b1c0023b7f6756fb7a401babb8c30e3a57e0f28e72ffd9a835ba17a372e44d3a262d52e79b5bf571fefe1724fc3043cad818ced34fea5254b5a1729e8e0e29189bf9c10612c372655dc554b5de5591c725bef16ee0eac5e7a06c3f53f9c3e0f712fd072de405ef8731eca0079ce10e55512427b01", ['\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00']}, 0x81f) sendfile(0xffffffffffffffff, r1, 0x0, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @private2}, 0x1c) sendfile(r0, r1, 0x0, 0x108d1521) r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_FEATURES_SET(r2, 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHGPRL(0xffffffffffffffff, 0x89f7, &(0x7f00000001c0)={'ip6tnl0\x00', 0x0}) sendmsg$ETHTOOL_MSG_LINKINFO_GET(0xffffffffffffffff, 0x0, 0x0) sendfile(r0, r1, 0x0, 0x8400fffffffa) close(0xffffffffffffffff) 07:15:20 executing program 4: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16002, 0x14ac000}]) [ 990.183688][ T9919] loop3: detected capacity change from 0 to 16 [ 990.190596][ C0] sd 0:0:1:0: [sg0] tag#5648 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 990.190627][ T9921] loop1: detected capacity change from 0 to 4 [ 990.201057][ C0] sd 0:0:1:0: [sg0] tag#5648 CDB: opcode=0xe5 (vendor) [ 990.201077][ C0] sd 0:0:1:0: [sg0] tag#5648 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 990.222068][ T9921] EXT4-fs (loop1): Invalid log block size: 4096 07:15:20 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\x00\x00\n', 0xfffffffffffffffe) [ 990.223876][ C0] sd 0:0:1:0: [sg0] tag#5648 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 990.239748][ C0] sd 0:0:1:0: [sg0] tag#5648 CDB[20]: ba 07:15:20 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\x00\x00\v', 0xfffffffffffffffe) 07:15:20 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\x00\x00\f', 0xfffffffffffffffe) 07:15:20 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x100, 0x0}) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x28000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_config_ext={0x5, 0x8}, 0x4000, 0x0, 0x9, 0x7, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000001440)) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r1, 0xd000943e, 0x0) clone(0x40808000, 0x0, 0x0, 0x0, 0x0) r2 = gettid() tkill(r2, 0x1e) r3 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r3, 0x0) ptrace$cont(0x18, 0x0, 0x0, 0x1) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ptrace$cont(0x7, 0x0, 0x0, 0x10001) openat$full(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x2, 0x80, 0x4, 0x4, 0xe0, 0xb, 0x0, 0x0, 0x8000, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x8004, 0x2, @perf_bp={0x0}, 0x0, 0x8000, 0xfffffff9, 0x7, 0x80000001, 0x8, 0x0, 0x0, 0xa, 0x0, 0x100000000}, r2, 0x8, 0xffffffffffffffff, 0x6ee4ca8bd5713173) 07:15:20 executing program 3: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000, 0x0, 0x0, 0xfff2}]) [ 990.387430][ T9921] loop1: detected capacity change from 0 to 4 [ 990.418057][ T9921] EXT4-fs (loop1): Invalid log block size: 4096 07:15:20 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\x00\x00\r', 0xfffffffffffffffe) 07:15:20 executing program 1: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000180)='./file1\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="20000000360000001900000060008f000ff68f01000000000011000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}], 0x0, &(0x7f0000000140)={[{@jqfmt_vfsv0}]}) 07:15:20 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\x00\x00\x0e', 0xfffffffffffffffe) [ 990.520418][ T9966] loop3: detected capacity change from 0 to 16 07:15:20 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\x00\x00\x0f', 0xfffffffffffffffe) [ 990.563019][ T9966] attempt to access beyond end of device [ 990.563019][ T9966] loop3: rw=34817, want=184, limit=16 [ 990.584661][ T9978] loop1: detected capacity change from 0 to 4 [ 990.597074][ T9978] EXT4-fs (loop1): Invalid log block size: 4352 07:15:20 executing program 3: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000, 0x0, 0x0, 0x15fff}]) [ 990.658503][ T9990] loop4: detected capacity change from 0 to 16 [ 990.667856][ T9978] loop1: detected capacity change from 0 to 4 [ 990.676489][ T9978] EXT4-fs (loop1): Invalid log block size: 4352 [ 990.753354][ T9998] loop3: detected capacity change from 0 to 16 07:15:21 executing program 0: syz_mount_image$vfat(&(0x7f00000002c0), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f736617e43c00088020000200000004f8000020004000000000000000000001", 0x25}, {0x0, 0x0, 0x200000000011000}], 0x0, &(0x7f0000000180)=ANY=[]) r0 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6900) ftruncate(r0, 0x800) lseek(r0, 0x1200, 0x0) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, r1, 0x0, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @private2}, 0x1c) sendfile(r0, r1, 0x0, 0x108d1521) r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_FEATURES_SET(r2, 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHGPRL(0xffffffffffffffff, 0x89f7, &(0x7f00000001c0)={'ip6tnl0\x00', 0x0}) sendmsg$ETHTOOL_MSG_LINKINFO_GET(0xffffffffffffffff, 0x0, 0x0) sendfile(r0, r1, 0x0, 0x8400fffffffa) close(0xffffffffffffffff) 07:15:21 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\x00\x00\x10', 0xfffffffffffffffe) 07:15:21 executing program 1: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000180)='./file1\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="20000000360000001900000060008f000ff68f01000000000012000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}], 0x0, &(0x7f0000000140)={[{@jqfmt_vfsv0}]}) 07:15:21 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x100, 0x0}) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x28000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_config_ext={0x5, 0x8}, 0x4000, 0x0, 0x9, 0x7, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000001440)) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r1, 0xd000943e, 0x0) clone(0x40808000, 0x0, 0x0, 0x0, 0x0) r2 = gettid() tkill(r2, 0x1e) r3 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r3, 0x0) ptrace$cont(0x18, 0x0, 0x0, 0x1) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ptrace$cont(0x7, 0x0, 0x0, 0x10001) openat$full(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x2, 0x80, 0x4, 0x4, 0xe0, 0xb, 0x0, 0x0, 0x8000, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x8004, 0x2, @perf_bp={0x0}, 0x0, 0x8000, 0xfffffff9, 0x7, 0x80000001, 0x8, 0x0, 0x0, 0xa, 0x0, 0x100000000}, r2, 0x8, 0xffffffffffffffff, 0x6ee4ca8bd5713173) 07:15:21 executing program 3: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000, 0x0, 0x0, 0x16000}]) 07:15:21 executing program 4: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16002, 0x2000000}]) [ 991.079838][T10026] loop3: detected capacity change from 0 to 16 [ 991.093766][T10029] loop1: detected capacity change from 0 to 4 [ 991.107204][T10029] EXT4-fs (loop1): Invalid log block size: 4608 07:15:21 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\x00\x00\x11', 0xfffffffffffffffe) [ 991.142044][T10026] attempt to access beyond end of device [ 991.142044][T10026] loop3: rw=34817, want=184, limit=16 [ 991.172868][T10029] loop1: detected capacity change from 0 to 4 07:15:21 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\x00\x00\x12', 0xfffffffffffffffe) [ 991.191540][T10029] EXT4-fs (loop1): Invalid log block size: 4608 07:15:21 executing program 1: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000180)='./file1\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="20000000360000001900000060008f000ff68f01000000000020000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}], 0x0, &(0x7f0000000140)={[{@jqfmt_vfsv0}]}) 07:15:21 executing program 3: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000, 0x0, 0x0, 0x80000}]) [ 991.256279][T10058] loop4: detected capacity change from 0 to 16 [ 991.314506][T10068] loop1: detected capacity change from 0 to 4 07:15:21 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x100, 0x0}) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x28000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_config_ext={0x5, 0x8}, 0x4000, 0x0, 0x9, 0x7, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000001440)) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r1, 0xd000943e, 0x0) clone(0x40808000, 0x0, 0x0, 0x0, 0x0) r2 = gettid() tkill(r2, 0x1e) r3 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r3, 0x0) ptrace$cont(0x18, 0x0, 0x0, 0x1) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ptrace$cont(0x7, 0x0, 0x0, 0x10001) openat$full(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x2, 0x80, 0x4, 0x4, 0xe0, 0xb, 0x0, 0x0, 0x8000, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x8004, 0x2, @perf_bp={0x0}, 0x0, 0x8000, 0xfffffff9, 0x7, 0x80000001, 0x8, 0x0, 0x0, 0xa, 0x0, 0x100000000}, r2, 0x8, 0xffffffffffffffff, 0x6ee4ca8bd5713173) 07:15:21 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\x00\x00H', 0xfffffffffffffffe) [ 991.354826][T10068] EXT4-fs (loop1): Invalid log block size: 8192 [ 991.394217][T10077] loop3: detected capacity change from 0 to 16 [ 991.396823][ C0] scsi_io_completion_action: 2 callbacks suppressed [ 991.396846][ C0] sd 0:0:1:0: [sg0] tag#5650 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 991.417436][ C0] sd 0:0:1:0: [sg0] tag#5650 CDB: opcode=0xe5 (vendor) [ 991.424325][ C0] sd 0:0:1:0: [sg0] tag#5650 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 991.433882][ C0] sd 0:0:1:0: [sg0] tag#5650 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 991.443551][ C0] sd 0:0:1:0: [sg0] tag#5650 CDB[20]: ba [ 991.470061][T10068] loop1: detected capacity change from 0 to 4 [ 991.478841][T10068] EXT4-fs (loop1): Invalid log block size: 8192 [ 991.479340][T10077] attempt to access beyond end of device [ 991.479340][T10077] loop3: rw=34817, want=184, limit=16 07:15:22 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\x00\x00L', 0xfffffffffffffffe) 07:15:22 executing program 1: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000180)='./file1\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="20000000360000001900000060008f000ff68f01000000001020000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}], 0x0, &(0x7f0000000140)={[{@jqfmt_vfsv0}]}) 07:15:22 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x100, 0x0}) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x28000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_config_ext={0x5, 0x8}, 0x4000, 0x0, 0x9, 0x7, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000001440)) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r1, 0xd000943e, 0x0) clone(0x40808000, 0x0, 0x0, 0x0, 0x0) r2 = gettid() tkill(r2, 0x1e) r3 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r3, 0x0) ptrace$cont(0x18, 0x0, 0x0, 0x1) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ptrace$cont(0x7, 0x0, 0x0, 0x10001) openat$full(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x2, 0x80, 0x4, 0x4, 0xe0, 0xb, 0x0, 0x0, 0x8000, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x8004, 0x2, @perf_bp={0x0}, 0x4000, 0x0, 0xfffffff9, 0x7, 0x80000001, 0x8, 0x0, 0x0, 0xa, 0x0, 0x100000000}, r2, 0x8, 0xffffffffffffffff, 0x6ee4ca8bd5713173) 07:15:22 executing program 3: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000, 0x0, 0x0, 0xa0000}]) 07:15:22 executing program 0: syz_mount_image$vfat(&(0x7f00000002c0), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f736617e43c00088020000200000004f8000020004000000000000000000001", 0x25}, {0x0, 0x0, 0x200000000011000}], 0x10, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000080)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6900) ftruncate(r0, 0x800) lseek(0xffffffffffffffff, 0x2, 0x0) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, r1, 0x0, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @private2}, 0x1c) sendfile(r0, r1, 0x0, 0x108d1521) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) sendmsg$ETHTOOL_MSG_FEATURES_SET(0xffffffffffffffff, 0x0, 0x8010) ioctl$sock_ipv6_tunnel_SIOCCHGPRL(0xffffffffffffffff, 0x89f7, &(0x7f00000001c0)={'ip6tnl0\x00', 0x0}) sendmsg$ETHTOOL_MSG_LINKINFO_GET(0xffffffffffffffff, 0x0, 0x0) sendfile(r0, r1, 0x0, 0x8400fffffffa) close(0xffffffffffffffff) mmap(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x8, 0x10, r1, 0xa36d4000) 07:15:22 executing program 4: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16002, 0x3000000}]) [ 991.963819][T10124] loop1: detected capacity change from 0 to 4 [ 991.964022][ C1] sd 0:0:1:0: [sg0] tag#5636 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 991.970369][T10130] loop3: detected capacity change from 0 to 16 [ 991.980458][ C1] sd 0:0:1:0: [sg0] tag#5636 CDB: opcode=0xe5 (vendor) [ 991.980478][ C1] sd 0:0:1:0: [sg0] tag#5636 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 991.995931][T10124] EXT4-fs (loop1): Invalid log block size: 8208 07:15:22 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\x00\x00h', 0xfffffffffffffffe) [ 992.003007][ C1] sd 0:0:1:0: [sg0] tag#5636 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 992.003046][ C1] sd 0:0:1:0: [sg0] tag#5636 CDB[20]: ba [ 992.037034][T10138] loop4: detected capacity change from 0 to 16 [ 992.055118][T10124] loop1: detected capacity change from 0 to 4 07:15:22 executing program 0: syz_mount_image$vfat(&(0x7f00000002c0), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f736617e43c00088020000200000004f8000020004000000000000000000001", 0x25}, {0x0, 0x0, 0x200000000011000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6900) ftruncate(r0, 0x800) lseek(r0, 0x1200, 0x0) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, r1, 0x0, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @private2}, 0x1c) sendfile(r0, r1, 0x0, 0x108d1521) r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_FEATURES_SET(r2, 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHGPRL(0xffffffffffffffff, 0x89f7, &(0x7f00000001c0)={'ip6tnl0\x00', 0x0}) sendmsg$ETHTOOL_MSG_LINKINFO_GET(0xffffffffffffffff, 0x0, 0x0) sendfile(r0, r1, 0x0, 0x8400fffffffa) close(0xffffffffffffffff) getsockopt$inet_buf(0xffffffffffffffff, 0x0, 0x50, &(0x7f0000001280)=""/4068, &(0x7f0000000040)=0xfe4) mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x2000006, 0x4010, 0xffffffffffffffff, 0xb51c5000) [ 992.063512][T10130] attempt to access beyond end of device [ 992.063512][T10130] loop3: rw=34817, want=184, limit=16 [ 992.089049][T10124] EXT4-fs (loop1): Invalid log block size: 8208 07:15:22 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\x00\x00l', 0xfffffffffffffffe) 07:15:22 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x100, 0x0}) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x28000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_config_ext={0x5, 0x8}, 0x4000, 0x0, 0x9, 0x7, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000001440)) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r1, 0xd000943e, 0x0) clone(0x40808000, 0x0, 0x0, 0x0, 0x0) r2 = gettid() tkill(r2, 0x1e) r3 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r3, 0x0) ptrace$cont(0x18, 0x0, 0x0, 0x1) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ptrace$cont(0x7, 0x0, 0x0, 0x10001) openat$full(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x2, 0x80, 0x4, 0x4, 0xe0, 0xb, 0x0, 0x0, 0x8000, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x8004, 0x2, @perf_bp={0x0}, 0x4000, 0x0, 0xfffffff9, 0x7, 0x80000001, 0x8, 0x0, 0x0, 0xa, 0x0, 0x100000000}, r2, 0x8, 0xffffffffffffffff, 0x6ee4ca8bd5713173) 07:15:22 executing program 3: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000, 0x0, 0x0, 0x100000}]) 07:15:22 executing program 1: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000180)='./file1\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="20000000360000001900000060008f000ff68f01000000000022000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}], 0x0, &(0x7f0000000140)={[{@jqfmt_vfsv0}]}) [ 992.210556][ C1] sd 0:0:1:0: [sg0] tag#5662 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 992.215624][T10173] loop1: detected capacity change from 0 to 4 [ 992.221002][ C1] sd 0:0:1:0: [sg0] tag#5662 CDB: opcode=0xe5 (vendor) [ 992.231942][T10173] EXT4-fs (loop1): Invalid log block size: 8704 [ 992.233841][ C1] sd 0:0:1:0: [sg0] tag#5662 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 992.249597][ C1] sd 0:0:1:0: [sg0] tag#5662 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d 07:15:22 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\x00\x00t', 0xfffffffffffffffe) [ 992.259166][ C1] sd 0:0:1:0: [sg0] tag#5662 CDB[20]: ba 07:15:22 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\x00\x00z', 0xfffffffffffffffe) [ 992.299916][T10173] loop1: detected capacity change from 0 to 4 [ 992.324384][T10173] EXT4-fs (loop1): Invalid log block size: 8704 [ 992.348801][T10195] loop3: detected capacity change from 0 to 16 07:15:22 executing program 1: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000180)='./file1\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="20000000360000001900000060008f000ff68f01000000000025000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}], 0x0, &(0x7f0000000140)={[{@jqfmt_vfsv0}]}) 07:15:22 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\xff\xff\xff\xfe', 0xfffffffffffffffe) [ 992.399065][T10195] attempt to access beyond end of device [ 992.399065][T10195] loop3: rw=34817, want=184, limit=16 07:15:22 executing program 4: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16002, 0x4000000}]) [ 992.453422][T10216] loop1: detected capacity change from 0 to 4 [ 992.493129][T10216] EXT4-fs (loop1): Invalid log block size: 9472 07:15:22 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x100, 0x0}) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x28000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_config_ext={0x5, 0x8}, 0x4000, 0x0, 0x9, 0x7, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000001440)) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r1, 0xd000943e, 0x0) clone(0x40808000, 0x0, 0x0, 0x0, 0x0) r2 = gettid() tkill(r2, 0x1e) r3 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r3, 0x0) ptrace$cont(0x18, 0x0, 0x0, 0x1) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ptrace$cont(0x7, 0x0, 0x0, 0x10001) openat$full(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x2, 0x80, 0x4, 0x4, 0xe0, 0xb, 0x0, 0x0, 0x8000, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x8004, 0x2, @perf_bp={0x0}, 0x4000, 0x0, 0xfffffff9, 0x7, 0x80000001, 0x8, 0x0, 0x0, 0xa, 0x0, 0x100000000}, r2, 0x8, 0xffffffffffffffff, 0x6ee4ca8bd5713173) 07:15:22 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\xfe\xff\xff', 0xfffffffffffffffe) [ 992.548335][T10216] loop1: detected capacity change from 0 to 4 [ 992.563924][T10216] EXT4-fs (loop1): Invalid log block size: 9472 [ 992.569192][ C1] sd 0:0:1:0: [sg0] tag#5688 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 992.580705][ C1] sd 0:0:1:0: [sg0] tag#5688 CDB: opcode=0xe5 (vendor) [ 992.587563][ C1] sd 0:0:1:0: [sg0] tag#5688 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 992.597124][ C1] sd 0:0:1:0: [sg0] tag#5688 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 992.606682][ C1] sd 0:0:1:0: [sg0] tag#5688 CDB[20]: ba [ 992.702324][T10251] loop4: detected capacity change from 0 to 16 07:15:23 executing program 0: syz_mount_image$vfat(&(0x7f00000002c0), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f736617e43c00088020000200000004f8000020004000000000000000000001", 0x25}, {0x0, 0x0, 0x200000000011000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6900) ftruncate(r0, 0x800) lseek(r0, 0x1200, 0x0) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, r1, 0x0, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @private2}, 0x1c) sendfile(r0, r1, 0x0, 0x108d1521) r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_FEATURES_SET(r2, 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHGPRL(0xffffffffffffffff, 0x89f7, &(0x7f00000001c0)={'ip6tnl0\x00', 0x0}) preadv(0xffffffffffffffff, &(0x7f0000000280), 0x18, 0xd9f, 0x0) write$tcp_congestion(0xffffffffffffffff, &(0x7f0000000080)='westwood\x00', 0x9) sendmsg$ETHTOOL_MSG_LINKINFO_GET(0xffffffffffffffff, 0x0, 0x0) sendfile(r0, r1, 0x0, 0x8400fffffffa) close(0xffffffffffffffff) 07:15:23 executing program 1: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000180)='./file1\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="20000000360000001900000060008f000ff68f01000000000028000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}], 0x0, &(0x7f0000000140)={[{@jqfmt_vfsv0}]}) 07:15:23 executing program 3: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000, 0x0, 0x0, 0x104000}]) 07:15:23 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\xfe\xff\xff\xff', 0xfffffffffffffffe) 07:15:23 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x100, 0x0}) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x28000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_config_ext={0x5, 0x8}, 0x4000, 0x0, 0x9, 0x7, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000001440)) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r1, 0xd000943e, 0x0) clone(0x40808000, 0x0, 0x0, 0x0, 0x0) r2 = gettid() tkill(r2, 0x1e) r3 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r3, 0x0) ptrace$cont(0x18, 0x0, 0x0, 0x1) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ptrace$cont(0x7, 0x0, 0x0, 0x10001) openat$full(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x2, 0x80, 0x4, 0x4, 0xe0, 0xb, 0x0, 0x0, 0x8000, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x8004, 0x2, @perf_bp={0x0}, 0x4000, 0x8000, 0x0, 0x7, 0x80000001, 0x8, 0x0, 0x0, 0xa, 0x0, 0x100000000}, r2, 0x8, 0xffffffffffffffff, 0x6ee4ca8bd5713173) 07:15:23 executing program 4: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16002, 0x5000000}]) [ 992.999005][T10269] loop3: detected capacity change from 0 to 16 [ 993.005367][T10271] loop1: detected capacity change from 0 to 4 [ 993.005691][ C1] sd 0:0:1:0: [sg0] tag#5650 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 993.021800][ C1] sd 0:0:1:0: [sg0] tag#5650 CDB: opcode=0xe5 (vendor) [ 993.028644][ C1] sd 0:0:1:0: [sg0] tag#5650 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 993.038235][ C1] sd 0:0:1:0: [sg0] tag#5650 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d 07:15:23 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x9f\x94p\x9f', 0xfffffffffffffffe) [ 993.047801][ C1] sd 0:0:1:0: [sg0] tag#5650 CDB[20]: ba [ 993.059155][T10271] EXT4-fs (loop1): Invalid log block size: 10240 [ 993.080129][T10276] ================================================================== [ 993.088251][T10276] BUG: KCSAN: data-race in copy_page_to_iter / fat_set_state [ 993.096089][T10276] [ 993.098403][T10276] write to 0xffff888165abd025 of 1 bytes by task 10269 on cpu 0: [ 993.106280][T10276] fat_set_state+0x16c/0x1d0 [ 993.110866][T10276] fat_fill_super+0x263a/0x2a80 [ 993.115717][T10276] vfat_fill_super+0x2c/0x40 [ 993.120302][T10276] mount_bdev+0x1e8/0x290 [ 993.124620][T10276] vfat_mount+0x2d/0x40 [ 993.126900][T10294] loop4: detected capacity change from 0 to 16 [ 993.128855][T10276] legacy_get_tree+0x70/0xc0 [ 993.128875][T10276] vfs_get_tree+0x4a/0x1a0 [ 993.143985][T10276] path_mount+0x11d4/0x1ce0 07:15:23 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\x00\x00\x00', 0xfffffffffffffffe) [ 993.148483][T10276] __se_sys_mount+0x23d/0x2e0 [ 993.153178][T10276] __x64_sys_mount+0x63/0x70 [ 993.157765][T10276] do_syscall_64+0x3d/0x90 [ 993.162181][T10276] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 993.168088][T10276] [ 993.170401][T10276] read to 0xffff888165abd000 of 1024 bytes by task 10276 on cpu 1: [ 993.178275][T10276] copy_page_to_iter+0x2e1/0x940 [ 993.183204][T10276] filemap_read+0xef6/0x1220 [ 993.187786][T10276] generic_file_read_iter+0x75/0x2c0 [ 993.193070][T10276] blkdev_read_iter+0xb9/0xf0 07:15:23 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x100, 0x0}) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x28000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_config_ext={0x5, 0x8}, 0x4000, 0x0, 0x9, 0x7, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000001440)) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r1, 0xd000943e, 0x0) clone(0x40808000, 0x0, 0x0, 0x0, 0x0) r2 = gettid() tkill(r2, 0x1e) r3 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r3, 0x0) ptrace$cont(0x18, 0x0, 0x0, 0x1) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ptrace$cont(0x7, 0x0, 0x0, 0x10001) openat$full(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x2, 0x80, 0x4, 0x4, 0xe0, 0xb, 0x0, 0x0, 0x8000, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x8004, 0x2, @perf_bp={0x0}, 0x4000, 0x8000, 0x0, 0x7, 0x80000001, 0x8, 0x0, 0x0, 0xa, 0x0, 0x100000000}, r2, 0x8, 0xffffffffffffffff, 0x6ee4ca8bd5713173) 07:15:23 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\x00\x00\x00', 0xfffffffffffffffe) [ 993.197743][T10276] vfs_read+0x565/0x5d0 [ 993.201890][T10276] ksys_read+0xce/0x180 [ 993.206030][T10276] __x64_sys_read+0x3e/0x50 [ 993.210539][T10276] do_syscall_64+0x3d/0x90 [ 993.214976][T10276] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 993.220862][T10276] [ 993.223174][T10276] Reported by Kernel Concurrency Sanitizer on: [ 993.229301][T10276] CPU: 1 PID: 10276 Comm: systemd-udevd Not tainted 5.14.0-rc4-syzkaller #0 [ 993.237990][T10276] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 993.248036][T10276] ================================================================== [ 993.258934][T10269] attempt to access beyond end of device [ 993.258934][T10269] loop3: rw=34817, want=184, limit=16 [ 993.287953][ C0] sd 0:0:1:0: [sg0] tag#5648 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s 07:15:23 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\x00\x00\x00', 0xfffffffffffffffe) [ 993.298328][ C0] sd 0:0:1:0: [sg0] tag#5648 CDB: opcode=0xe5 (vendor) [ 993.305216][ C0] sd 0:0:1:0: [sg0] tag#5648 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 993.314773][ C0] sd 0:0:1:0: [sg0] tag#5648 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 993.324416][ C0] sd 0:0:1:0: [sg0] tag#5648 CDB[20]: ba 07:15:23 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x100, 0x0}) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x28000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_config_ext={0x5, 0x8}, 0x4000, 0x0, 0x9, 0x7, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000001440)) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r1, 0xd000943e, 0x0) clone(0x40808000, 0x0, 0x0, 0x0, 0x0) r2 = gettid() tkill(r2, 0x1e) r3 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r3, 0x0) ptrace$cont(0x18, 0x0, 0x0, 0x1) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ptrace$cont(0x7, 0x0, 0x0, 0x10001) openat$full(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x2, 0x80, 0x4, 0x4, 0xe0, 0xb, 0x0, 0x0, 0x8000, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x8004, 0x2, @perf_bp={0x0}, 0x4000, 0x8000, 0x0, 0x7, 0x80000001, 0x8, 0x0, 0x0, 0xa, 0x0, 0x100000000}, r2, 0x8, 0xffffffffffffffff, 0x6ee4ca8bd5713173) [ 993.394619][T10271] loop1: detected capacity change from 0 to 4 [ 993.407356][ C1] sd 0:0:1:0: [sg0] tag#5678 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 993.416052][T10271] EXT4-fs (loop1): Invalid log block size: 10240 [ 993.417810][ C1] sd 0:0:1:0: [sg0] tag#5678 CDB: opcode=0xe5 (vendor) [ 993.430992][ C1] sd 0:0:1:0: [sg0] tag#5678 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 993.440588][ C1] sd 0:0:1:0: [sg0] tag#5678 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 993.450149][ C1] sd 0:0:1:0: [sg0] tag#5678 CDB[20]: ba 07:15:24 executing program 4: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16002, 0x6000000}]) 07:15:24 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\x00\x00\x00', 0xfffffffffffffffe) 07:15:24 executing program 3: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000, 0x0, 0x0, 0x400000}]) 07:15:24 executing program 1: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000180)='./file1\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="20000000360000001900000060008f000ff68f0100000000002e000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}], 0x0, &(0x7f0000000140)={[{@jqfmt_vfsv0}]}) 07:15:24 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x100, 0x0}) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x28000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_config_ext={0x5, 0x8}, 0x4000, 0x0, 0x9, 0x7, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000001440)) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r1, 0xd000943e, 0x0) clone(0x40808000, 0x0, 0x0, 0x0, 0x0) r2 = gettid() tkill(r2, 0x1e) r3 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r3, 0x0) ptrace$cont(0x18, 0x0, 0x0, 0x1) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ptrace$cont(0x7, 0x0, 0x0, 0x10001) openat$full(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x2, 0x80, 0x4, 0x4, 0xe0, 0xb, 0x0, 0x0, 0x8000, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x8004, 0x2, @perf_bp={0x0}, 0x4000, 0x8000, 0xfffffff9, 0x0, 0x80000001, 0x8, 0x0, 0x0, 0xa, 0x0, 0x100000000}, r2, 0x8, 0xffffffffffffffff, 0x6ee4ca8bd5713173) 07:15:24 executing program 0: syz_mount_image$vfat(&(0x7f00000002c0), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f736617e43c00088020000200000004f8000020004000000000000000000001", 0x25}, {0x0, 0x0, 0x200000000011000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6900) ftruncate(r0, 0x800) lseek(r0, 0x1200, 0x0) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, r1, 0x0, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @private2}, 0x1c) sendfile(r0, r1, 0x0, 0x108d1521) r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_FEATURES_SET(r2, 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHGPRL(r0, 0x89f7, &(0x7f00000001c0)={'ip6gre0\x00', 0x0}) sendfile(0xffffffffffffffff, r1, 0x0, 0x4005) close(0xffffffffffffffff) r3 = syz_genetlink_get_family_id$tipc(&(0x7f0000000140), r1) sendmsg$TIPC_CMD_SET_LINK_PRI(r1, &(0x7f0000000300)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000180)={&(0x7f0000000340)=ANY=[@ANYBLOB='h\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="100026bd7000ffecdf25010000000000000008410000004c00180000000773797a300000000000000000003b1110364c6db5197d680000010000000000000000000000000000000000000000000000000000000000000000000000000000210f00000000000000000040000098a746af9d66b0eeda2a80f8c31b89a14333e21bde250a516c2ad35da6e0e4aaa822ae44e4836c47b4e01ff875469b614be4c6bdf4cfc05c743fa1d8f6a0ba1b5436f4be628862a590eddaa1a9c0881d36f78be4972238c515bfaf43b7c9ea1aab8594640f73992681c1eb86e77f0b1239dd6de39ec882a3810c9404"], 0x68}, 0x1, 0x0, 0x0, 0x4000000}, 0x41) [ 993.996572][T10361] loop3: detected capacity change from 0 to 16 [ 993.996927][T10356] loop1: detected capacity change from 0 to 4 [ 994.003471][ C0] sd 0:0:1:0: [sg0] tag#5658 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 994.019245][ C0] sd 0:0:1:0: [sg0] tag#5658 CDB: opcode=0xe5 (vendor) [ 994.026127][ C0] sd 0:0:1:0: [sg0] tag#5658 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 994.034812][T10356] EXT4-fs (loop1): Invalid log block size: 11776 07:15:24 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\x00\x00\x00', 0xfffffffffffffffe) [ 994.035692][ C0] sd 0:0:1:0: [sg0] tag#5658 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 994.035708][ C0] sd 0:0:1:0: [sg0] tag#5658 CDB[20]: ba [ 994.090486][T10376] loop4: detected capacity change from 0 to 16 [ 994.122257][T10361] attempt to access beyond end of device [ 994.122257][T10361] loop3: rw=34817, want=184, limit=16 07:15:24 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x100, 0x0}) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x28000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_config_ext={0x5, 0x8}, 0x4000, 0x0, 0x9, 0x7, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000001440)) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r1, 0xd000943e, 0x0) clone(0x40808000, 0x0, 0x0, 0x0, 0x0) r2 = gettid() tkill(r2, 0x1e) r3 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r3, 0x0) ptrace$cont(0x18, 0x0, 0x0, 0x1) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ptrace$cont(0x7, 0x0, 0x0, 0x10001) openat$full(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x2, 0x80, 0x4, 0x4, 0xe0, 0xb, 0x0, 0x0, 0x8000, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x8004, 0x2, @perf_bp={0x0}, 0x4000, 0x8000, 0xfffffff9, 0x0, 0x80000001, 0x8, 0x0, 0x0, 0xa, 0x0, 0x100000000}, r2, 0x8, 0xffffffffffffffff, 0x6ee4ca8bd5713173) 07:15:24 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\x00\x00\x00', 0xfffffffffffffffe) [ 994.136665][T10356] loop1: detected capacity change from 0 to 4 [ 994.163277][T10356] EXT4-fs (loop1): Invalid log block size: 11776 [ 994.200618][ C1] sd 0:0:1:0: [sg0] tag#5685 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s 07:15:24 executing program 1: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000180)='./file1\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="20000000360000001900000060008f000ff68f0100000000002f000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}], 0x0, &(0x7f0000000140)={[{@jqfmt_vfsv0}]}) 07:15:24 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\x00\x00\x00', 0xfffffffffffffffe) [ 994.211000][ C1] sd 0:0:1:0: [sg0] tag#5685 CDB: opcode=0xe5 (vendor) [ 994.217865][ C1] sd 0:0:1:0: [sg0] tag#5685 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 994.227450][ C1] sd 0:0:1:0: [sg0] tag#5685 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 994.237034][ C1] sd 0:0:1:0: [sg0] tag#5685 CDB[20]: ba 07:15:24 executing program 3: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000, 0x0, 0x0, 0x401000}]) 07:15:24 executing program 4: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16002, 0x8000000}]) 07:15:24 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\x00\x00\x00', 0xfffffffffffffffe) [ 994.292070][T10404] loop1: detected capacity change from 0 to 4 [ 994.321650][T10404] EXT4-fs (loop1): Invalid log block size: 12032 07:15:24 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x100, 0x0}) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x28000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_config_ext={0x5, 0x8}, 0x4000, 0x0, 0x9, 0x7, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000001440)) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r1, 0xd000943e, 0x0) clone(0x40808000, 0x0, 0x0, 0x0, 0x0) r2 = gettid() tkill(r2, 0x1e) r3 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r3, 0x0) ptrace$cont(0x18, 0x0, 0x0, 0x1) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ptrace$cont(0x7, 0x0, 0x0, 0x10001) openat$full(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x2, 0x80, 0x4, 0x4, 0xe0, 0xb, 0x0, 0x0, 0x8000, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x8004, 0x2, @perf_bp={0x0}, 0x4000, 0x8000, 0xfffffff9, 0x0, 0x80000001, 0x8, 0x0, 0x0, 0xa, 0x0, 0x100000000}, r2, 0x8, 0xffffffffffffffff, 0x6ee4ca8bd5713173) [ 994.364726][T10404] loop1: detected capacity change from 0 to 4 [ 994.389556][T10404] EXT4-fs (loop1): Invalid log block size: 12032 [ 994.392136][T10425] loop3: detected capacity change from 0 to 16 07:15:24 executing program 1: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000180)='./file1\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="20000000360000001900000060008f000ff68f01000000000030000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}], 0x0, &(0x7f0000000140)={[{@jqfmt_vfsv0}]}) 07:15:24 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\x00\x00\x00', 0xfffffffffffffffe) [ 994.424980][ C1] sd 0:0:1:0: [sg0] tag#5653 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 994.435385][ C1] sd 0:0:1:0: [sg0] tag#5653 CDB: opcode=0xe5 (vendor) [ 994.442257][ C1] sd 0:0:1:0: [sg0] tag#5653 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 994.451811][ C1] sd 0:0:1:0: [sg0] tag#5653 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 994.461368][ C1] sd 0:0:1:0: [sg0] tag#5653 CDB[20]: ba [ 994.486920][T10425] attempt to access beyond end of device [ 994.486920][T10425] loop3: rw=34817, want=184, limit=16 [ 994.506723][T10441] loop1: detected capacity change from 0 to 4 [ 994.538636][T10441] EXT4-fs (loop1): Invalid log block size: 12288 [ 994.610084][T10441] loop1: detected capacity change from 0 to 4 [ 994.623821][T10441] EXT4-fs (loop1): Invalid log block size: 12288 [ 994.656868][T10468] loop4: detected capacity change from 0 to 16 07:15:25 executing program 0: syz_mount_image$vfat(&(0x7f00000002c0), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f736617e43c00088020000200000004f8000020004000000000000000000001", 0x25}, {0x0, 0x0, 0x200000000011000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6900) ftruncate(r0, 0x800) lseek(r0, 0x1200, 0x0) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, r1, 0x0, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @private2}, 0x1c) sendfile(r0, r1, 0x0, 0x108d1521) r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_FEATURES_SET(r2, 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHGPRL(r0, 0x89f7, &(0x7f00000001c0)={'ip6tnl0\x00', 0x0}) sendmsg$ETHTOOL_MSG_LINKINFO_GET(0xffffffffffffffff, 0x0, 0x0) sendfile(r0, r1, 0x0, 0x8400fffffffa) close(0xffffffffffffffff) 07:15:25 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\x00\x00\x00', 0xfffffffffffffffe) 07:15:25 executing program 3: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000, 0x0, 0x0, 0x4af000}]) 07:15:25 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x100, 0x0}) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x28000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_config_ext={0x5, 0x8}, 0x4000, 0x0, 0x9, 0x7, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000001440)) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r1, 0xd000943e, 0x0) clone(0x40808000, 0x0, 0x0, 0x0, 0x0) r2 = gettid() tkill(r2, 0x1e) r3 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r3, 0x0) ptrace$cont(0x18, 0x0, 0x0, 0x1) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ptrace$cont(0x7, 0x0, 0x0, 0x10001) openat$full(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x2, 0x80, 0x4, 0x4, 0xe0, 0xb, 0x0, 0x0, 0x8000, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x8004, 0x2, @perf_bp={0x0}, 0x4000, 0x8000, 0xfffffff9, 0x7, 0x0, 0x8, 0x0, 0x0, 0xa, 0x0, 0x100000000}, r2, 0x8, 0xffffffffffffffff, 0x6ee4ca8bd5713173) 07:15:25 executing program 1: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000180)='./file1\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="20000000360000001900000060008f000ff68f01000000000031000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}], 0x0, &(0x7f0000000140)={[{@jqfmt_vfsv0}]}) 07:15:25 executing program 4: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16002, 0x8040000}]) [ 994.932934][T10489] loop3: detected capacity change from 0 to 16 [ 994.955947][T10495] loop1: detected capacity change from 0 to 4 [ 994.970727][T10489] attempt to access beyond end of device [ 994.970727][T10489] loop3: rw=34817, want=184, limit=16 07:15:25 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\x00\x00\x00', 0xfffffffffffffffe) [ 994.988857][T10495] EXT4-fs (loop1): Invalid log block size: 12544 07:15:25 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\x00\x00\x00', 0xfffffffffffffffe) 07:15:25 executing program 3: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000, 0x0, 0x0, 0x4fc000}]) [ 995.043389][T10495] loop1: detected capacity change from 0 to 4 [ 995.069856][T10495] EXT4-fs (loop1): Invalid log block size: 12544 07:15:25 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x100, 0x0}) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x28000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_config_ext={0x5, 0x8}, 0x4000, 0x0, 0x9, 0x7, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000001440)) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r1, 0xd000943e, 0x0) clone(0x40808000, 0x0, 0x0, 0x0, 0x0) r2 = gettid() tkill(r2, 0x1e) r3 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r3, 0x0) ptrace$cont(0x18, 0x0, 0x0, 0x1) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ptrace$cont(0x7, 0x0, 0x0, 0x10001) openat$full(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x2, 0x80, 0x4, 0x4, 0xe0, 0xb, 0x0, 0x0, 0x8000, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x8004, 0x2, @perf_bp={0x0}, 0x4000, 0x8000, 0xfffffff9, 0x7, 0x0, 0x8, 0x0, 0x0, 0xa, 0x0, 0x100000000}, r2, 0x8, 0xffffffffffffffff, 0x6ee4ca8bd5713173) 07:15:25 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\x00\x00\x00', 0xfffffffffffffffe) [ 995.127560][T10508] loop4: detected capacity change from 0 to 16 07:15:25 executing program 1: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000180)='./file1\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="20000000360000001900000060008f000ff68f0100000000003f000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}], 0x0, &(0x7f0000000140)={[{@jqfmt_vfsv0}]}) [ 995.229261][T10543] loop3: detected capacity change from 0 to 16 [ 995.255992][T10544] loop1: detected capacity change from 0 to 4 [ 995.280337][T10544] EXT4-fs (loop1): Invalid log block size: 16128 [ 995.309412][T10543] attempt to access beyond end of device [ 995.309412][T10543] loop3: rw=34817, want=184, limit=16 [ 995.361153][T10544] loop1: detected capacity change from 0 to 4 [ 995.376172][T10544] EXT4-fs (loop1): Invalid log block size: 16128 07:15:26 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x100, 0x0}) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x28000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_config_ext={0x5, 0x8}, 0x4000, 0x0, 0x9, 0x7, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000001440)) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r1, 0xd000943e, 0x0) clone(0x40808000, 0x0, 0x0, 0x0, 0x0) r2 = gettid() tkill(r2, 0x1e) r3 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r3, 0x0) ptrace$cont(0x18, 0x0, 0x0, 0x1) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ptrace$cont(0x7, 0x0, 0x0, 0x10001) openat$full(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x2, 0x80, 0x4, 0x4, 0xe0, 0xb, 0x0, 0x0, 0x8000, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x8004, 0x2, @perf_bp={0x0}, 0x4000, 0x8000, 0xfffffff9, 0x7, 0x0, 0x8, 0x0, 0x0, 0xa, 0x0, 0x100000000}, r2, 0x8, 0xffffffffffffffff, 0x6ee4ca8bd5713173) 07:15:26 executing program 0: syz_mount_image$vfat(&(0x7f00000002c0), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f736617e43c00088020000200000004f8000020004000000000000000000001", 0x25}, {0x0, 0x0, 0x200000000011000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') fcntl$setstatus(0xffffffffffffffff, 0x4, 0x6900) ftruncate(0xffffffffffffffff, 0x800) lseek(0xffffffffffffffff, 0x1200, 0x0) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, 0x0, 0x0) r0 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, r0, 0x0, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f0000000400)={0xa, 0x0, 0x0, @empty, 0x3}, 0xffffff36) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x6) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_LINKSTATE_GET(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x20, r2, 0x20, 0x70bd2c, 0x25dfdbfc, {}, [@HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}]}]}, 0x20}, 0x1, 0x0, 0x0, 0x4}, 0x44001) sendmsg$ETHTOOL_MSG_FEATURES_SET(r1, 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHGPRL(0xffffffffffffffff, 0x89f7, &(0x7f00000001c0)={'ip6tnl0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_KEY(r0, &(0x7f00000003c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000380)={&(0x7f0000000300)={0x6c, 0x0, 0x400, 0x70bd2d, 0x25dfdbfe, {{}, {@void, @val={0xc, 0x99, {0x3, 0x47}}}}, [@NL80211_ATTR_KEY={0x20, 0x50, 0x0, 0x1, [@NL80211_KEY_IDX={0x5, 0x2, 0x2}, @NL80211_KEY_DATA_WEP104={0x11, 0x1, "914520821c548845c322c05a81"}]}, @NL80211_ATTR_KEY_TYPE={0x8, 0x37, 0x1}, @NL80211_ATTR_KEY_CIPHER={0x8, 0x9, 0xfac01}, @NL80211_ATTR_KEY_DEFAULT={0x4}, @NL80211_ATTR_KEY_DEFAULT={0x4}, @NL80211_ATTR_KEY_DEFAULT_TYPES={0x14, 0x6e, 0x0, 0x1, [@NL80211_KEY_DEFAULT_TYPE_MULTICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}, @NL80211_KEY_DEFAULT_TYPE_UNICAST={0x4}]}]}, 0x6c}, 0x1, 0x0, 0x0, 0x20008040}, 0x4) sendmsg$ETHTOOL_MSG_LINKINFO_GET(0xffffffffffffffff, 0x0, 0x0) sendfile(0xffffffffffffffff, r0, 0x0, 0x8400fffffffa) close(0xffffffffffffffff) 07:15:26 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\x00\x00\x00', 0xfffffffffffffffe) 07:15:26 executing program 3: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000, 0x0, 0x0, 0x540000}]) 07:15:26 executing program 1: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000180)='./file1\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="20000000360000001900000060008f000ff68f01000000000040000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}], 0x0, &(0x7f0000000140)={[{@jqfmt_vfsv0}]}) 07:15:26 executing program 4: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16002, 0x8800000}]) [ 995.902919][T10591] loop3: detected capacity change from 0 to 16 [ 995.903772][T10590] loop1: detected capacity change from 0 to 4 [ 995.932929][T10591] attempt to access beyond end of device [ 995.932929][T10591] loop3: rw=34817, want=184, limit=16 07:15:26 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\x00\x00\x00', 0xfffffffffffffffe) [ 995.955569][T10603] loop4: detected capacity change from 0 to 16 07:15:26 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\x00\x00\x00', 0xfffffffffffffffe) 07:15:26 executing program 3: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000, 0x0, 0x0, 0x600100}]) [ 996.031559][T10590] EXT4-fs (loop1): Invalid log block size: 16384 07:15:26 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\x00\x00\x00', 0xfffffffffffffffe) [ 996.080570][T10590] loop1: detected capacity change from 0 to 4 [ 996.112272][T10590] EXT4-fs (loop1): Invalid log block size: 16384 07:15:26 executing program 1: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000180)='./file1\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="20000000360000001900000060008f000ff68f01000000080040000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}], 0x0, &(0x7f0000000140)={[{@jqfmt_vfsv0}]}) 07:15:26 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\x00\x00\x00', 0xfffffffffffffffe) [ 996.151305][T10635] loop3: detected capacity change from 0 to 16 07:15:26 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x100, 0x0}) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x28000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_config_ext={0x5, 0x8}, 0x4000, 0x0, 0x9, 0x7, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000001440)) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r1, 0xd000943e, 0x0) clone(0x40808000, 0x0, 0x0, 0x0, 0x0) r2 = gettid() tkill(r2, 0x1e) r3 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r3, 0x0) ptrace$cont(0x18, 0x0, 0x0, 0x1) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ptrace$cont(0x7, 0x0, 0x0, 0x10001) openat$full(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x2, 0x80, 0x4, 0x4, 0xe0, 0xb, 0x0, 0x0, 0x8000, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x8004, 0x2, @perf_bp={0x0}, 0x4000, 0x8000, 0xfffffff9, 0x7, 0x80000001, 0x0, 0x0, 0x0, 0xa, 0x0, 0x100000000}, r2, 0x8, 0xffffffffffffffff, 0x6ee4ca8bd5713173) 07:15:26 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\x00\x00\x00', 0xfffffffffffffffe) [ 996.215915][T10635] attempt to access beyond end of device [ 996.215915][T10635] loop3: rw=34817, want=184, limit=16 [ 996.245067][T10650] loop1: detected capacity change from 0 to 4 07:15:26 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\x00\x00\x00', 0xfffffffffffffffe) [ 996.289745][T10650] EXT4-fs (loop1): Invalid log block size: 16384 07:15:26 executing program 3: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000, 0x0, 0x0, 0x970000}]) 07:15:26 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\x00\x00\x00', 0xfffffffffffffffe) [ 996.358967][T10650] loop1: detected capacity change from 0 to 4 [ 996.374216][T10650] EXT4-fs (loop1): Invalid log block size: 16384 [ 996.446715][T10688] loop3: detected capacity change from 0 to 16 07:15:26 executing program 4: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16002, 0x9000000}]) 07:15:26 executing program 1: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000180)='./file1\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="20000000360000001900000060008f000ff68f01000000000048000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}], 0x0, &(0x7f0000000140)={[{@jqfmt_vfsv0}]}) 07:15:26 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x100, 0x0}) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x28000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_config_ext={0x5, 0x8}, 0x4000, 0x0, 0x9, 0x7, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000001440)) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r1, 0xd000943e, 0x0) clone(0x40808000, 0x0, 0x0, 0x0, 0x0) r2 = gettid() tkill(r2, 0x1e) r3 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r3, 0x0) ptrace$cont(0x18, 0x0, 0x0, 0x1) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ptrace$cont(0x7, 0x0, 0x0, 0x10001) openat$full(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x2, 0x80, 0x4, 0x4, 0xe0, 0xb, 0x0, 0x0, 0x8000, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x8004, 0x2, @perf_bp={0x0}, 0x4000, 0x8000, 0xfffffff9, 0x7, 0x80000001, 0x0, 0x0, 0x0, 0xa, 0x0, 0x100000000}, r2, 0x8, 0xffffffffffffffff, 0x6ee4ca8bd5713173) 07:15:26 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\x00\x00\x00', 0xfffffffffffffffe) [ 996.528368][T10688] attempt to access beyond end of device [ 996.528368][T10688] loop3: rw=34817, want=184, limit=16 [ 996.569710][T10708] loop1: detected capacity change from 0 to 4 [ 996.578929][ C1] scsi_io_completion_action: 4 callbacks suppressed [ 996.578962][ C1] sd 0:0:1:0: [sg0] tag#5675 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 996.595929][ C1] sd 0:0:1:0: [sg0] tag#5675 CDB: opcode=0xe5 (vendor) [ 996.602896][ C1] sd 0:0:1:0: [sg0] tag#5675 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 996.612477][ C1] sd 0:0:1:0: [sg0] tag#5675 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 996.622053][ C1] sd 0:0:1:0: [sg0] tag#5675 CDB[20]: ba 07:15:26 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\x00\x00\x00', 0xfffffffffffffffe) 07:15:26 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\x00\x00\x00', 0xfffffffffffffffe) 07:15:26 executing program 3: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000, 0x0, 0x0, 0xc04a01}]) [ 996.761249][T10708] EXT4-fs (loop1): Invalid log block size: 18432 [ 996.796573][T10708] loop1: detected capacity change from 0 to 4 07:15:27 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x100, 0x0}) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x28000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_config_ext={0x5, 0x8}, 0x4000, 0x0, 0x9, 0x7, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000001440)) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r1, 0xd000943e, 0x0) clone(0x40808000, 0x0, 0x0, 0x0, 0x0) r2 = gettid() tkill(r2, 0x1e) r3 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r3, 0x0) ptrace$cont(0x18, 0x0, 0x0, 0x1) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ptrace$cont(0x7, 0x0, 0x0, 0x10001) openat$full(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x2, 0x80, 0x4, 0x4, 0xe0, 0xb, 0x0, 0x0, 0x8000, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x8004, 0x2, @perf_bp={0x0}, 0x4000, 0x8000, 0xfffffff9, 0x7, 0x80000001, 0x0, 0x0, 0x0, 0xa, 0x0, 0x100000000}, r2, 0x8, 0xffffffffffffffff, 0x6ee4ca8bd5713173) [ 996.825416][T10708] EXT4-fs (loop1): Invalid log block size: 18432 [ 996.853565][T10740] loop3: detected capacity change from 0 to 16 07:15:27 executing program 1: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000180)='./file1\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="20000000360000001900000060008f000ff68f0100000000004c000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}], 0x0, &(0x7f0000000140)={[{@jqfmt_vfsv0}]}) 07:15:27 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\x00\x00\x00', 0xfffffffffffffffe) [ 996.890596][ C1] sd 0:0:1:0: [sg0] tag#5676 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 996.900974][ C1] sd 0:0:1:0: [sg0] tag#5676 CDB: opcode=0xe5 (vendor) [ 996.907917][ C1] sd 0:0:1:0: [sg0] tag#5676 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 996.917482][ C1] sd 0:0:1:0: [sg0] tag#5676 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 996.927152][ C1] sd 0:0:1:0: [sg0] tag#5676 CDB[20]: ba 07:15:27 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\x00w~', 0xfffffffffffffffe) [ 996.977031][T10751] loop1: detected capacity change from 0 to 4 [ 997.043088][T10751] EXT4-fs (loop1): Invalid log block size: 19456 [ 997.072911][T10751] loop1: detected capacity change from 0 to 4 07:15:27 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\x00\x00\x00', 0xfffffffffffffffe) [ 997.094933][T10751] EXT4-fs (loop1): Invalid log block size: 19456 [ 997.247302][T10793] loop4: detected capacity change from 0 to 16 07:15:27 executing program 1: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000180)='./file1\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="20000000360000001900000060008f000ff68f01000000000060000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}], 0x0, &(0x7f0000000140)={[{@jqfmt_vfsv0}]}) 07:15:27 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x100, 0x0}) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x28000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_config_ext={0x5, 0x8}, 0x4000, 0x0, 0x9, 0x7, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000001440)) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r1, 0xd000943e, 0x0) clone(0x40808000, 0x0, 0x0, 0x0, 0x0) r2 = gettid() tkill(r2, 0x1e) r3 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r3, 0x0) ptrace$cont(0x18, 0x0, 0x0, 0x1) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ptrace$cont(0x7, 0x0, 0x0, 0x10001) openat$full(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x2, 0x80, 0x4, 0x4, 0xe0, 0xb, 0x0, 0x0, 0x8000, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x8004, 0x2, @perf_bp={0x0}, 0x4000, 0x8000, 0xfffffff9, 0x7, 0x80000001, 0x8, 0x0, 0x0, 0x0, 0x0, 0x100000000}, r2, 0x8, 0xffffffffffffffff, 0x6ee4ca8bd5713173) 07:15:27 executing program 3: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000, 0x0, 0x0, 0xc04f00}]) 07:15:27 executing program 4: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16002, 0xc000000}]) 07:15:27 executing program 0: syz_mount_image$vfat(&(0x7f00000002c0), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f736617e43c00088020000200000004f8000020004000000000000000000001", 0x25}, {0x0, 0x0, 0x200000000011000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6900) ftruncate(r0, 0x800) lseek(r0, 0x1200, 0x0) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, 0x0, 0x0) sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000680)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000640)={&(0x7f0000000700)=ANY=[@ANYBLOB="e2ff4800", @ANYRES16, @ANYBLOB="000028bd7000fbdbdf250e0000000c00038008000500e000000108000600050000000c00736970001400038008000300020000000800010002000000565d6335376ea73a3bf729273da5fd9514a6d96ee0b0911c2c701b85139366db30a36fb26770540cbbde559355028e7acce482586f5007ec081bb3f846e03bbbc13bd1b78f4aa1caff568f151e01df091237b56816496f662421bc7520856b1d432945d9fed6a36b0acb710016b306d4"], 0x48}, 0x1, 0x0, 0x0, 0x20008000}, 0x4080) sendmsg$IPVS_CMD_DEL_SERVICE(0xffffffffffffffff, &(0x7f0000000280)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000240)={&(0x7f0000000180)={0x34, 0x0, 0x200, 0x70bd28, 0x25dfdbff, {}, [@IPVS_CMD_ATTR_SERVICE={0xc, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_SCHED_NAME={0x8, 0x6, 'ovf\x00'}]}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x400}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x200000}]}]}, 0x34}, 0x1, 0x0, 0x0, 0x4800}, 0x8080) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, r1, 0x0, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @private2}, 0x1c) sendfile(r0, r1, 0x0, 0x108d1521) r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_FEATURES_SET(r2, 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHGPRL(0xffffffffffffffff, 0x89f7, &(0x7f00000001c0)={'ip6tnl0\x00', 0x0}) sendmsg$ETHTOOL_MSG_LINKINFO_GET(0xffffffffffffffff, 0x0, 0x0) sendfile(r0, r1, 0x0, 0x8400fffffffa) close(0xffffffffffffffff) 07:15:27 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\x02\x00\x00', 0xfffffffffffffffe) 07:15:27 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\x03\x00\x00', 0xfffffffffffffffe) [ 997.362018][T10801] loop3: detected capacity change from 0 to 16 [ 997.375853][T10808] loop1: detected capacity change from 0 to 4 [ 997.378440][ C1] sd 0:0:1:0: [sg0] tag#5644 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 997.392292][ C1] sd 0:0:1:0: [sg0] tag#5644 CDB: opcode=0xe5 (vendor) [ 997.399157][ C1] sd 0:0:1:0: [sg0] tag#5644 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 997.408729][ C1] sd 0:0:1:0: [sg0] tag#5644 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 997.418293][ C1] sd 0:0:1:0: [sg0] tag#5644 CDB[20]: ba [ 997.437034][T10801] attempt to access beyond end of device [ 997.437034][T10801] loop3: rw=34817, want=184, limit=16 [ 997.441956][T10808] EXT4-fs (loop1): Invalid log block size: 24576 07:15:27 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x100, 0x0}) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x28000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_config_ext={0x5, 0x8}, 0x4000, 0x0, 0x9, 0x7, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000001440)) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r1, 0xd000943e, 0x0) clone(0x40808000, 0x0, 0x0, 0x0, 0x0) r2 = gettid() tkill(r2, 0x1e) r3 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r3, 0x0) ptrace$cont(0x18, 0x0, 0x0, 0x1) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ptrace$cont(0x7, 0x0, 0x0, 0x10001) openat$full(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x2, 0x80, 0x4, 0x4, 0xe0, 0xb, 0x0, 0x0, 0x8000, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x8004, 0x2, @perf_bp={0x0}, 0x4000, 0x8000, 0xfffffff9, 0x7, 0x80000001, 0x8, 0x0, 0x0, 0x0, 0x0, 0x100000000}, r2, 0x8, 0xffffffffffffffff, 0x6ee4ca8bd5713173) 07:15:27 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\x04\x00\x00', 0xfffffffffffffffe) [ 997.531874][T10808] loop1: detected capacity change from 0 to 4 [ 997.542111][T10808] EXT4-fs (loop1): Invalid log block size: 24576 [ 997.549561][ C0] sd 0:0:1:0: [sg0] tag#5689 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 997.559946][ C0] sd 0:0:1:0: [sg0] tag#5689 CDB: opcode=0xe5 (vendor) [ 997.566794][ C0] sd 0:0:1:0: [sg0] tag#5689 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c 07:15:27 executing program 3: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000, 0x0, 0x0, 0xf04a00}]) 07:15:27 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\x05\x00\x00', 0xfffffffffffffffe) [ 997.571970][T10848] loop4: detected capacity change from 0 to 16 [ 997.576362][ C0] sd 0:0:1:0: [sg0] tag#5689 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 997.592032][ C0] sd 0:0:1:0: [sg0] tag#5689 CDB[20]: ba 07:15:27 executing program 1: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000180)='./file1\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="20000000360000001900000060008f000ff68f01000000000068000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}], 0x0, &(0x7f0000000140)={[{@jqfmt_vfsv0}]}) 07:15:27 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\x06\x00\x00', 0xfffffffffffffffe) [ 997.705001][T10872] loop3: detected capacity change from 0 to 16 [ 997.731285][T10876] loop1: detected capacity change from 0 to 4 07:15:28 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\a\x00\x00', 0xfffffffffffffffe) [ 997.770078][T10876] EXT4-fs (loop1): Invalid log block size: 26624 [ 997.792331][T10872] attempt to access beyond end of device [ 997.792331][T10872] loop3: rw=34817, want=184, limit=16 07:15:28 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x100, 0x0}) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x28000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_config_ext={0x5, 0x8}, 0x4000, 0x0, 0x9, 0x7, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000001440)) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r1, 0xd000943e, 0x0) clone(0x40808000, 0x0, 0x0, 0x0, 0x0) r2 = gettid() tkill(r2, 0x1e) r3 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r3, 0x0) ptrace$cont(0x18, 0x0, 0x0, 0x1) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ptrace$cont(0x7, 0x0, 0x0, 0x10001) openat$full(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x2, 0x80, 0x4, 0x4, 0xe0, 0xb, 0x0, 0x0, 0x8000, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x8004, 0x2, @perf_bp={0x0}, 0x4000, 0x8000, 0xfffffff9, 0x7, 0x80000001, 0x8, 0x0, 0x0, 0x0, 0x0, 0x100000000}, r2, 0x8, 0xffffffffffffffff, 0x6ee4ca8bd5713173) [ 997.831226][T10876] loop1: detected capacity change from 0 to 4 [ 997.860847][T10876] EXT4-fs (loop1): Invalid log block size: 26624 [ 997.911036][ C0] sd 0:0:1:0: [sg0] tag#5682 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 997.921402][ C0] sd 0:0:1:0: [sg0] tag#5682 CDB: opcode=0xe5 (vendor) [ 997.928253][ C0] sd 0:0:1:0: [sg0] tag#5682 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 997.937835][ C0] sd 0:0:1:0: [sg0] tag#5682 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 997.947396][ C0] sd 0:0:1:0: [sg0] tag#5682 CDB[20]: ba 07:15:28 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\b\x00\x00', 0xfffffffffffffffe) 07:15:28 executing program 0: syz_mount_image$vfat(&(0x7f00000002c0), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f736617e43c00088020000200000004f8000020004000000000000000000001", 0x25}, {0x0, 0x0, 0x200000000011000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000080)='./bus\x00') r0 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6900) ftruncate(r0, 0x800) lseek(r0, 0x1200, 0x0) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, r1, 0x0, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @private2}, 0x1c) sendfile(r0, r1, 0x0, 0x108d1521) r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_FEATURES_SET(r2, 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHGPRL(0xffffffffffffffff, 0x89f7, &(0x7f00000001c0)={'ip6tnl0\x00', 0x0}) sendmsg$ETHTOOL_MSG_LINKINFO_GET(0xffffffffffffffff, 0x0, 0x0) sendfile(r0, r1, 0x0, 0x8400fffffffa) close(0xffffffffffffffff) 07:15:28 executing program 3: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000, 0x0, 0x0, 0x1000000}]) 07:15:28 executing program 4: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16002, 0x10000000}]) 07:15:28 executing program 1: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000180)='./file1\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="20000000360000001900000060008f000ff68f0100000000006c000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}], 0x0, &(0x7f0000000140)={[{@jqfmt_vfsv0}]}) 07:15:28 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x100, 0x0}) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x28000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_config_ext={0x5, 0x8}, 0x4000, 0x0, 0x9, 0x7, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000001440)) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r1, 0xd000943e, 0x0) clone(0x40808000, 0x0, 0x0, 0x0, 0x0) r2 = gettid() tkill(r2, 0x1e) r3 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r3, 0x0) ptrace$cont(0x18, 0x0, 0x0, 0x1) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ptrace$cont(0x7, 0x0, 0x0, 0x10001) openat$full(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x2, 0x80, 0x4, 0x4, 0xe0, 0xb, 0x0, 0x0, 0x8000, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x8004, 0x2, @perf_bp={0x0}, 0x4000, 0x8000, 0xfffffff9, 0x7, 0x80000001, 0x8, 0x0, 0x0, 0xa}, r2, 0x8, 0xffffffffffffffff, 0x6ee4ca8bd5713173) 07:15:28 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\t\x00\x00', 0xfffffffffffffffe) [ 998.324407][T10930] loop1: detected capacity change from 0 to 4 [ 998.339555][T10930] EXT4-fs (loop1): Invalid log block size: 27648 [ 998.346839][ C1] sd 0:0:1:0: [sg0] tag#5687 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 998.349105][T10937] loop3: detected capacity change from 0 to 16 [ 998.357209][ C1] sd 0:0:1:0: [sg0] tag#5687 CDB: opcode=0xe5 (vendor) 07:15:28 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\n\x00\x00', 0xfffffffffffffffe) [ 998.370648][ C1] sd 0:0:1:0: [sg0] tag#5687 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 998.380215][ C1] sd 0:0:1:0: [sg0] tag#5687 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 998.389967][ C1] sd 0:0:1:0: [sg0] tag#5687 CDB[20]: ba 07:15:28 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\v\x00\x00', 0xfffffffffffffffe) 07:15:28 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x100, 0x0}) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x28000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_config_ext={0x5, 0x8}, 0x4000, 0x0, 0x9, 0x7, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000001440)) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r1, 0xd000943e, 0x0) clone(0x40808000, 0x0, 0x0, 0x0, 0x0) r2 = gettid() tkill(r2, 0x1e) r3 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r3, 0x0) ptrace$cont(0x18, 0x0, 0x0, 0x1) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ptrace$cont(0x7, 0x0, 0x0, 0x10001) openat$full(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x2, 0x80, 0x4, 0x4, 0xe0, 0xb, 0x0, 0x0, 0x8000, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x8004, 0x2, @perf_bp={0x0}, 0x4000, 0x8000, 0xfffffff9, 0x7, 0x80000001, 0x8, 0x0, 0x0, 0xa}, r2, 0x8, 0xffffffffffffffff, 0x6ee4ca8bd5713173) [ 998.421730][T10937] attempt to access beyond end of device [ 998.421730][T10937] loop3: rw=34817, want=184, limit=16 07:15:28 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\f\x00\x00', 0xfffffffffffffffe) [ 998.483582][ C1] sd 0:0:1:0: [sg0] tag#5655 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 998.493973][ C1] sd 0:0:1:0: [sg0] tag#5655 CDB: opcode=0xe5 (vendor) [ 998.500870][ C1] sd 0:0:1:0: [sg0] tag#5655 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 998.510423][ C1] sd 0:0:1:0: [sg0] tag#5655 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 998.520015][ C1] sd 0:0:1:0: [sg0] tag#5655 CDB[20]: ba [ 998.532544][T10930] loop1: detected capacity change from 0 to 4 07:15:28 executing program 3: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000, 0x0, 0x0, 0x14ac000}]) 07:15:28 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\r\x00\x00', 0xfffffffffffffffe) [ 998.559431][T10930] EXT4-fs (loop1): Invalid log block size: 27648 [ 998.609331][T10976] loop4: detected capacity change from 0 to 16 [ 998.669503][T10987] loop3: detected capacity change from 0 to 16 07:15:29 executing program 0: syz_mount_image$vfat(&(0x7f00000002c0), &(0x7f0000000080)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000000140)="601c6d6b646f73661439bf55e43c00088020000200000004f8000100000000000000010000000000", 0x28}, {0x0, 0x0, 0x200000000011000}], 0x0, &(0x7f0000000100)=ANY=[@ANYRESOCT=0x0]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6900) ftruncate(r0, 0x800) lseek(r0, 0x1200, 0x0) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, r1, 0x0, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @private2}, 0x1c) sendfile(r0, r1, 0x0, 0x108d1521) r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_FEATURES_SET(r2, 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHGPRL(0xffffffffffffffff, 0x89f7, &(0x7f00000001c0)={'ip6tnl0\x00', 0x0}) sendmsg$ETHTOOL_MSG_LINKINFO_GET(0xffffffffffffffff, 0x0, 0x0) sendfile(r0, r1, 0x0, 0x8400fffffffa) close(0xffffffffffffffff) 07:15:29 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x100, 0x0}) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x28000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_config_ext={0x5, 0x8}, 0x4000, 0x0, 0x9, 0x7, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000001440)) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r1, 0xd000943e, 0x0) clone(0x40808000, 0x0, 0x0, 0x0, 0x0) r2 = gettid() tkill(r2, 0x1e) r3 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r3, 0x0) ptrace$cont(0x18, 0x0, 0x0, 0x1) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ptrace$cont(0x7, 0x0, 0x0, 0x10001) openat$full(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x2, 0x80, 0x4, 0x4, 0xe0, 0xb, 0x0, 0x0, 0x8000, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x8004, 0x2, @perf_bp={0x0}, 0x4000, 0x8000, 0xfffffff9, 0x7, 0x80000001, 0x8, 0x0, 0x0, 0xa}, r2, 0x8, 0xffffffffffffffff, 0x6ee4ca8bd5713173) 07:15:29 executing program 1: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000180)='./file1\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="20000000360000001900000060008f000ff68f0100008267bd72000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}], 0x0, &(0x7f0000000140)={[{@jqfmt_vfsv0}]}) 07:15:29 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\x0e\x00\x00', 0xfffffffffffffffe) 07:15:29 executing program 3: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000, 0x0, 0x0, 0x2000000}]) 07:15:29 executing program 4: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16002, 0x12000000}]) [ 999.375021][T11009] loop1: detected capacity change from 0 to 4 [ 999.385238][T11011] loop3: detected capacity change from 0 to 16 [ 999.390346][ C1] sd 0:0:1:0: [sg0] tag#5647 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 999.401744][ C1] sd 0:0:1:0: [sg0] tag#5647 CDB: opcode=0xe5 (vendor) [ 999.408597][ C1] sd 0:0:1:0: [sg0] tag#5647 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c 07:15:29 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\x0f\x00\x00', 0xfffffffffffffffe) [ 999.418236][ C1] sd 0:0:1:0: [sg0] tag#5647 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 999.423270][T11011] handle_bad_sector: 1 callbacks suppressed [ 999.423282][T11011] attempt to access beyond end of device [ 999.423282][T11011] loop3: rw=34817, want=184, limit=16 [ 999.427791][ C1] sd 0:0:1:0: [sg0] tag#5647 CDB[20]: ba [ 999.449160][T11009] EXT4-fs (loop1): Invalid log block size: 29373 07:15:29 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\x10\x00\x00', 0xfffffffffffffffe) [ 999.497474][T11031] loop4: detected capacity change from 0 to 16 07:15:29 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\x11\x00\x00', 0xfffffffffffffffe) 07:15:29 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\x12\x00\x00', 0xfffffffffffffffe) 07:15:29 executing program 3: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000, 0x0, 0x0, 0x2040000}]) 07:15:29 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00H\x00\x00', 0xfffffffffffffffe) [ 999.617709][T11009] loop1: detected capacity change from 0 to 4 [ 999.629154][T11009] EXT4-fs (loop1): Invalid log block size: 29373 [ 999.717588][T11070] loop3: detected capacity change from 0 to 16 [ 999.748624][T11070] attempt to access beyond end of device [ 999.748624][T11070] loop3: rw=34817, want=184, limit=16 07:15:30 executing program 0: syz_mount_image$vfat(&(0x7f00000002c0), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f736617e43c00088020000200000004f8000020004000000000000000000001", 0x25}, {0x0, 0x0, 0x200000000011000}], 0x0, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6900) ftruncate(r0, 0x800) lseek(r0, 0x1200, 0x0) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, r1, 0x0, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @private2}, 0x1c) sendfile(r0, r1, 0x0, 0x108d1521) r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_FEATURES_SET(r2, 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHGPRL(0xffffffffffffffff, 0x89f7, &(0x7f00000001c0)={'ip6tnl0\x00', 0x0}) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), r0) sendmsg$ETHTOOL_MSG_LINKINFO_GET(0xffffffffffffffff, 0x0, 0x0) sendfile(r0, r1, 0x0, 0x8400fffffffa) close(0xffffffffffffffff) 07:15:30 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x100, 0x0}) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x28000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_config_ext={0x5, 0x8}, 0x4000, 0x0, 0x9, 0x7, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000001440)) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r1, 0xd000943e, 0x0) clone(0x40808000, 0x0, 0x0, 0x0, 0x0) r2 = gettid() tkill(r2, 0x1e) r3 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r3, 0x0) ptrace$cont(0x18, 0x0, 0x0, 0x1) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ptrace$cont(0x7, 0x0, 0x0, 0x10001) openat$full(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x2, 0x80, 0x4, 0x4, 0xe0, 0xb, 0x0, 0x0, 0x8000, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x8004, 0x2, @perf_bp={0x0}, 0x4000, 0x8000, 0xfffffff9, 0x7, 0x80000001, 0x8, 0x0, 0x0, 0xa, 0x0, 0x100000000}, 0x0, 0x8, 0xffffffffffffffff, 0x6ee4ca8bd5713173) 07:15:30 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00L\x00\x00', 0xfffffffffffffffe) 07:15:30 executing program 1: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000180)='./file1\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="20000000360000001900000060008f000ff68f01000000000074000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}], 0x0, &(0x7f0000000140)={[{@jqfmt_vfsv0}]}) 07:15:30 executing program 4: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16002, 0x16000000}]) 07:15:30 executing program 3: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000, 0x0, 0x0, 0x3000000}]) [ 1000.351448][ C1] sd 0:0:1:0: [sg0] tag#5670 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 1000.351642][T11093] loop3: detected capacity change from 0 to 16 [ 1000.361953][ C1] sd 0:0:1:0: [sg0] tag#5670 CDB: opcode=0xe5 (vendor) [ 1000.368627][T11096] loop1: detected capacity change from 0 to 4 [ 1000.375306][ C1] sd 0:0:1:0: [sg0] tag#5670 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 1000.391006][ C1] sd 0:0:1:0: [sg0] tag#5670 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d 07:15:30 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00h\x00\x00', 0xfffffffffffffffe) [ 1000.400597][ C1] sd 0:0:1:0: [sg0] tag#5670 CDB[20]: ba [ 1000.404281][T11096] EXT4-fs (loop1): Invalid log block size: 29696 [ 1000.437115][T11093] attempt to access beyond end of device [ 1000.437115][T11093] loop3: rw=34817, want=184, limit=16 07:15:30 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00l\x00\x00', 0xfffffffffffffffe) 07:15:30 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00t\x00\x00', 0xfffffffffffffffe) 07:15:30 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x100, 0x0}) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x28000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_config_ext={0x5, 0x8}, 0x4000, 0x0, 0x9, 0x7, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000001440)) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r1, 0xd000943e, 0x0) clone(0x40808000, 0x0, 0x0, 0x0, 0x0) r2 = gettid() tkill(r2, 0x1e) r3 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r3, 0x0) ptrace$cont(0x18, 0x0, 0x0, 0x1) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ptrace$cont(0x7, 0x0, 0x0, 0x10001) openat$full(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x2, 0x80, 0x4, 0x4, 0xe0, 0xb, 0x0, 0x0, 0x8000, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x8004, 0x2, @perf_bp={0x0}, 0x4000, 0x8000, 0xfffffff9, 0x7, 0x80000001, 0x8, 0x0, 0x0, 0xa, 0x0, 0x100000000}, 0x0, 0x8, 0xffffffffffffffff, 0x6ee4ca8bd5713173) [ 1000.544102][T11096] loop1: detected capacity change from 0 to 4 [ 1000.564493][T11096] EXT4-fs (loop1): Invalid log block size: 29696 [ 1000.572538][ C0] sd 0:0:1:0: [sg0] tag#5645 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 1000.582913][ C0] sd 0:0:1:0: [sg0] tag#5645 CDB: opcode=0xe5 (vendor) 07:15:30 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00z\x00\x00', 0xfffffffffffffffe) 07:15:30 executing program 1: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000180)='./file1\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="20000000360000001900000060008f000ff68f0100000000007a000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}], 0x0, &(0x7f0000000140)={[{@jqfmt_vfsv0}]}) [ 1000.589796][ C0] sd 0:0:1:0: [sg0] tag#5645 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 1000.597944][T11135] loop4: detected capacity change from 0 to 16 [ 1000.599331][ C0] sd 0:0:1:0: [sg0] tag#5645 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 1000.599350][ C0] sd 0:0:1:0: [sg0] tag#5645 CDB[20]: ba [ 1000.702778][T11150] loop1: detected capacity change from 0 to 4 [ 1000.718753][T11150] EXT4-fs (loop1): Invalid log block size: 31232 [ 1000.774476][T11150] loop1: detected capacity change from 0 to 4 [ 1000.786434][T11150] EXT4-fs (loop1): Invalid log block size: 31232 07:15:31 executing program 0: syz_mount_image$vfat(&(0x7f00000002c0), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000200)=[{&(0x7f0000010000)="601c6d6b646f736617e43c00088020000200000004f8000020004000000000000000000001", 0x25}, {0x0, 0x0, 0x200000000011000}], 0x280c002, &(0x7f0000000180)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6900) ftruncate(r0, 0x800) lseek(r0, 0x1200, 0x0) socket(0x21, 0x2, 0x2) r1 = socket$inet(0x2, 0x1, 0x0) setsockopt$IP_VS_SO_SET_TIMEOUT(r1, 0x0, 0x48a, 0x0, 0x0) r2 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, r2, 0x0, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @private2}, 0x1c) sendfile(r0, r2, 0x0, 0x108d1521) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_FEATURES_SET(r3, 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHGPRL(0xffffffffffffffff, 0x89f7, &(0x7f00000001c0)={'ip6tnl0\x00', 0x0}) sendmsg$ETHTOOL_MSG_LINKINFO_GET(0xffffffffffffffff, 0x0, 0x0) sendfile(r0, r2, 0x0, 0x8400fffffffa) close(0xffffffffffffffff) 07:15:31 executing program 3: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000, 0x0, 0x0, 0x4000000}]) 07:15:31 executing program 4: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16002, 0x17000000}]) 07:15:31 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x100, 0x0}) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x28000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_config_ext={0x5, 0x8}, 0x4000, 0x0, 0x9, 0x7, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000001440)) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r1, 0xd000943e, 0x0) clone(0x40808000, 0x0, 0x0, 0x0, 0x0) r2 = gettid() tkill(r2, 0x1e) r3 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r3, 0x0) ptrace$cont(0x18, 0x0, 0x0, 0x1) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ptrace$cont(0x7, 0x0, 0x0, 0x10001) openat$full(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x2, 0x80, 0x4, 0x4, 0xe0, 0xb, 0x0, 0x0, 0x8000, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x8004, 0x2, @perf_bp={0x0}, 0x4000, 0x8000, 0xfffffff9, 0x7, 0x80000001, 0x8, 0x0, 0x0, 0xa, 0x0, 0x100000000}, 0x0, 0x8, 0xffffffffffffffff, 0x6ee4ca8bd5713173) 07:15:31 executing program 1: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000180)='./file1\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="20000000360000001900000060008f000ff68f01000072bd6782000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}], 0x0, &(0x7f0000000140)={[{@jqfmt_vfsv0}]}) 07:15:31 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\x00\x03\x00', 0xfffffffffffffffe) 07:15:31 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\x00\x05\x00', 0xfffffffffffffffe) [ 1001.224571][T11185] loop1: detected capacity change from 0 to 4 [ 1001.234299][T11185] EXT4-fs (loop1): Invalid log block size: 33383 [ 1001.244717][T11184] loop3: detected capacity change from 0 to 16 [ 1001.260377][T11195] loop4: detected capacity change from 0 to 16 [ 1001.273758][T11185] loop1: detected capacity change from 0 to 4 [ 1001.274177][T11190] blk_update_request: I/O error, dev loop1, sector 0 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 0 [ 1001.307227][T11185] EXT4-fs (loop1): Invalid log block size: 33383 07:15:31 executing program 1: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000180)='./file1\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="20000000360000001900000060008f000ff68f010000ffffff85000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}], 0x0, &(0x7f0000000140)={[{@jqfmt_vfsv0}]}) 07:15:31 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\x00\x06\x00', 0xfffffffffffffffe) [ 1001.335894][T11184] attempt to access beyond end of device [ 1001.335894][T11184] loop3: rw=34817, want=184, limit=16 07:15:31 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\x00\a\x00', 0xfffffffffffffffe) [ 1001.385048][T11214] loop1: detected capacity change from 0 to 4 [ 1001.400887][T11214] EXT4-fs (loop1): Invalid log block size: 34303 07:15:31 executing program 4: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16002, 0x3f000000}]) 07:15:31 executing program 3: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000, 0x0, 0x0, 0x5000000}]) [ 1001.478309][T11214] loop1: detected capacity change from 0 to 4 [ 1001.499385][T11214] EXT4-fs (loop1): Invalid log block size: 34303 [ 1001.528792][T11236] loop3: detected capacity change from 0 to 16 [ 1001.551241][T11236] attempt to access beyond end of device [ 1001.551241][T11236] loop3: rw=34817, want=184, limit=16 [ 1001.611169][T11248] loop4: detected capacity change from 0 to 16 07:15:32 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\x00\t\x00', 0xfffffffffffffffe) 07:15:32 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x100, 0x0}) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x28000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_config_ext={0x5, 0x8}, 0x4000, 0x0, 0x9, 0x7, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000001440)) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r1, 0xd000943e, 0x0) clone(0x40808000, 0x0, 0x0, 0x0, 0x0) r2 = gettid() tkill(r2, 0x1e) r3 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r3, 0x0) ptrace$cont(0x18, 0x0, 0x0, 0x1) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ptrace$cont(0x7, 0x0, 0x0, 0x10001) openat$full(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x2, 0x80, 0x4, 0x4, 0xe0, 0xb, 0x0, 0x0, 0x8000, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x8004, 0x2, @perf_bp={0x0}, 0x4000, 0x8000, 0xfffffff9, 0x7, 0x80000001, 0x8, 0x0, 0x0, 0xa, 0x0, 0x100000000}, r2, 0x0, 0xffffffffffffffff, 0x6ee4ca8bd5713173) 07:15:32 executing program 1: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000180)='./file1\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="20000000360000001900000060008f000ff68f010000ffffff8c000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}], 0x0, &(0x7f0000000140)={[{@jqfmt_vfsv0}]}) 07:15:32 executing program 3: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000, 0x0, 0x0, 0x6000000}]) 07:15:32 executing program 0: syz_mount_image$vfat(&(0x7f00000002c0), &(0x7f0000000100)='./file0\x00', 0xfffffffffffffffc, 0x0, &(0x7f0000000200), 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0179de354efa5eb85caa6d56d0bb5387db074c63e6fe4f6e5e7bd1a0a639f7acded75e"]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6900) ftruncate(r0, 0x80c) lseek(r0, 0x1200, 0x0) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, r1, 0x0, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @private2}, 0x1c) sendfile(r0, r1, 0x0, 0x108d1521) r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_FEATURES_SET(r2, 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHGPRL(0xffffffffffffffff, 0x89f7, &(0x7f00000001c0)={'ip6tnl0\x00', 0x0}) sendmsg$ETHTOOL_MSG_LINKINFO_GET(0xffffffffffffffff, 0x0, 0x0) sendfile(r0, r1, 0x0, 0x8400fffffffa) close(0xffffffffffffffff) getsockopt$inet_buf(0xffffffffffffffff, 0x0, 0x50, &(0x7f0000001280)=""/4068, &(0x7f0000000040)=0xfe4) ioctl$FS_IOC_MEASURE_VERITY(0xffffffffffffffff, 0xc0046686, &(0x7f0000000300)={0x2, 0xa6, "e32e5d0f67f29dd2c2047b416aa93eb87c74e454600ffc8aa317f57404e187cb39045dd69833e62ed2522cd93a2395e7173c716d58450e1d3706388aedacc830086279c4430a522f3dc07ba7186f6b4a602a5e7b1e53f84bf3b317b1836394353efb52b809ceb621bcb4363129ab78cced938b3a115b581f536fc7d6814846da8e3cf14a122696b1b7226d3e8d4bec6aac212c7b5172535adeebb58b189cc74daa492f1f0401"}) 07:15:32 executing program 4: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16002, 0x40000000}]) 07:15:32 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\x00\n\x00', 0xfffffffffffffffe) [ 1002.200326][T11266] loop3: detected capacity change from 0 to 16 [ 1002.205539][T11267] loop1: detected capacity change from 0 to 4 [ 1002.207936][ C1] scsi_io_completion_action: 1 callbacks suppressed [ 1002.207959][ C1] sd 0:0:1:0: [sg0] tag#5670 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 1002.227373][T11267] EXT4-fs (loop1): Invalid log block size: 36095 [ 1002.229508][ C1] sd 0:0:1:0: [sg0] tag#5670 CDB: opcode=0xe5 (vendor) [ 1002.242689][ C1] sd 0:0:1:0: [sg0] tag#5670 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 1002.252248][ C1] sd 0:0:1:0: [sg0] tag#5670 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 1002.261807][ C1] sd 0:0:1:0: [sg0] tag#5670 CDB[20]: ba [ 1002.265090][T11278] loop4: detected capacity change from 0 to 16 07:15:32 executing program 0: syz_mount_image$vfat(&(0x7f00000002c0), &(0x7f0000000100)='./bus\x00', 0x1, 0x2, &(0x7f0000000200)=[{&(0x7f0000000240)="60070e00000000000000000600", 0xd}, {0x0, 0x0, 0x200000000011000}], 0x0, &(0x7f0000000640)=ANY=[@ANYRES16, @ANYBLOB="f84a8a49e8a289a017273fa983c8eb3cdc35fb76eac079067e6ffa7e19b04598ad899538e2269b31308be788be57ca2f4e8409dd49c834f4332d2421f3ad4c4bbaad7bf8b8f1138008cbbceb63a720ed4a14173b147949b522604502f4297f8f55b8ff4efb5062d93a20703a0958fdfb231e9eb3b5753362bdf5a6e183e772269a373321d8464fade74361602d8243", @ANYRES16, @ANYRESOCT, @ANYRES64, @ANYRESDEC, @ANYRESHEX, @ANYBLOB="c8b9ac981cd13848ae5fed3c21806663b7e53a8cb1841f7e5703293c10bc016a2df00bcc395a5638ce3f696d0996ec131f8c82b8c491b5b1cb6bdfe2d21484165e8c2f6d56d7fb94c14f62575862b1516ea850fd938d954e3256bb01436f2c1e9cdb892dfb7fddd06110ea533629d0f6aa2a39e49f7100036ae801ba49fbae32a3ae5fbe6e11335eddea01b0810ef6e20c32a1375f5797ba349debc99c9eb7b8d98427efc426664e83b0fdf88634d2ace24c05d456184218f2450b7c90b5fa4c1cd1ef1ef43ad0d6f42b4b6a86", @ANYRESHEX]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6900) ftruncate(r0, 0x800) lseek(r0, 0x1200, 0x0) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, 0x0, 0x0) r1 = open(&(0x7f0000000180)='./bus\x00', 0x0, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f0000000140)={0x1, &(0x7f0000000080)=[{0x2, 0x5, 0x9, 0xffff8001}]}) socket$inet(0x2, 0x1, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x1) bind$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @private2}, 0x1c) sendfile(r0, r1, 0x0, 0x108d1521) r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_FEATURES_SET(r2, 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHGPRL(0xffffffffffffffff, 0x89f7, &(0x7f00000001c0)={'ip6tnl0\x00', 0x0}) sendmsg$ETHTOOL_MSG_LINKINFO_GET(0xffffffffffffffff, 0x0, 0x0) sendfile(r0, r1, 0x0, 0x8400fffffffa) close(0xffffffffffffffff) 07:15:32 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\x00\v\x00', 0xfffffffffffffffe) 07:15:32 executing program 1: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000180)='./file1\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="20000000360000001900000060008f000ff68f010000ffffff97000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}], 0x0, &(0x7f0000000140)={[{@jqfmt_vfsv0}]}) [ 1002.320708][T11266] attempt to access beyond end of device [ 1002.320708][T11266] loop3: rw=34817, want=184, limit=16 07:15:32 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\x00\f\x00', 0xfffffffffffffffe) [ 1002.381155][T11309] loop1: detected capacity change from 0 to 4 07:15:32 executing program 2: r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x100, 0x0}) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x28000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, @perf_config_ext={0x5, 0x8}, 0x4000, 0x0, 0x9, 0x7, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xa) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/tty/ldiscs\x00', 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(0xffffffffffffffff, 0x81f8943c, &(0x7f0000001440)) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r1, 0xd000943e, 0x0) clone(0x40808000, 0x0, 0x0, 0x0, 0x0) r2 = gettid() tkill(r2, 0x1e) r3 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x180000f, 0x12, r3, 0x0) ptrace$cont(0x18, 0x0, 0x0, 0x1) preadv(r3, &(0x7f0000000280), 0x18, 0xd9f, 0x0) ptrace$cont(0x7, 0x0, 0x0, 0x10001) openat$full(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) perf_event_open(&(0x7f0000000240)={0x2, 0x80, 0x4, 0x4, 0xe0, 0xb, 0x0, 0x0, 0x8000, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x8004, 0x2, @perf_bp={0x0}, 0x4000, 0x8000, 0xfffffff9, 0x7, 0x80000001, 0x8, 0x0, 0x0, 0xa, 0x0, 0x100000000}, r2, 0x0, 0xffffffffffffffff, 0x6ee4ca8bd5713173) 07:15:32 executing program 3: syz_mount_image$vfat(&(0x7f0000000200), &(0x7f0000000100)='./file0\x00', 0x0, 0x2, &(0x7f0000000080)=[{&(0x7f00000002c0)="eb3c8f000000732e66617400020101000240008080f801", 0x17}, {0x0, 0x0, 0x1000}], 0x0, &(0x7f0000000000)=ANY=[]) chdir(&(0x7f0000000040)='./file0\x00') r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x6000) io_setup(0x202, &(0x7f00000003c0)=0x0) r2 = open(&(0x7f0000000180)='./bus\x00', 0x100000169042, 0x0) ftruncate(r2, 0x10099b8) io_submit(r1, 0x3, &(0x7f0000000540)=[&(0x7f00000000c0)={0x25, 0x3a5, 0x2, 0x1, 0x0, r0, &(0x7f0000000000), 0x16000, 0x0, 0x0, 0x6040000}]) [ 1002.427367][T11309] EXT4-fs (loop1): Invalid log block size: 38911 [ 1002.459797][ C1] sd 0:0:1:0: [sg0] tag#5641 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 1002.470215][ C1] sd 0:0:1:0: [sg0] tag#5641 CDB: opcode=0xe5 (vendor) 07:15:32 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x00\x00\x00\r\x00', 0xfffffffffffffffe) [ 1002.477167][ C1] sd 0:0:1:0: [sg0] tag#5641 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 1002.486759][ C1] sd 0:0:1:0: [sg0] tag#5641 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 1002.496306][ C1] sd 0:0:1:0: [sg0] tag#5641 CDB[20]: ba [ 1002.528255][T11309] loop1: detected capacity change from 0 to 4 [ 1002.552783][T11309] EXT4-fs (loop1): Invalid log block size: 38911 07:15:32 executing program 1: syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000180)='./file1\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="20000000360000001900000060008f000ff68f0100000000edc0000004000000000002000020000020000000ddf4655fddf4655f0100ffff53ef010001000000ddf4655f000000000000000001000000000000000b0000000001000008000000d24200001203", 0x66, 0x400}], 0x0, &(0x7f0000000140)={[{@jqfmt_vfsv0}]}) [ 1002.577032][T11341] loop3: detected capacity change from 0 to 16 07:15:32 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x800006, 0x12, r0, 0x0) preadv(r0, &(0x7f0000000280), 0x18, 0xd9f, 0x0) request_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000001ffb)={'syz', 0x1}, &(0x7f0000001fee)='R\t\x00\x00\x00\x02\x00\x00\x84\x00\x00\x00\x00\x