7f00000009c0)=[{0xa0, 0x1ff, 0x800, "434c94cf096ca2c6e3a8a6433ea1ccf960ad859f9cabeb13bbcd113f89069f10afdedfc1c2c2a6455dc4d1cc5b8c42e105db6d89e5394ec484d7db74d839a1021c616111655c01f0d6840a2cc4a77a0a2613073b0d1e9ab634a70c9cafd212450fe14e5e32b6ee05d11e22515b1b820c7425d601c3c41b459046978582375e37f0268020620ba8c96a1cf8de5399"}, {0x20, 0x113, 0x3, "64bc63fb1e5bc65e5043"}], 0xc0, 0x4040000}, 0x4000040) r2 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r2, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) [ 507.351194] Buffer I/O error on dev loop5, logical block 132, lost async page write [ 507.402393] attempt to access beyond end of device [ 507.436066] loop5: rw=1, want=142, limit=112 06:07:08 executing program 4: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) r1 = socket$inet6(0xa, 0x5, 0x0) r2 = syz_genetlink_get_family_id$ipvs(&(0x7f00000007c0)='IPVS\x00') r3 = socket$inet6(0xa, 0x400000000001, 0x0) ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000000)) ioctl$sock_inet_SIOCSIFFLAGS(r3, 0x8914, &(0x7f0000000040)={"626f6e643000000001feffff00"}) getsockopt$inet_sctp6_SCTP_INITMSG(r1, 0x84, 0x2, &(0x7f00000004c0), &(0x7f0000000500)=0x8) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8923, &(0x7f00000000c0)={'bond0\x00', 0xfff}) setsockopt$inet6_MCAST_LEAVE_GROUP(r3, 0x29, 0x2d, &(0x7f0000000800)={0x32e, {{0xa, 0x4e24, 0x6f5, @dev={0xfe, 0x80, [], 0xd}, 0x100000000}}}, 0x88) fsetxattr(r1, &(0x7f0000000400)=@known='trusted.overlay.nlink\x00', &(0x7f0000000540)="626f6e643000000001feffff00", 0xd, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r1, 0x29, 0x14, &(0x7f0000000040)={@mcast2}, 0x20) sendmsg$IPVS_CMD_GET_DEST(0xffffffffffffffff, &(0x7f0000000740)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000700)={&(0x7f00000000c0)=ANY=[@ANYBLOB="14000000", @ANYRES16=0x0, @ANYBLOB="fc01000100000000000008000000"], 0x14}}, 0xffffffffffffffff) r4 = syz_open_dev$sndpcmp(&(0x7f00000005c0)='/dev/snd/pcmC#D#p\x00', 0x0, 0x0) sendmsg$IPVS_CMD_GET_SERVICE(r4, &(0x7f0000000780)={&(0x7f0000000600)={0x10, 0x0, 0x0, 0x4c6116cec1bcabea}, 0xc, &(0x7f00000006c0)={&(0x7f0000000640)={0x44, r2, 0x300, 0x70bd2c, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_DEST={0xc, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x1ff}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x3959}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_ACTIVE_CONNS={0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2, 0x4e23}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0xab5}]}, 0x44}, 0x1, 0x0, 0x0, 0x10}, 0x20000000) setsockopt$inet_MCAST_JOIN_GROUP(0xffffffffffffffff, 0x0, 0x2a, &(0x7f0000000140)={0x0, {{0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x17}}}}, 0x84) syncfs(r0) r5 = syz_open_dev$sndpcmc(&(0x7f0000000080)='/dev/snd/pcmC#D#c\x00', 0x4, 0x80002) ioctl$sock_inet_SIOCSIFPFLAGS(r1, 0x8934, &(0x7f0000000580)={'team_slave_1\x00', 0x7}) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r5, &(0x7f0000000480)={0x5, 0x10, 0xfa00, {&(0x7f0000000200), 0xffffffffffffffff, 0x1}}, 0x18) connect$l2tp(r5, &(0x7f0000000000)=@pppol2tpin6={0x18, 0x1, {0x0, r3, 0x1, 0x3, 0x3, 0x0, {0xa, 0x4e23, 0x101, @remote, 0x6}}}, 0x32) ioctl$TIOCNOTTY(r5, 0x5422) [ 507.462645] Buffer I/O error on dev loop5, logical block 141, lost async page write [ 507.471325] attempt to access beyond end of device [ 507.497689] loop5: rw=1, want=143, limit=112 [ 507.502138] Buffer I/O error on dev loop5, logical block 142, lost async page write 06:07:08 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca580582050000000000b893123f89dedb03442000000000000000000000", @ANYRES32], 0x2}}, 0x0) [ 507.513844] FAT-fs (loop3): Unrecognized mount option "v]HFɁ8XLzR@z３IZdQh^I3yl" or missing value [ 507.620665] attempt to access beyond end of device [ 507.650159] loop5: rw=1, want=144, limit=112 06:07:08 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca580500ffffff9e0000b893123f89dedb03442000000000000000000000", @ANYRES32], 0x2}}, 0x0) [ 507.678803] Buffer I/O error on dev loop5, logical block 143, lost async page write [ 507.729733] FAT-fs (loop3): Unrecognized mount option "v]HFɁ8XLzR@z３IZdQh^I3yl" or missing value [ 507.745517] attempt to access beyond end of device 06:07:08 executing program 2: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = socket$inet6(0xa, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp={0x2c, 0x0, 0x0, 0x3d}, 0x80) openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000900)="b6", 0x1}], 0x1, &(0x7f00000009c0)=[{0xa0, 0x1ff, 0x800, "434c94cf096ca2c6e3a8a6433ea1ccf960ad859f9cabeb13bbcd113f89069f10afdedfc1c2c2a6455dc4d1cc5b8c42e105db6d89e5394ec484d7db74d839a1021c616111655c01f0d6840a2cc4a77a0a2613073b0d1e9ab634a70c9cafd212450fe14e5e32b6ee05d11e22515b1b820c7425d601c3c41b459046978582375e37f0268020620ba8c96a1cf8de5399"}, {0x20, 0x113, 0x3, "64bc63fb1e5bc65e5043"}], 0xc0, 0x4040000}, 0x4000040) r2 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r2, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) [ 507.794812] loop5: rw=1, want=145, limit=112 [ 507.810275] Buffer I/O error on dev loop5, logical block 144, lost async page write [ 507.862785] attempt to access beyond end of device [ 507.880689] loop5: rw=1, want=2178, limit=112 06:07:09 executing program 5: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = socket$inet6(0xa, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp={0x2c, 0x0, 0x0, 0x3d}, 0x80) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r2, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000900)="b6d35518b48becfbd314d1fa96a307da879125869c71d40c5a385ce1d3af47c69a6acba0142b27475f2f890e1446d7e0851a8c84b5", 0x35}], 0x1, &(0x7f00000009c0), 0x0, 0x4040000}, 0x4000040) r3 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r3, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:07:09 executing program 1: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = socket$inet6(0xa, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp={0x2c, 0x0, 0x0, 0x3d}, 0x80) gettid() ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000440)="bd5281e90e382e49bc31c58bec93575c69955b99c59ad4bd0fe49bfd7fe94d8885ab76161d9ce31d5d33721046808670be4653c0cc84b9da38535652f4ed2dc5c76b973366cda5cd22c8854b38e0bd58358a1c4321e295b32e956b0a7b25eb0cb616e08644cfab02fce229997b4ca12d8723eff6b59433fc01a0bd53b5f45a48e6ca29d035", 0x85}, {&(0x7f0000000600)="ee02b064c6289979b056ec862d34542624a8ef094eb3a6d305a6b17837f96191c27fc94f9efbd066e7e2aafbbf5452c61d49dff03991631cf6114f7113ed7e182e0d1b123bef992a4116ec55c036280818e436412b534c08c3dc283c7c9b4b455a38317ada3f0c861359a91d527f65a55a36cf34ce77f48745b116b0e4b4ef2b2ed9e1b16e6fb87b15bc5525f19be536cfb606be0f5e94fb6d503ebea5d3a1ed62d5ed5ada217fa9f737221eb398002f72faccd90f01e2fac7fb2097abded2aad0df01", 0xc3}, {&(0x7f0000000900)="b6d35518b48becfbd314d1fa96a307da879125869c71d40c5a385ce1d3af47c69a6acba0142b27475f2f890e1446d7e0851a8c84b5cc192ecdcc36e574f7f7996872b86ab02a1483169b257a8026ce3c23855275080d876355a8d08d92386b82dc72cc793a6ae4", 0x67}], 0x3, &(0x7f00000009c0)=[{0xa0, 0x1ff, 0x800, "434c94cf096ca2c6e3a8a6433ea1ccf960ad859f9cabeb13bbcd113f89069f10afdedfc1c2c2a6455dc4d1cc5b8c42e105db6d89e5394ec484d7db74d839a1021c616111655c01f0d6840a2cc4a77a0a2613073b0d1e9ab634a70c9cafd212450fe14e5e32b6ee05d11e22515b1b820c7425d601c3c41b459046978582375e37f0268020620ba8c96a1cf8de5399"}, {0x20, 0x113, 0x3, "64bc63fb1e5bc65e5043"}], 0xc0, 0x4040000}, 0x4000040) r2 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r2, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:07:09 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca58050000f000000000b893123f89dedb03442000000000000000000000", @ANYRES32], 0x2}}, 0x0) 06:07:09 executing program 4: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x2) r1 = socket$inet6(0xa, 0x5, 0x2000000) syz_genetlink_get_family_id$ipvs(&(0x7f0000000440)='IPVS\x00') r2 = socket$inet6(0xa, 0x400000000001, 0x0) ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000000)) ioctl$sock_inet_SIOCSIFFLAGS(r2, 0x8914, &(0x7f0000000040)={"626f6e643000000001feffff00"}) getsockopt$inet_sctp6_SCTP_INITMSG(r1, 0x84, 0x2, &(0x7f00000004c0), &(0x7f0000000500)=0x8) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8923, &(0x7f00000000c0)={'bond0\x00', 0xfff}) fsetxattr(r1, &(0x7f0000000400)=@known='trusted.overlay.nlink\x00', &(0x7f0000000540)="626f6e643000000001feffff00", 0xd, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r1, 0x29, 0x14, &(0x7f0000000040)={@mcast2}, 0x20) sendmsg$IPVS_CMD_GET_DEST(0xffffffffffffffff, &(0x7f0000000740)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000700)={&(0x7f00000000c0)={0x14, 0x0, 0xfffffffffffffffc, 0x2}, 0x14}}, 0xffffffffffffffff) setsockopt$inet_MCAST_JOIN_GROUP(0xffffffffffffffff, 0x0, 0x2a, &(0x7f0000000140)={0x0, {{0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x17}}}}, 0x84) syncfs(r0) r3 = syz_open_dev$sndpcmc(&(0x7f0000000080)='/dev/snd/pcmC#D#c\x00', 0x4, 0x80002) ioctl$sock_inet_SIOCSIFPFLAGS(r1, 0x8934, &(0x7f0000000580)={'team_slave_1\x00', 0x7}) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r3, &(0x7f0000000480)={0x5, 0x10, 0xfa00, {&(0x7f0000000200), 0xffffffffffffffff, 0x1}}, 0x18) pipe(&(0x7f00000005c0)) connect$l2tp(r3, &(0x7f0000000000)=@pppol2tpin6={0x18, 0x1, {0x0, r2, 0x1, 0x3, 0x3, 0x0, {0xa, 0x4e23, 0x101, @remote, 0x6}}}, 0x32) ioctl$TIOCNOTTY(r3, 0x5422) 06:07:09 executing program 3: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r1, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x3, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)=[{0x10, 0x107, 0x5}], 0x10, 0x20040000}, 0x8001) sendto$unix(0xffffffffffffffff, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r0) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:07:09 executing program 2: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = socket$inet6(0xa, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp={0x2c, 0x0, 0x0, 0x3d}, 0x80) openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000900)="b6", 0x1}], 0x1, &(0x7f00000009c0)=[{0xa0, 0x1ff, 0x800, "434c94cf096ca2c6e3a8a6433ea1ccf960ad859f9cabeb13bbcd113f89069f10afdedfc1c2c2a6455dc4d1cc5b8c42e105db6d89e5394ec484d7db74d839a1021c616111655c01f0d6840a2cc4a77a0a2613073b0d1e9ab634a70c9cafd212450fe14e5e32b6ee05d11e22515b1b820c7425d601c3c41b459046978582375e37f0268020620ba8c96a1cf8de5399"}, {0x20, 0x113, 0x3, "64bc63fb1e5bc65e5043"}], 0xc0, 0x4040000}, 0x4000040) r2 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r2, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) [ 508.305953] attempt to access beyond end of device [ 508.310946] loop2: rw=1, want=130, limit=112 [ 508.310964] Buffer I/O error on dev loop2, logical block 129, lost async page write [ 508.311006] attempt to access beyond end of device [ 508.329266] loop2: rw=1, want=131, limit=112 [ 508.333927] Buffer I/O error on dev loop2, logical block 130, lost async page write [ 508.349347] attempt to access beyond end of device 06:07:09 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca58050000f0ffff0000b893123f89dedb03442000000000000000000000", @ANYRES32], 0x2}}, 0x0) [ 508.354472] loop5: rw=1, want=130, limit=112 [ 508.379249] attempt to access beyond end of device [ 508.398577] attempt to access beyond end of device [ 508.411940] loop2: rw=1, want=132, limit=112 [ 508.419905] loop5: rw=1, want=131, limit=112 [ 508.436273] attempt to access beyond end of device [ 508.450192] attempt to access beyond end of device [ 508.463174] loop5: rw=1, want=132, limit=112 [ 508.480577] loop2: rw=1, want=133, limit=112 [ 508.492711] attempt to access beyond end of device 06:07:09 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca580500f0ffffff0000b893123f89dedb03442000000000000000000000", @ANYRES32], 0x2}}, 0x0) [ 508.513907] attempt to access beyond end of device 06:07:09 executing program 3: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r1, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x3, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)=[{0x10, 0x107, 0x5}], 0x10, 0x20040000}, 0x8001) sendto$unix(0xffffffffffffffff, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r0) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) r2 = request_key(&(0x7f0000000340)='dns_resolver\x00', &(0x7f0000000380)={'syz', 0x2}, &(0x7f00000003c0)='vfat\x00', 0xfffffffffffffffd) add_key(&(0x7f0000000080)='id_legacy\x00', &(0x7f00000000c0)={'syz', 0x2}, &(0x7f00000001c0)="df3729fe5d012f7db3fac2bb0e513195a238b7ff94546c5dbed37e6c56737c723525dc331e2b294d5d2f", 0x2a, r2) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x400}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:07:09 executing program 1: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = socket$inet6(0xa, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp={0x2c, 0x0, 0x0, 0x3d}, 0x80) gettid() ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000440)="bd5281e90e382e49bc31c58bec93575c69955b99c59ad4bd0fe49bfd7fe94d8885ab76161d9ce31d5d33721046808670be4653c0cc84b9da38535652f4ed2dc5c76b973366cda5cd22c8854b38e0bd58358a1c4321e295b32e956b0a7b25eb0cb616e08644cfab02fce229997b4ca12d8723eff6b59433fc01a0bd53b5f45a48e6ca29d035", 0x85}, {&(0x7f0000000600)="ee02b064c6289979b056ec862d34542624a8ef094eb3a6d305a6b17837f96191c27fc94f9efbd066e7e2aafbbf5452c61d49dff03991631cf6114f7113ed7e182e0d1b123bef992a4116ec55c036280818e436412b534c08c3dc283c7c9b4b455a38317ada3f0c861359a91d527f65a55a36cf34ce77f48745b116b0e4b4ef2b2ed9e1b16e6fb87b15bc5525f19be536cfb606be0f5e94fb6d503ebea5d3a1ed62d5ed5ada217fa9f737221eb398002f72faccd90f01e2fac7fb2097abded2aad0df01", 0xc3}, {&(0x7f0000000900)="b6d35518b48becfbd314d1fa96a307da879125869c71d40c5a385ce1d3af47c69a6acba0142b27475f2f890e1446d7e0851a8c84b5cc192ecdcc36e574f7f7996872b86ab02a1483169b257a8026ce3c23855275080d876355a8d08d92386b82dc72cc793a6ae4", 0x67}], 0x3, &(0x7f00000009c0)=[{0xa0, 0x1ff, 0x800, "434c94cf096ca2c6e3a8a6433ea1ccf960ad859f9cabeb13bbcd113f89069f10afdedfc1c2c2a6455dc4d1cc5b8c42e105db6d89e5394ec484d7db74d839a1021c616111655c01f0d6840a2cc4a77a0a2613073b0d1e9ab634a70c9cafd212450fe14e5e32b6ee05d11e22515b1b820c7425d601c3c41b459046978582375e37f0268020620ba8c96a1cf8de5399"}, {0x20, 0x113, 0x3, "64bc63fb1e5bc65e5043"}], 0xc0, 0x4040000}, 0x4000040) r2 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r2, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) [ 508.534834] loop5: rw=1, want=133, limit=112 [ 508.550083] loop2: rw=1, want=142, limit=112 [ 508.562132] attempt to access beyond end of device [ 508.576285] attempt to access beyond end of device 06:07:09 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca580500820500000000b893123f89dedb03442000000000000000000000", @ANYRES32], 0x2}}, 0x0) [ 508.584681] loop5: rw=1, want=142, limit=112 [ 508.595170] loop2: rw=1, want=143, limit=112 [ 508.599891] attempt to access beyond end of device [ 508.609201] attempt to access beyond end of device [ 508.615295] loop5: rw=1, want=143, limit=112 [ 508.618078] loop2: rw=1, want=144, limit=112 [ 508.622319] attempt to access beyond end of device [ 508.626867] attempt to access beyond end of device 06:07:09 executing program 4: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000080)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r1, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x3, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)=[{0x10, 0x107, 0x5}], 0x10, 0x20040000}, 0x8001) socket$pppoe(0x18, 0x1, 0x0) getsockname$inet(r0, &(0x7f00000000c0)={0x2, 0x0, @loopback}, &(0x7f00000001c0)=0x10) sendto$unix(0xffffffffffffffff, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r0) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) [ 508.634572] loop2: rw=1, want=145, limit=112 [ 508.636096] loop5: rw=1, want=144, limit=112 [ 508.643035] attempt to access beyond end of device [ 508.643575] attempt to access beyond end of device [ 508.648425] loop2: rw=1, want=2178, limit=112 [ 508.671287] loop5: rw=1, want=145, limit=112 [ 508.679672] attempt to access beyond end of device [ 508.684677] loop5: rw=1, want=2178, limit=112 06:07:09 executing program 5: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = socket$inet6(0xa, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp={0x2c, 0x0, 0x0, 0x3d}, 0x80) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r2, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000900)="b6d35518b48becfbd314d1fa96a307da879125869c71d40c5a385ce1d3af47c69a6acba0142b27475f2f890e1446d7e0851a8c84b5", 0x35}], 0x1, &(0x7f00000009c0)=[{0xa0, 0x0, 0x800, "434c94cf096ca2c6e3a8a6433ea1ccf960ad859f9cabeb13bbcd113f89069f10afdedfc1c2c2a6455dc4d1cc5b8c42e105db6d89e5394ec484d7db74d839a1021c616111655c01f0d6840a2cc4a77a0a2613073b0d1e9ab634a70c9cafd212450fe14e5e32b6ee05d11e22515b1b820c7425d601c3c41b459046978582375e37f0268020620ba8c96a1cf8de5399"}], 0xa0, 0x4040000}, 0x4000040) r3 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r3, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:07:09 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca580500020000000000b893123f89dedb03442000000000000000000000", @ANYRES32], 0x2}}, 0x0) 06:07:09 executing program 1: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = socket$inet6(0xa, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp={0x2c, 0x0, 0x0, 0x3d}, 0x80) gettid() ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000440)="bd5281e90e382e49bc31c58bec93575c69955b99c59ad4bd0fe49bfd7fe94d8885ab76161d9ce31d5d33721046808670be4653c0cc84b9da38535652f4ed2dc5c76b973366cda5cd22c8854b38e0bd58358a1c4321e295b32e956b0a7b25eb0cb616e08644cfab02fce229997b4ca12d8723eff6b59433fc01a0bd53b5f45a48e6ca29d035", 0x85}, {&(0x7f0000000600)="ee02b064c6289979b056ec862d34542624a8ef094eb3a6d305a6b17837f96191c27fc94f9efbd066e7e2aafbbf5452c61d49dff03991631cf6114f7113ed7e182e0d1b123bef992a4116ec55c036280818e436412b534c08c3dc283c7c9b4b455a38317ada3f0c861359a91d527f65a55a36cf34ce77f48745b116b0e4b4ef2b2ed9e1b16e6fb87b15bc5525f19be536cfb606be0f5e94fb6d503ebea5d3a1ed62d5ed5ada217fa9f737221eb398002f72faccd90f01e2fac7fb2097abded2aad0df01", 0xc3}, {&(0x7f0000000900)="b6d35518b48becfbd314d1fa96a307da879125869c71d40c5a385ce1d3af47c69a6acba0142b27475f2f890e1446d7e0851a8c84b5cc192ecdcc36e574f7f7996872b86ab02a1483169b257a8026ce3c23855275080d876355a8d08d92386b82dc72cc793a6ae4", 0x67}], 0x3, &(0x7f00000009c0)=[{0xa0, 0x1ff, 0x800, "434c94cf096ca2c6e3a8a6433ea1ccf960ad859f9cabeb13bbcd113f89069f10afdedfc1c2c2a6455dc4d1cc5b8c42e105db6d89e5394ec484d7db74d839a1021c616111655c01f0d6840a2cc4a77a0a2613073b0d1e9ab634a70c9cafd212450fe14e5e32b6ee05d11e22515b1b820c7425d601c3c41b459046978582375e37f0268020620ba8c96a1cf8de5399"}, {0x20, 0x113, 0x3, "64bc63fb1e5bc65e5043"}], 0xc0, 0x4040000}, 0x4000040) r2 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r2, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:07:09 executing program 2: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = socket$inet6(0xa, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp={0x2c, 0x0, 0x0, 0x3d}, 0x80) openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000900)="b6", 0x1}], 0x1, &(0x7f00000009c0)=[{0xa0, 0x1ff, 0x800, "434c94cf096ca2c6e3a8a6433ea1ccf960ad859f9cabeb13bbcd113f89069f10afdedfc1c2c2a6455dc4d1cc5b8c42e105db6d89e5394ec484d7db74d839a1021c616111655c01f0d6840a2cc4a77a0a2613073b0d1e9ab634a70c9cafd212450fe14e5e32b6ee05d11e22515b1b820c7425d601c3c41b459046978582375e37f0268020620ba8c96a1cf8de5399"}, {0x20, 0x113, 0x3, "64bc63fb1e5bc65e5043"}], 0xc0, 0x4040000}, 0x4000040) r2 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r2, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:07:09 executing program 4: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000080)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r1, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x3, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)=[{0x10, 0x107, 0x5}], 0x10, 0x20040000}, 0x8001) socket$pppoe(0x18, 0x1, 0x0) getsockname$inet(r0, &(0x7f00000000c0)={0x2, 0x0, @loopback}, &(0x7f00000001c0)=0x10) sendto$unix(0xffffffffffffffff, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r0) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:07:09 executing program 3: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r1, 0x10e, 0x2, &(0x7f0000000080)=0xf, 0x4) ioctl$LOOP_CTL_REMOVE(r1, 0x5421, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f00000000c0)={0x1, 0x9}, 0x2) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x3, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)=ANY=[@ANYBLOB="100000000000000007010d0005000000"], 0x10, 0x20040000}, 0x8001) sendto$unix(0xffffffffffffffff, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r0) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:07:09 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca5805009effffff0000b893123f89dedb03442000000000000000000000", @ANYRES32], 0x2}}, 0x0) [ 509.396204] audit: type=1804 audit(1539756430.153:120): pid=23504 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor1" name="/root/syzkaller-testdir266326801/syzkaller.kNCasg/433/file0" dev="sda1" ino=16593 res=1 06:07:10 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca580500fffff0000000b893123f89dedb03442000000000000000000000", @ANYRES32], 0x2}}, 0x0) 06:07:10 executing program 1: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = socket$inet6(0xa, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp={0x2c, 0x0, 0x0, 0x3d}, 0x80) gettid() ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000440)="bd5281e90e382e49bc31c58bec93575c69955b99c59ad4bd0fe49bfd7fe94d8885ab76161d9ce31d5d33721046808670be4653c0cc84b9da38535652f4ed2dc5c76b973366cda5cd22c8854b38e0bd58358a1c4321e295b32e956b0a7b25eb0cb616e08644cfab02fce229997b4ca12d8723eff6b59433fc01a0bd53b5f45a48e6ca29d035", 0x85}, {&(0x7f0000000600)="ee02b064c6289979b056ec862d34542624a8ef094eb3a6d305a6b17837f96191c27fc94f9efbd066e7e2aafbbf5452c61d49dff03991631cf6114f7113ed7e182e0d1b123bef992a4116ec55c036280818e436412b534c08c3dc283c7c9b4b455a38317ada3f0c861359a91d527f65a55a36cf34ce77f48745b116b0e4b4ef2b2ed9e1b16e6fb87b15bc5525f19be536cfb606be0f5e94fb6d503ebea5d3a1ed62d5ed5ada217fa9f737221eb398002f72faccd90f01e2fac7fb2097abded2aad0df01", 0xc3}, {&(0x7f0000000900)="b6d35518b48becfbd314d1fa96a307da879125869c71d40c5a385ce1d3af47c69a6acba0142b27475f2f890e1446d7e0851a8c84b5cc192ecdcc36e574f7f7996872b86ab02a1483169b257a8026ce3c23855275080d876355a8d08d92386b82dc72cc793a6ae4", 0x67}], 0x3, &(0x7f00000009c0)=[{0xa0, 0x1ff, 0x800, "434c94cf096ca2c6e3a8a6433ea1ccf960ad859f9cabeb13bbcd113f89069f10afdedfc1c2c2a6455dc4d1cc5b8c42e105db6d89e5394ec484d7db74d839a1021c616111655c01f0d6840a2cc4a77a0a2613073b0d1e9ab634a70c9cafd212450fe14e5e32b6ee05d11e22515b1b820c7425d601c3c41b459046978582375e37f0268020620ba8c96a1cf8de5399"}, {0x20, 0x113, 0x3, "64bc63fb1e5bc65e5043"}], 0xc0, 0x4040000}, 0x4000040) r2 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r2, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:07:10 executing program 2: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = socket$inet6(0xa, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp={0x2c, 0x0, 0x0, 0x3d}, 0x80) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) ioctl$LOOP_CTL_REMOVE(r2, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000900)="b6", 0x1}], 0x1, &(0x7f00000009c0)=[{0xa0, 0x1ff, 0x800, "434c94cf096ca2c6e3a8a6433ea1ccf960ad859f9cabeb13bbcd113f89069f10afdedfc1c2c2a6455dc4d1cc5b8c42e105db6d89e5394ec484d7db74d839a1021c616111655c01f0d6840a2cc4a77a0a2613073b0d1e9ab634a70c9cafd212450fe14e5e32b6ee05d11e22515b1b820c7425d601c3c41b459046978582375e37f0268020620ba8c96a1cf8de5399"}, {0x20, 0x113, 0x3, "64bc63fb1e5bc65e5043"}], 0xc0, 0x4040000}, 0x4000040) r3 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r3, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:07:10 executing program 5: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = socket$inet6(0xa, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp={0x2c, 0x0, 0x0, 0x3d}, 0x80) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r2, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000900)="b6d35518b48becfbd314d1fa96a307da879125869c71d40c5a385ce1d3af47c69a6acba0142b27475f2f890e1446d7e0851a8c84b5", 0x35}], 0x1, &(0x7f00000009c0)=[{0xa0, 0x0, 0x800, "434c94cf096ca2c6e3a8a6433ea1ccf960ad859f9cabeb13bbcd113f89069f10afdedfc1c2c2a6455dc4d1cc5b8c42e105db6d89e5394ec484d7db74d839a1021c616111655c01f0d6840a2cc4a77a0a2613073b0d1e9ab634a70c9cafd212450fe14e5e32b6ee05d11e22515b1b820c7425d601c3c41b459046978582375e37f0268020620ba8c96a1cf8de5399"}], 0xa0, 0x4040000}, 0x4000040) r3 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r3, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:07:10 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca580500000000020000b893123f89dedb03442000000000000000000000", @ANYRES32], 0x2}}, 0x0) 06:07:10 executing program 4: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000080)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r1, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x3, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)=[{0x10, 0x107, 0x5}], 0x10, 0x20040000}, 0x8001) socket$pppoe(0x18, 0x1, 0x0) getsockname$inet(r0, &(0x7f00000000c0)={0x2, 0x0, @loopback}, &(0x7f00000001c0)=0x10) sendto$unix(0xffffffffffffffff, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r0) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:07:10 executing program 3: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/loop-control\x00', 0x43a400, 0x0) r1 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r1, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x3, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="100000feece87c732fef0a7d00000000000701000005000000"], 0x10, 0x20040000}, 0x8001) sendto$unix(0xffffffffffffffff, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r0) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:07:10 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca580500fffffff00000b893123f89dedb03442000000000000000000000", @ANYRES32], 0x2}}, 0x0) 06:07:10 executing program 1: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = socket$inet6(0xa, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp={0x2c, 0x0, 0x0, 0x3d}, 0x80) gettid() ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000440)="bd5281e90e382e49bc31c58bec93575c69955b99c59ad4bd0fe49bfd7fe94d8885ab76161d9ce31d5d33721046808670be4653c0cc84b9da38535652f4ed2dc5c76b973366cda5cd22c8854b38e0bd58358a1c4321e295b32e956b0a7b25eb0cb616e08644cfab02fce229997b4ca12d8723eff6b59433fc01a0bd53b5f45a48e6ca29d035", 0x85}, {&(0x7f0000000600)="ee02b064c6289979b056ec862d34542624a8ef094eb3a6d305a6b17837f96191c27fc94f9efbd066e7e2aafbbf5452c61d49dff03991631cf6114f7113ed7e182e0d1b123bef992a4116ec55c036280818e436412b534c08c3dc283c7c9b4b455a38317ada3f0c861359a91d527f65a55a36cf34ce77f48745b116b0e4b4ef2b2ed9e1b16e6fb87b15bc5525f19be536cfb606be0f5e94fb6d503ebea5d3a1ed62d5ed5ada217fa9f737221eb398002f72faccd90f01e2fac7fb2097abded2aad0df01", 0xc3}, {&(0x7f0000000900)="b6d35518b48becfbd314d1fa96a307da879125869c71d40c5a385ce1d3af47c69a6acba0142b27475f2f890e1446d7e0851a8c84b5cc192ecdcc36e574f7f7996872b86ab02a1483169b257a8026ce3c23855275080d876355a8d08d92386b82dc72cc793a6ae4", 0x67}], 0x3, &(0x7f00000009c0)=[{0xa0, 0x1ff, 0x800, "434c94cf096ca2c6e3a8a6433ea1ccf960ad859f9cabeb13bbcd113f89069f10afdedfc1c2c2a6455dc4d1cc5b8c42e105db6d89e5394ec484d7db74d839a1021c616111655c01f0d6840a2cc4a77a0a2613073b0d1e9ab634a70c9cafd212450fe14e5e32b6ee05d11e22515b1b820c7425d601c3c41b459046978582375e37f0268020620ba8c96a1cf8de5399"}, {0x20, 0x113, 0x3, "64bc63fb1e5bc65e5043"}], 0xc0, 0x4040000}, 0x4000040) r2 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r2, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:07:11 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca580500058200000000b893123f89dedb03442000000000000000000000", @ANYRES32], 0x2}}, 0x0) 06:07:11 executing program 2: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = socket$inet6(0xa, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp={0x2c, 0x0, 0x0, 0x3d}, 0x80) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) ioctl$LOOP_CTL_REMOVE(r2, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000900)="b6", 0x1}], 0x1, &(0x7f00000009c0)=[{0xa0, 0x1ff, 0x800, "434c94cf096ca2c6e3a8a6433ea1ccf960ad859f9cabeb13bbcd113f89069f10afdedfc1c2c2a6455dc4d1cc5b8c42e105db6d89e5394ec484d7db74d839a1021c616111655c01f0d6840a2cc4a77a0a2613073b0d1e9ab634a70c9cafd212450fe14e5e32b6ee05d11e22515b1b820c7425d601c3c41b459046978582375e37f0268020620ba8c96a1cf8de5399"}, {0x20, 0x113, 0x3, "64bc63fb1e5bc65e5043"}], 0xc0, 0x4040000}, 0x4000040) r3 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r3, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:07:11 executing program 3: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) r1 = accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() getsockopt$inet_sctp6_SCTP_RECVNXTINFO(r1, 0x84, 0x21, &(0x7f0000000080), &(0x7f00000000c0)=0x4) ioctl$LOOP_CTL_REMOVE(r2, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x3, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)=[{0x10, 0x107, 0x5}], 0x10, 0x20040000}, 0x8001) sendto$unix(0xffffffffffffffff, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r0) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:07:11 executing program 4: r0 = accept(0xffffffffffffffff, &(0x7f00000005c0)=@ax25, &(0x7f0000000640)=0x80) getsockopt$inet_dccp_buf(r0, 0x21, 0x0, &(0x7f0000000900)=""/226, &(0x7f0000000680)=0xe2) r1 = socket$inet6(0xa, 0x100003, 0xfffffffffffffff8) ioctl$SNDRV_RAWMIDI_IOCTL_STATUS(0xffffffffffffffff, 0xc0385720, &(0x7f00000000c0)={0x0, {0x0, 0x989680}}) r2 = syz_open_dev$audion(&(0x7f0000000040)='/dev/audio#\x00', 0x8, 0xa00) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0xfffffffffffffffc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_inet6_tcp_SIOCATMARK(r2, 0x8905, &(0x7f0000000080)) r4 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x80000000007, 0x0) execveat(r2, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), &(0x7f0000000400)=[&(0x7f0000000200)='\x00', &(0x7f0000000240)='em0\x00', &(0x7f0000000280)='/dev/bus/usb/00#/00#\x00', &(0x7f00000002c0)='/dev/audio#\x00', &(0x7f0000000340)='/dev/bus/usb/00#/00#\x00', &(0x7f0000000380)='lolo\x00', &(0x7f00000003c0)='/dev/audio#\x00'], 0x0) r5 = dup3(r3, r4, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000480)={"76090000000000da6c5161c682976100"}) sendmsg$nl_route(r4, &(0x7f0000000580)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x84000}, 0xc, &(0x7f0000000540)={&(0x7f00000005c0)=ANY=[@ANYBLOB='\x00'], 0x1}, 0x1, 0x0, 0x0, 0x4000080}, 0x800) write$RDMA_USER_CM_CMD_DESTROY_ID(0xffffffffffffffff, &(0x7f00000001c0)={0x1, 0x10, 0xfa00, {&(0x7f0000000100)}}, 0x18) lsetxattr$security_evm(&(0x7f0000000300)='./file0\x00', &(0x7f0000000440)='security.evm\x00', &(0x7f00000004c0)=@v1={0x2, "1add"}, 0x3, 0x2) syz_genetlink_get_family_id$ipvs(&(0x7f0000000440)='IPVS\x00') r6 = socket$inet6(0xa, 0x400000000001, 0xfffffffffffffffd) ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000000)) ioctl$sock_inet_SIOCSIFFLAGS(r6, 0x8914, &(0x7f0000000040)={"626f6e643000000001feffff00"}) getsockopt$inet_sctp6_SCTP_INITMSG(r1, 0x84, 0x2, &(0x7f00000004c0), &(0x7f0000000500)=0x8) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8923, &(0x7f00000000c0)={'bond0\x00', 0xfff}) fsetxattr(r1, &(0x7f0000000400)=@known='trusted.overlay.nlink\x00', &(0x7f0000000540)="626f6e643000000001feffff00", 0xd, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r1, 0x29, 0x14, &(0x7f0000000040)={@mcast2}, 0x20) sendmsg$IPVS_CMD_GET_DEST(0xffffffffffffffff, &(0x7f0000000740)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000700)={&(0x7f0000000880)=ANY=[@ANYBLOB="140000005b55f7c5", @ANYRES16=0x0, @ANYBLOB="fc7f0800000000000000000000004c46c3938087e8ec4a87b34242ffce73"], 0x14}}, 0xffffffffffffffff) setsockopt$inet_MCAST_JOIN_GROUP(0xffffffffffffffff, 0x0, 0x2a, &(0x7f0000000140)={0x0, {{0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x17}}}}, 0x84) syncfs(0xffffffffffffffff) r7 = syz_open_dev$sndpcmc(&(0x7f0000000080)='/dev/snd/pcmC#D#c\x00', 0x4, 0x80002) ioctl$sock_inet_SIOCSIFPFLAGS(r1, 0x8934, &(0x7f0000000580)={'team_slave_1\x00', 0x7}) write$RDMA_USER_CM_CMD_CREATE_ID(r7, &(0x7f00000008c0)={0x0, 0x18, 0xfa00, {0x4, &(0x7f00000006c0)={0xffffffffffffffff}, 0x117, 0x2}}, 0x20) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r7, &(0x7f0000000480)={0x5, 0x10, 0xfa00, {&(0x7f0000000200), r8, 0x1}}, 0x18) connect$l2tp(r7, &(0x7f0000000000)=@pppol2tpin6={0x18, 0x1, {0x0, r6, 0x1, 0x3, 0x3, 0x0, {0xa, 0x4e23, 0x101, @remote, 0x6}}}, 0x32) 06:07:11 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca5805007fffffff0000b893123f89dedb03442000000000000000000000", @ANYRES32], 0x2}}, 0x0) 06:07:11 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca580500000005820000b893123f89dedb03442000000000000000000000", @ANYRES32], 0x2}}, 0x0) 06:07:11 executing program 5: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = socket$inet6(0xa, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp={0x2c, 0x0, 0x0, 0x3d}, 0x80) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r2, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000900)="b6d35518b48becfbd314d1fa96a307da879125869c71d40c5a385ce1d3af47c69a6acba0142b27475f2f890e1446d7e0851a8c84b5", 0x35}], 0x1, &(0x7f00000009c0)=[{0xa0, 0x0, 0x800, "434c94cf096ca2c6e3a8a6433ea1ccf960ad859f9cabeb13bbcd113f89069f10afdedfc1c2c2a6455dc4d1cc5b8c42e105db6d89e5394ec484d7db74d839a1021c616111655c01f0d6840a2cc4a77a0a2613073b0d1e9ab634a70c9cafd212450fe14e5e32b6ee05d11e22515b1b820c7425d601c3c41b459046978582375e37f0268020620ba8c96a1cf8de5399"}], 0xa0, 0x4040000}, 0x4000040) r3 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r3, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:07:11 executing program 3: r0 = memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) getdents64(r1, &(0x7f0000000340)=""/134, 0x86) gettid() ioctl$LOOP_CTL_REMOVE(r2, 0x5421, 0x0) sendmsg(r0, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x3, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x266, &(0x7f0000000340), 0xfffff45, &(0x7f0000003b40)=[{0x10, 0x107, 0x1}], 0x10, 0x20040100}, 0x8001) sendto$unix(0xffffffffffffffff, &(0x7f00000001c0)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000080)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:07:11 executing program 2: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = socket$inet6(0xa, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp={0x2c, 0x0, 0x0, 0x3d}, 0x80) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) ioctl$LOOP_CTL_REMOVE(r2, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000900)="b6", 0x1}], 0x1, &(0x7f00000009c0)=[{0xa0, 0x1ff, 0x800, "434c94cf096ca2c6e3a8a6433ea1ccf960ad859f9cabeb13bbcd113f89069f10afdedfc1c2c2a6455dc4d1cc5b8c42e105db6d89e5394ec484d7db74d839a1021c616111655c01f0d6840a2cc4a77a0a2613073b0d1e9ab634a70c9cafd212450fe14e5e32b6ee05d11e22515b1b820c7425d601c3c41b459046978582375e37f0268020620ba8c96a1cf8de5399"}, {0x20, 0x113, 0x3, "64bc63fb1e5bc65e5043"}], 0xc0, 0x4040000}, 0x4000040) r3 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r3, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:07:11 executing program 4: r0 = memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x3fffff, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000340)={{{@in6=@mcast2, @in=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@dev}, 0x0, @in=@rand_addr}}, &(0x7f0000000440)=0xe8) ioctl$sock_inet6_SIOCSIFADDR(r0, 0x8916, &(0x7f0000000480)={@local, 0x2f, r2}) gettid() r3 = add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f00000000c0)={'syz', 0x2}, 0x0, 0x0, 0xfffffffffffffffc) keyctl$invalidate(0x15, r3) ioctl$LOOP_CTL_REMOVE(r1, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x3, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)=[{0x10, 0x107, 0x5}], 0x10, 0x20040000}, 0x8001) sendto$unix(0xffffffffffffffff, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r1) setsockopt$inet_tcp_TCP_FASTOPEN_KEY(r1, 0x6, 0x21, &(0x7f00000001c0)="6c0e335ed3cb022891c56fa903cee1f2", 0x10) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:07:11 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca580500f00000000000b893123f89dedb03442000000000000000000000", @ANYRES32], 0x2}}, 0x0) [ 510.915911] attempt to access beyond end of device [ 510.920898] loop5: rw=1, want=130, limit=112 [ 510.958852] attempt to access beyond end of device [ 510.976462] loop5: rw=1, want=131, limit=112 [ 510.999797] attempt to access beyond end of device [ 511.031611] loop5: rw=1, want=132, limit=112 06:07:11 executing program 1: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = socket$inet6(0xa, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp={0x2c, 0x0, 0x0, 0x3d}, 0x80) gettid() ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000440)="bd5281e90e382e49bc31c58bec93575c69955b99c59ad4bd0fe49bfd7fe94d8885ab76161d9ce31d5d33721046808670be4653c0cc84b9da38535652f4ed2dc5c76b973366cda5cd22c8854b38e0bd58358a1c4321e295b32e956b0a7b25eb0cb616e08644cfab02fce229997b4ca12d8723eff6b59433fc01a0bd53b5f45a48e6ca29d035", 0x85}, {&(0x7f0000000600)="ee02b064c6289979b056ec862d34542624a8ef094eb3a6d305a6b17837f96191c27fc94f9efbd066e7e2aafbbf5452c61d49dff03991631cf6114f7113ed7e182e0d1b123bef992a4116ec55c036280818e436412b534c08c3dc283c7c9b4b455a38317ada3f0c861359a91d527f65a55a36cf34ce77f48745b116b0e4b4ef2b2ed9e1b16e6fb87b15bc5525f19be536cfb606be0f5e94fb6d503ebea5d3a1ed62d5ed5ada217fa9f737221eb398002f72faccd90f01e2fac7fb2097abded2aad0df01", 0xc3}, {&(0x7f0000000900)="b6d35518b48becfbd314d1fa96a307da879125869c71d40c5a385ce1d3af47c69a6acba0142b27475f2f890e1446d7e0851a8c84b5cc192ecdcc36e574f7f7996872b86ab02a1483169b257a8026ce3c23855275080d876355a8d08d92386b82dc72cc793a6ae4", 0x67}], 0x3, &(0x7f00000009c0)=[{0xa0, 0x1ff, 0x800, "434c94cf096ca2c6e3a8a6433ea1ccf960ad859f9cabeb13bbcd113f89069f10afdedfc1c2c2a6455dc4d1cc5b8c42e105db6d89e5394ec484d7db74d839a1021c616111655c01f0d6840a2cc4a77a0a2613073b0d1e9ab634a70c9cafd212450fe14e5e32b6ee05d11e22515b1b820c7425d601c3c41b459046978582375e37f0268020620ba8c96a1cf8de5399"}, {0x20, 0x113, 0x3, "64bc63fb1e5bc65e5043"}], 0xc0, 0x4040000}, 0x4000040) r2 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r2, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:07:11 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca580500000000010000b893123f89dedb03442000000000000000000000", @ANYRES32], 0x2}}, 0x0) [ 511.066426] attempt to access beyond end of device [ 511.071408] loop5: rw=1, want=133, limit=112 [ 511.096526] attempt to access beyond end of device [ 511.120485] loop1: rw=1, want=130, limit=112 [ 511.137739] attempt to access beyond end of device [ 511.144759] attempt to access beyond end of device [ 511.165567] loop1: rw=1, want=131, limit=112 [ 511.179574] loop5: rw=1, want=142, limit=112 [ 511.189966] attempt to access beyond end of device [ 511.196280] attempt to access beyond end of device [ 511.210675] loop1: rw=1, want=132, limit=112 [ 511.218717] loop5: rw=1, want=143, limit=112 06:07:12 executing program 3: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r1, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000080)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x3, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)=[{0x0, 0x107, 0x5}], 0x4, 0x20040000}, 0x8001) sendto$unix(0xffffffffffffffff, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r0) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) [ 511.231255] attempt to access beyond end of device [ 511.237678] attempt to access beyond end of device [ 511.245725] loop1: rw=1, want=133, limit=112 [ 511.250295] loop5: rw=1, want=144, limit=112 [ 511.259004] attempt to access beyond end of device [ 511.265496] attempt to access beyond end of device [ 511.273281] loop1: rw=1, want=142, limit=112 06:07:12 executing program 4: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000240)=@filter={'filter\x00', 0xe, 0x1, 0x130, [0x0, 0x20000100, 0x20000130, 0x20000160], 0x0, &(0x7f0000000000), &(0x7f0000000100)=ANY=[@ANYBLOB="0000000000002a7b0000000000000000000000000300000000000000000000000000000000000000ffffffff0000000000000000000000000012c31aa8b556307b0000160900000000000000000000000000000000000000ffffffff00000000000000000000000000000000000000000000000000ffffff7f000000000000000000000000000000feffffff01000000000000106cf4aa4ac99e8d000000006c6f00000000000000000000000000010000000000000000000000001000000000000100895fc5d400000000a85f001a4b0000000000000005000000aaaaaaaaaa0000000000000000007000000070000000a000000041554449540000000000000000000000000000000000000000000000000000000800000000000d1500000000000000000000000000000000000000"]}, 0x1a8) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000340)='net/iq_mr_Aache\x00') ioctl$BLKDISCARD(r1, 0x1277, &(0x7f0000000300)=0xc00000000000) r2 = socket$inet6(0xa, 0x100000002, 0x0) connect$inet6(r2, &(0x7f0000000080)={0xa, 0x0, 0x0, @mcast1, 0xd}, 0x1c) sendto$inet6(r2, &(0x7f0000000300), 0xfd90, 0x0, &(0x7f00000000c0)={0xa, 0x4e23, 0x0, @ipv4={[], [], @multicast2}}, 0x1c) getsockopt$inet_sctp_SCTP_AUTH_ACTIVE_KEY(r1, 0x84, 0x18, &(0x7f00000004c0)={0x0, 0x8b2}, &(0x7f0000000500)=0x8) getsockopt$inet_sctp_SCTP_PR_ASSOC_STATUS(r1, 0x84, 0x73, &(0x7f0000000540)={r3, 0x5, 0x20, 0x1, 0x6}, &(0x7f0000000580)=0x18) setsockopt$RDS_GET_MR_FOR_DEST(r1, 0x114, 0x7, &(0x7f0000000400)={@nfc_llcp={0x27, 0x0, 0x1, 0x2, 0xca9, 0xe7ab, "99c33a3c2f2ec82a9de886d0362ca7e9ce85e7a962b7a90e1528bab53dec0456c83db9c356d61aa91633fa305c46be9d055a6ab8ddc069d4f54cdc11927d6a", 0x39}, {&(0x7f0000000380)=""/91, 0x5b}, &(0x7f00000002c0)}, 0xa0) 06:07:12 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca580500000000058200b893123f89dedb03442000000000000000000000", @ANYRES32], 0x2}}, 0x0) [ 511.281644] loop5: rw=1, want=145, limit=112 [ 511.288696] attempt to access beyond end of device [ 511.304620] attempt to access beyond end of device [ 511.310563] loop1: rw=1, want=143, limit=112 [ 511.316498] loop5: rw=1, want=2178, limit=112 [ 511.324829] attempt to access beyond end of device [ 511.329785] loop1: rw=1, want=144, limit=112 [ 511.338120] attempt to access beyond end of device [ 511.343068] loop1: rw=1, want=145, limit=112 [ 511.351288] attempt to access beyond end of device [ 511.357685] loop1: rw=1, want=977, limit=112 06:07:12 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca58050000fffff00000b893123f89dedb03442000000000000000000000", @ANYRES32], 0x2}}, 0x0) 06:07:12 executing program 2: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = socket$inet6(0xa, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp={0x2c, 0x0, 0x0, 0x3d}, 0x80) gettid() ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000900)="b6", 0x1}], 0x1, &(0x7f00000009c0)=[{0xa0, 0x1ff, 0x800, "434c94cf096ca2c6e3a8a6433ea1ccf960ad859f9cabeb13bbcd113f89069f10afdedfc1c2c2a6455dc4d1cc5b8c42e105db6d89e5394ec484d7db74d839a1021c616111655c01f0d6840a2cc4a77a0a2613073b0d1e9ab634a70c9cafd212450fe14e5e32b6ee05d11e22515b1b820c7425d601c3c41b459046978582375e37f0268020620ba8c96a1cf8de5399"}, {0x20, 0x113, 0x3, "64bc63fb1e5bc65e5043"}], 0xc0, 0x4040000}, 0x4000040) r2 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r2, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) [ 511.550546] kernel msg: ebtables bug: please report to author: EBT_ENTRY_OR_ENTRIES shouldn't be set in distinguisher [ 511.759954] kernel msg: ebtables bug: please report to author: EBT_ENTRY_OR_ENTRIES shouldn't be set in distinguisher 06:07:12 executing program 5: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = socket$inet6(0xa, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp={0x2c, 0x0, 0x0, 0x3d}, 0x80) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r2, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000900)="b6d35518b48becfbd314d1fa96a307da879125869c71d40c5a385ce1d3af47c69a6acba0142b27475f2f890e1446d7e0851a8c84b5", 0x35}], 0x1, &(0x7f00000009c0)=[{0xa0, 0x1ff, 0x0, "434c94cf096ca2c6e3a8a6433ea1ccf960ad859f9cabeb13bbcd113f89069f10afdedfc1c2c2a6455dc4d1cc5b8c42e105db6d89e5394ec484d7db74d839a1021c616111655c01f0d6840a2cc4a77a0a2613073b0d1e9ab634a70c9cafd212450fe14e5e32b6ee05d11e22515b1b820c7425d601c3c41b459046978582375e37f0268020620ba8c96a1cf8de5399"}], 0xa0, 0x4040000}, 0x4000040) r3 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r3, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:07:12 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca5805000000f0000000b893123f89dedb03442000000000000000000000", @ANYRES32], 0x2}}, 0x0) 06:07:12 executing program 1: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = socket$inet6(0xa, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp={0x2c, 0x0, 0x0, 0x3d}, 0x80) gettid() ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000440)="bd5281e90e382e49bc31c58bec93575c69955b99c59ad4bd0fe49bfd7fe94d8885ab76161d9ce31d5d33721046808670be4653c0cc84b9da38535652f4ed2dc5c76b973366cda5cd22c8854b38e0bd58358a1c4321e295b32e956b0a7b25eb0cb616e08644cfab02fce229997b4ca12d8723eff6b59433fc01a0bd53b5f45a48e6ca29d035", 0x85}, {&(0x7f0000000600)="ee02b064c6289979b056ec862d34542624a8ef094eb3a6d305a6b17837f96191c27fc94f9efbd066e7e2aafbbf5452c61d49dff03991631cf6114f7113ed7e182e0d1b123bef992a4116ec55c036280818e436412b534c08c3dc283c7c9b4b455a38317ada3f0c861359a91d527f65a55a36cf34ce77f48745b116b0e4b4ef2b2ed9e1b16e6fb87b15bc5525f19be536cfb606be0f5e94fb6d503ebea5d3a1ed62d5ed5ada217fa9f737221eb398002f72faccd90f01e2fac7fb2097abded2aad0df01", 0xc3}, {&(0x7f0000000900)="b6d35518b48becfbd314d1fa96a307da879125869c71d40c5a385ce1d3af47c69a6acba0142b27475f2f890e1446d7e0851a8c84b5cc192ecdcc36e574f7f7996872b86ab02a1483169b257a8026ce3c23855275080d876355a8d08d92386b82dc72cc793a6ae4", 0x67}], 0x3, &(0x7f00000009c0)=[{0xa0, 0x1ff, 0x800, "434c94cf096ca2c6e3a8a6433ea1ccf960ad859f9cabeb13bbcd113f89069f10afdedfc1c2c2a6455dc4d1cc5b8c42e105db6d89e5394ec484d7db74d839a1021c616111655c01f0d6840a2cc4a77a0a2613073b0d1e9ab634a70c9cafd212450fe14e5e32b6ee05d11e22515b1b820c7425d601c3c41b459046978582375e37f0268020620ba8c96a1cf8de5399"}, {0x20, 0x113, 0x3, "64bc63fb1e5bc65e5043"}], 0xc0, 0x4040000}, 0x4000040) r2 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r2, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:07:12 executing program 4: r0 = creat(&(0x7f0000000180)='./bus\x00', 0x0) ftruncate(r0, 0xffffffffffffffff) lseek(r0, 0x0, 0x2) ioctl$SNDRV_SEQ_IOCTL_GET_NAMED_QUEUE(r0, 0xc08c5336, &(0x7f0000000040)={0x8001, 0x5, 0xf1, 'queue1\x00', 0x5}) r1 = getpgrp(0xffffffffffffffff) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000140)={r1, r0, 0x0, 0x7, &(0x7f0000000100)='queue1\x00'}, 0x30) r2 = open(&(0x7f0000000240)='./bus\x00', 0x2, 0x0) sendfile(r0, r2, &(0x7f0000001940), 0x80007) syz_open_dev$dmmidi(&(0x7f0000000000)='/dev/dmmidi#\x00', 0xf404, 0x40000) ioctl$EXT4_IOC_ALLOC_DA_BLKS(r2, 0x660c) 06:07:12 executing program 3: r0 = memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r2, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x3, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)=[{0x10, 0x107, 0x5}], 0x10, 0x20040000}, 0x8001) sendto$unix(0xffffffffffffffff, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r1) ioctl$SNDRV_CTL_IOCTL_TLV_READ(r0, 0xc008551a, &(0x7f00000001c0)={0x2, 0x20, [0x6, 0x40, 0x2, 0x1ff, 0x8, 0x5d, 0x10001, 0x0]}) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) getsockopt$XDP_STATISTICS(r0, 0x11b, 0x7, &(0x7f0000000080), &(0x7f00000000c0)=0x18) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:07:12 executing program 2: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = socket$inet6(0xa, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp={0x2c, 0x0, 0x0, 0x3d}, 0x80) gettid() ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000900)="b6", 0x1}], 0x1, &(0x7f00000009c0)=[{0xa0, 0x1ff, 0x800, "434c94cf096ca2c6e3a8a6433ea1ccf960ad859f9cabeb13bbcd113f89069f10afdedfc1c2c2a6455dc4d1cc5b8c42e105db6d89e5394ec484d7db74d839a1021c616111655c01f0d6840a2cc4a77a0a2613073b0d1e9ab634a70c9cafd212450fe14e5e32b6ee05d11e22515b1b820c7425d601c3c41b459046978582375e37f0268020620ba8c96a1cf8de5399"}, {0x20, 0x113, 0x3, "64bc63fb1e5bc65e5043"}], 0xc0, 0x4040000}, 0x4000040) r2 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r2, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:07:12 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca580500009effffff00b893123f89dedb03442000000000000000000000", @ANYRES32], 0x2}}, 0x0) 06:07:12 executing program 4: r0 = syz_open_dev$dri(&(0x7f0000000080)='/dev/dri/card#\x00', 0x0, 0x0) mmap(&(0x7f0000ffa000/0x4000)=nil, 0x605000, 0x0, 0x20012, r0, 0x0) r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000200)='/dev/dsp\x00', 0x2000, 0x0) write$P9_RFLUSH(r1, &(0x7f0000000240)={0x7, 0x6d, 0x1}, 0x7) r2 = socket$inet6(0xa, 0x0, 0x2) getsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(r1, 0x84, 0x72, &(0x7f00000000c0)={0x0, 0x4}, &(0x7f00000003c0)=0xc) setsockopt$inet_sctp6_SCTP_RESET_STREAMS(r2, 0x84, 0x77, &(0x7f0000000180)=ANY=[@ANYRES32=r3, @ANYBLOB="2b33eeb5261a4cf9"], 0x12) setsockopt$inet_sctp6_SCTP_CONTEXT(r2, 0x84, 0x11, &(0x7f0000000140)={r3, 0x9}, 0x8) r4 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000040)='/dev/qat_adf_ctl\x00', 0x2a2240, 0x0) write$FUSE_OPEN(r4, &(0x7f00000001c0)={0x20, 0x0, 0x6, {0x0, 0x2}}, 0x20) setsockopt$inet6_IPV6_ADDRFORM(r4, 0x29, 0x1, &(0x7f0000000000), 0x4) ioctl$TUNGETFEATURES(r1, 0x800454cf, &(0x7f0000000280)) 06:07:13 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca58050000f0ffffff00b893123f89dedb03442000000000000000000000", @ANYRES32], 0x2}}, 0x0) 06:07:13 executing program 1: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = socket$inet6(0xa, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp={0x2c, 0x0, 0x0, 0x3d}, 0x80) gettid() ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000440)="bd5281e90e382e49bc31c58bec93575c69955b99c59ad4bd0fe49bfd7fe94d8885ab76161d9ce31d5d33721046808670be4653c0cc84b9da38535652f4ed2dc5c76b973366cda5cd22c8854b38e0bd58358a1c4321e295b32e956b0a7b25eb0cb616e08644cfab02fce229997b4ca12d8723eff6b59433fc01a0bd53b5f45a48e6ca29d035", 0x85}, {&(0x7f0000000600)="ee02b064c6289979b056ec862d34542624a8ef094eb3a6d305a6b17837f96191c27fc94f9efbd066e7e2aafbbf5452c61d49dff03991631cf6114f7113ed7e182e0d1b123bef992a4116ec55c036280818e436412b534c08c3dc283c7c9b4b455a38317ada3f0c861359a91d527f65a55a36cf34ce77f48745b116b0e4b4ef2b2ed9e1b16e6fb87b15bc5525f19be536cfb606be0f5e94fb6d503ebea5d3a1ed62d5ed5ada217fa9f737221eb398002f72faccd90f01e2fac7fb2097abded2aad0df01", 0xc3}, {&(0x7f0000000900)="b6d35518b48becfbd314d1fa96a307da879125869c71d40c5a385ce1d3af47c69a6acba0142b27475f2f890e1446d7e0851a8c84b5cc192ecdcc36e574f7f7996872b86ab02a1483169b257a8026ce3c23855275080d876355a8d08d92386b82dc72cc793a6ae4", 0x67}], 0x3, &(0x7f00000009c0)=[{0xa0, 0x1ff, 0x800, "434c94cf096ca2c6e3a8a6433ea1ccf960ad859f9cabeb13bbcd113f89069f10afdedfc1c2c2a6455dc4d1cc5b8c42e105db6d89e5394ec484d7db74d839a1021c616111655c01f0d6840a2cc4a77a0a2613073b0d1e9ab634a70c9cafd212450fe14e5e32b6ee05d11e22515b1b820c7425d601c3c41b459046978582375e37f0268020620ba8c96a1cf8de5399"}, {0x20, 0x113, 0x3, "64bc63fb1e5bc65e5043"}], 0xc0, 0x4040000}, 0x4000040) r2 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r2, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:07:13 executing program 4: perf_event_open(&(0x7f0000000200)={0x8000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x3, 0xff) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @mcast1}, 0x1c) pipe2(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4000) setsockopt$bt_BT_SNDMTU(r1, 0x112, 0xc, &(0x7f00000000c0)=0x9, 0x2) sendmmsg(r0, &(0x7f00000002c0), 0x4cc, 0x20007ffc) 06:07:13 executing program 2: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = socket$inet6(0xa, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp={0x2c, 0x0, 0x0, 0x3d}, 0x80) gettid() ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000900)="b6", 0x1}], 0x1, &(0x7f00000009c0)=[{0xa0, 0x1ff, 0x800, "434c94cf096ca2c6e3a8a6433ea1ccf960ad859f9cabeb13bbcd113f89069f10afdedfc1c2c2a6455dc4d1cc5b8c42e105db6d89e5394ec484d7db74d839a1021c616111655c01f0d6840a2cc4a77a0a2613073b0d1e9ab634a70c9cafd212450fe14e5e32b6ee05d11e22515b1b820c7425d601c3c41b459046978582375e37f0268020620ba8c96a1cf8de5399"}, {0x20, 0x113, 0x3, "64bc63fb1e5bc65e5043"}], 0xc0, 0x4040000}, 0x4000040) r2 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r2, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:07:13 executing program 5: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = socket$inet6(0xa, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp={0x2c, 0x0, 0x0, 0x3d}, 0x80) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r2, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000900)="b6d35518b48becfbd314d1fa96a307da879125869c71d40c5a385ce1d3af47c69a6acba0142b27475f2f890e1446d7e0851a8c84b5", 0x35}], 0x1, &(0x7f00000009c0)=[{0xa0, 0x1ff, 0x0, "434c94cf096ca2c6e3a8a6433ea1ccf960ad859f9cabeb13bbcd113f89069f10afdedfc1c2c2a6455dc4d1cc5b8c42e105db6d89e5394ec484d7db74d839a1021c616111655c01f0d6840a2cc4a77a0a2613073b0d1e9ab634a70c9cafd212450fe14e5e32b6ee05d11e22515b1b820c7425d601c3c41b459046978582375e37f0268020620ba8c96a1cf8de5399"}], 0xa0, 0x4040000}, 0x4000040) r3 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r3, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:07:13 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca580500000000000100b893123f89dedb03442000000000000000000000", @ANYRES32], 0x2}}, 0x0) 06:07:13 executing program 4: r0 = socket$inet(0x2, 0x2, 0x0) setsockopt$inet_opts(r0, 0x0, 0xddeee3422918921b, &(0x7f0000000040)="8906040461", 0x5) 06:07:13 executing program 3: r0 = memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(r0, &(0x7f0000000580)=@rc, &(0x7f00000001c0)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r2, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x3, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)=ANY=[@ANYBLOB="10003196b63000000000000007010000"], 0x10, 0x20040000}, 0x8001) sendto$unix(0xffffffffffffffff, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:07:13 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca58050000ffffff9e00b893123f89dedb03442000000000000000000000", @ANYRES32], 0x2}}, 0x0) 06:07:13 executing program 4: r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000140)='/dev/dsp\x00', 0x400000002, 0x0) write$binfmt_elf32(r0, &(0x7f0000000180)=ANY=[@ANYBLOB='\x00'], 0x1) ioctl$int_in(r0, 0xc00008c004500a, &(0x7f0000000000)) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x2, 0x12, r0, 0x0) openat$uhid(0xffffffffffffff9c, &(0x7f0000000040)='/dev/uhid\x00', 0x2, 0x0) 06:07:13 executing program 2: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = socket$inet6(0xa, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r2, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000900)="b6", 0x1}], 0x1, &(0x7f00000009c0)=[{0xa0, 0x1ff, 0x800, "434c94cf096ca2c6e3a8a6433ea1ccf960ad859f9cabeb13bbcd113f89069f10afdedfc1c2c2a6455dc4d1cc5b8c42e105db6d89e5394ec484d7db74d839a1021c616111655c01f0d6840a2cc4a77a0a2613073b0d1e9ab634a70c9cafd212450fe14e5e32b6ee05d11e22515b1b820c7425d601c3c41b459046978582375e37f0268020620ba8c96a1cf8de5399"}, {0x20, 0x113, 0x3, "64bc63fb1e5bc65e5043"}], 0xc0, 0x4040000}, 0x4000040) r3 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r3, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:07:13 executing program 5: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = socket$inet6(0xa, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp={0x2c, 0x0, 0x0, 0x3d}, 0x80) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r2, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000900)="b6d35518b48becfbd314d1fa96a307da879125869c71d40c5a385ce1d3af47c69a6acba0142b27475f2f890e1446d7e0851a8c84b5", 0x35}], 0x1, &(0x7f00000009c0)=[{0xa0, 0x1ff, 0x0, "434c94cf096ca2c6e3a8a6433ea1ccf960ad859f9cabeb13bbcd113f89069f10afdedfc1c2c2a6455dc4d1cc5b8c42e105db6d89e5394ec484d7db74d839a1021c616111655c01f0d6840a2cc4a77a0a2613073b0d1e9ab634a70c9cafd212450fe14e5e32b6ee05d11e22515b1b820c7425d601c3c41b459046978582375e37f0268020620ba8c96a1cf8de5399"}], 0xa0, 0x4040000}, 0x4000040) r3 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r3, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:07:13 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca58050000f000000000b893123f89dedb03442000000000000000000000", @ANYRES32], 0x2}}, 0x0) 06:07:13 executing program 1: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = socket$inet6(0xa, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp, 0x80) gettid() ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000440)="bd5281e90e382e49bc31c58bec93575c69955b99c59ad4bd0fe49bfd7fe94d8885ab76161d9ce31d5d33721046808670be4653c0cc84b9da38535652f4ed2dc5c76b973366cda5cd22c8854b38e0bd58358a1c4321e295b32e956b0a7b25eb0cb616e08644cfab02fce229997b4ca12d8723eff6b59433fc01a0bd53b5f45a48e6ca29d035", 0x85}, {&(0x7f0000000600)="ee02b064c6289979b056ec862d34542624a8ef094eb3a6d305a6b17837f96191c27fc94f9efbd066e7e2aafbbf5452c61d49dff03991631cf6114f7113ed7e182e0d1b123bef992a4116ec55c036280818e436412b534c08c3dc283c7c9b4b455a38317ada3f0c861359a91d527f65a55a36cf34ce77f48745b116b0e4b4ef2b2ed9e1b16e6fb87b15bc5525f19be536cfb606be0f5e94fb6d503ebea5d3a1ed62d5ed5ada217fa9f737221eb398002f72faccd90f01e2fac7fb2097abded2aad0df01", 0xc3}, {&(0x7f0000000900)="b6d35518b48becfbd314d1fa96a307da879125869c71d40c5a385ce1d3af47c69a6acba0142b27475f2f890e1446d7e0851a8c84b5cc192ecdcc36e574f7f7996872b86ab02a1483169b257a8026ce3c23855275080d876355a8d08d92386b82dc72cc793a6ae4", 0x67}], 0x3, &(0x7f00000009c0)=[{0xa0, 0x1ff, 0x800, "434c94cf096ca2c6e3a8a6433ea1ccf960ad859f9cabeb13bbcd113f89069f10afdedfc1c2c2a6455dc4d1cc5b8c42e105db6d89e5394ec484d7db74d839a1021c616111655c01f0d6840a2cc4a77a0a2613073b0d1e9ab634a70c9cafd212450fe14e5e32b6ee05d11e22515b1b820c7425d601c3c41b459046978582375e37f0268020620ba8c96a1cf8de5399"}, {0x20, 0x113, 0x3, "64bc63fb1e5bc65e5043"}], 0xc0, 0x4040000}, 0x4000040) r2 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r2, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:07:13 executing program 4: clone(0x20002100, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000001a40)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000200000000002000900400000000000bc0000000000030006000000000002000000e0000054d81458186fe8b90002000100000000000000020200044a7b030005000000000002000000e0003f010000000000fca0d9"], 0x60}}, 0x0) socketpair$nbd(0x2, 0x1, 0x0, &(0x7f0000000040)) flistxattr(0xffffffffffffffff, &(0x7f0000000140)=""/19, 0x13) ioctl$EVIOCREVOKE(0xffffffffffffffff, 0x40044591, &(0x7f0000000380)=0x8) r1 = creat(&(0x7f0000000080)='./file0\x00', 0x0) fsetxattr$security_smack_entry(0xffffffffffffffff, &(0x7f00000001c0)='security.SMACK64\x00', &(0x7f0000000280)='/dev/vcs#\x00', 0xa, 0x2) fstat(r1, &(0x7f0000000200)) fcntl$setsig(r1, 0xa, 0x3c) bpf$MAP_CREATE(0x0, &(0x7f00000002c0)={0xf, 0x7fff, 0xd9d4, 0x4, 0x4, r1}, 0x2c) exit(0x0) 06:07:14 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca580500008205000000b893123f89dedb03442000000000000000000000", @ANYRES32], 0x2}}, 0x0) [ 513.266235] attempt to access beyond end of device [ 513.271237] loop1: rw=1, want=130, limit=112 [ 513.297393] buffer_io_error: 30 callbacks suppressed [ 513.297403] Buffer I/O error on dev loop1, logical block 129, lost async page write [ 513.354451] attempt to access beyond end of device [ 513.359438] loop1: rw=1, want=131, limit=112 06:07:14 executing program 3: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) r1 = accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) setsockopt$l2tp_PPPOL2TP_SO_DEBUG(r1, 0x111, 0x1, 0x20, 0x4) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r2, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x3, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)=[{0x10, 0x107, 0x5}], 0x10, 0x20040000}, 0x8001) sendto$unix(0xffffffffffffffff, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r0) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:07:14 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca5805000000f0ffff00b893123f89dedb03442000000000000000000000", @ANYRES32], 0x2}}, 0x0) [ 513.419962] Buffer I/O error on dev loop1, logical block 130, lost async page write [ 513.456567] attempt to access beyond end of device [ 513.461524] loop1: rw=1, want=132, limit=112 [ 513.491893] Buffer I/O error on dev loop1, logical block 131, lost async page write [ 513.501024] attempt to access beyond end of device [ 513.506654] loop1: rw=1, want=133, limit=112 [ 513.511155] Buffer I/O error on dev loop1, logical block 132, lost async page write [ 513.519454] attempt to access beyond end of device [ 513.525677] loop1: rw=1, want=142, limit=112 [ 513.530277] Buffer I/O error on dev loop1, logical block 141, lost async page write [ 513.608397] attempt to access beyond end of device 06:07:14 executing program 5: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = socket$inet6(0xa, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp={0x2c, 0x0, 0x0, 0x3d}, 0x80) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r2, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000900)="b6d35518b48becfbd314d1fa96a307da879125869c71d40c5a385ce1d3af47c69a6acba0142b27475f2f890e1446d7e0851a8c84b5", 0x35}], 0x1, &(0x7f00000009c0)=[{0x10, 0x1ff, 0x800}], 0x10, 0x4040000}, 0x4000040) r3 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r3, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) [ 513.632516] loop1: rw=1, want=143, limit=112 06:07:14 executing program 2: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = socket$inet6(0xa, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r2, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000900)="b6", 0x1}], 0x1, &(0x7f00000009c0)=[{0xa0, 0x1ff, 0x800, "434c94cf096ca2c6e3a8a6433ea1ccf960ad859f9cabeb13bbcd113f89069f10afdedfc1c2c2a6455dc4d1cc5b8c42e105db6d89e5394ec484d7db74d839a1021c616111655c01f0d6840a2cc4a77a0a2613073b0d1e9ab634a70c9cafd212450fe14e5e32b6ee05d11e22515b1b820c7425d601c3c41b459046978582375e37f0268020620ba8c96a1cf8de5399"}, {0x20, 0x113, 0x3, "64bc63fb1e5bc65e5043"}], 0xc0, 0x4040000}, 0x4000040) r3 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r3, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:07:14 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca580500000200000000b893123f89dedb03442000000000000000000000", @ANYRES32], 0x2}}, 0x0) [ 513.662439] Buffer I/O error on dev loop1, logical block 142, lost async page write [ 513.696306] attempt to access beyond end of device [ 513.701372] loop1: rw=1, want=144, limit=112 [ 513.706008] Buffer I/O error on dev loop1, logical block 143, lost async page write [ 513.714255] attempt to access beyond end of device [ 513.719480] loop1: rw=1, want=145, limit=112 [ 513.723939] Buffer I/O error on dev loop1, logical block 144, lost async page write [ 513.743255] attempt to access beyond end of device [ 513.748300] loop1: rw=1, want=2178, limit=112 06:07:14 executing program 3: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r1, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x3, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)=[{0x10, 0x107, 0x5}], 0x10, 0x20040000}, 0x8001) sendto$unix(0xffffffffffffffff, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r0) open$dir(&(0x7f00000000c0)='./file0\x00', 0x80440, 0x0) setsockopt$IP_VS_SO_SET_TIMEOUT(r0, 0x0, 0x48a, &(0x7f0000000080)={0x6, 0x0, 0x8}, 0xc) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xeee, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:07:14 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca58050000fffffff000b893123f89dedb03442000000000000000000000", @ANYRES32], 0x2}}, 0x0) 06:07:14 executing program 5: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = socket$inet6(0xa, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp={0x2c, 0x0, 0x0, 0x3d}, 0x80) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r2, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000900)="b6d35518b48becfbd314d1fa96a307da879125869c71d40c5a385ce1d3af47c69a6acba0142b27475f2f890e1446d7e0851a8c84b5", 0x35}], 0x1, &(0x7f00000009c0)=[{0x10, 0x1ff, 0x800}], 0x10, 0x4040000}, 0x4000040) r3 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r3, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:07:14 executing program 2: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = socket$inet6(0xa, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r2, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000900)="b6", 0x1}], 0x1, &(0x7f00000009c0)=[{0xa0, 0x1ff, 0x800, "434c94cf096ca2c6e3a8a6433ea1ccf960ad859f9cabeb13bbcd113f89069f10afdedfc1c2c2a6455dc4d1cc5b8c42e105db6d89e5394ec484d7db74d839a1021c616111655c01f0d6840a2cc4a77a0a2613073b0d1e9ab634a70c9cafd212450fe14e5e32b6ee05d11e22515b1b820c7425d601c3c41b459046978582375e37f0268020620ba8c96a1cf8de5399"}, {0x20, 0x113, 0x3, "64bc63fb1e5bc65e5043"}], 0xc0, 0x4040000}, 0x4000040) r3 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r3, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:07:15 executing program 1: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) socket$inet6(0xa, 0x0, 0x0) r0 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp, 0x80) gettid() ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000440)="bd5281e90e382e49bc31c58bec93575c69955b99c59ad4bd0fe49bfd7fe94d8885ab76161d9ce31d5d33721046808670be4653c0cc84b9da38535652f4ed2dc5c76b973366cda5cd22c8854b38e0bd58358a1c4321e295b32e956b0a7b25eb0cb616e08644cfab02fce229997b4ca12d8723eff6b59433fc01a0bd53b5f45a48e6ca29d035", 0x85}, {&(0x7f0000000600)="ee02b064c6289979b056ec862d34542624a8ef094eb3a6d305a6b17837f96191c27fc94f9efbd066e7e2aafbbf5452c61d49dff03991631cf6114f7113ed7e182e0d1b123bef992a4116ec55c036280818e436412b534c08c3dc283c7c9b4b455a38317ada3f0c861359a91d527f65a55a36cf34ce77f48745b116b0e4b4ef2b2ed9e1b16e6fb87b15bc5525f19be536cfb606be0f5e94fb6d503ebea5d3a1ed62d5ed5ada217fa9f737221eb398002f72faccd90f01e2fac7fb2097abded2aad0df01", 0xc3}, {&(0x7f0000000900)="b6d35518b48becfbd314d1fa96a307da879125869c71d40c5a385ce1d3af47c69a6acba0142b27475f2f890e1446d7e0851a8c84b5cc192ecdcc36e574f7f7996872b86ab02a1483169b257a8026ce3c23855275080d876355a8d08d92386b82dc72cc793a6ae4", 0x67}], 0x3, &(0x7f00000009c0)=[{0xa0, 0x1ff, 0x800, "434c94cf096ca2c6e3a8a6433ea1ccf960ad859f9cabeb13bbcd113f89069f10afdedfc1c2c2a6455dc4d1cc5b8c42e105db6d89e5394ec484d7db74d839a1021c616111655c01f0d6840a2cc4a77a0a2613073b0d1e9ab634a70c9cafd212450fe14e5e32b6ee05d11e22515b1b820c7425d601c3c41b459046978582375e37f0268020620ba8c96a1cf8de5399"}, {0x20, 0x113, 0x3, "64bc63fb1e5bc65e5043"}], 0xc0, 0x4040000}, 0x4000040) r1 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r1, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r0) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:07:15 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca580500000582000000b893123f89dedb03442000000000000000000000", @ANYRES32], 0x2}}, 0x0) 06:07:15 executing program 2: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = socket$inet6(0xa, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp={0x2c, 0x0, 0x0, 0x3d}, 0x80) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r2, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000900)="b6", 0x1}], 0x1, &(0x7f00000009c0)=[{0xa0, 0x1ff, 0x800, "434c94cf096ca2c6e3a8a6433ea1ccf960ad859f9cabeb13bbcd113f89069f10afdedfc1c2c2a6455dc4d1cc5b8c42e105db6d89e5394ec484d7db74d839a1021c616111655c01f0d6840a2cc4a77a0a2613073b0d1e9ab634a70c9cafd212450fe14e5e32b6ee05d11e22515b1b820c7425d601c3c41b459046978582375e37f0268020620ba8c96a1cf8de5399"}, {0x20, 0x113, 0x3, "64bc63fb1e5bc65e5043"}], 0xc0, 0x4040000}, 0x4000040) r3 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r3, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:07:15 executing program 4: recvmmsg(0xffffffffffffffff, &(0x7f0000000380)=[{{&(0x7f0000000080)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, 0x80, &(0x7f0000000340)=[{&(0x7f0000000100)=""/153, 0x99}, {&(0x7f00000001c0)=""/126, 0x7e}, {&(0x7f0000000240)=""/73, 0x49}, {&(0x7f00000002c0)=""/77, 0x4d}], 0x4, 0x0, 0x0, 0x5}, 0x1ff}], 0x1, 0x40000040, &(0x7f00000003c0)) setsockopt$inet6_int(r0, 0x29, 0xd0, &(0x7f0000000400)=0x7, 0x4) r1 = socket$inet6(0xa, 0x2, 0x0) ioctl$sock_SIOCOUTQNSD(r1, 0x894b, &(0x7f0000000000)) prctl$getreaper(0x29, &(0x7f0000987ff8)) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) 06:07:15 executing program 3: r0 = memfd_create(&(0x7f0000000040)='iocharset', 0x2) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f00000000c0)={0x0, @local, @dev}, &(0x7f00000001c0)=0xc) connect$packet(r0, &(0x7f00000003c0)={0x11, 0x9, r1, 0x1, 0x3, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}}, 0x14) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r2 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r3, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x3, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)=[{0x10, 0x107, 0x5}], 0x10, 0x20040000}, 0x8001) sendto$unix(0xffffffffffffffff, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r2) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) memfd_create(&(0x7f0000000380)='\x00', 0x4) 06:07:15 executing program 5: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = socket$inet6(0xa, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp={0x2c, 0x0, 0x0, 0x3d}, 0x80) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r2, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000900)="b6d35518b48becfbd314d1fa96a307da879125869c71d40c5a385ce1d3af47c69a6acba0142b27475f2f890e1446d7e0851a8c84b5", 0x35}], 0x1, &(0x7f00000009c0)=[{0x10, 0x1ff, 0x800}], 0x10, 0x4040000}, 0x4000040) r3 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r3, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:07:15 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca580500000000000200b893123f89dedb03442000000000000000000000", @ANYRES32], 0x2}}, 0x0) [ 514.935100] attempt to access beyond end of device [ 514.940232] loop1: rw=1, want=130, limit=112 [ 514.962587] Buffer I/O error on dev loop1, logical block 129, lost async page write 06:07:15 executing program 4: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x0, 0x0) sendto$inet(r0, &(0x7f0000000000), 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @loopback}, 0x10) write$binfmt_elf64(r0, &(0x7f00000016c0)=ANY=[@ANYPTR=&(0x7f00000005c0)=ANY=[@ANYPTR=&(0x7f00000004c0)=ANY=[@ANYRES16], @ANYRES32, @ANYRES64=0x0, @ANYPTR=&(0x7f0000000580)=ANY=[@ANYPTR64, @ANYRESHEX, @ANYPTR64, @ANYRES32=0x0]], @ANYRESDEC, @ANYRES16], 0xffffff84) recvmsg(r0, &(0x7f0000000240)={&(0x7f0000000740)=@nfc, 0x80, &(0x7f00000001c0)=[{&(0x7f0000003ac0)=""/4096, 0xff9a}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x0) [ 515.040953] attempt to access beyond end of device [ 515.079657] loop1: rw=1, want=131, limit=112 [ 515.111638] Buffer I/O error on dev loop1, logical block 130, lost async page write 06:07:15 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca580500007fffffff00b893123f89dedb03442000000000000000000000", @ANYRES32], 0x2}}, 0x0) [ 515.154484] attempt to access beyond end of device [ 515.166760] loop1: rw=1, want=132, limit=112 [ 515.177031] attempt to access beyond end of device [ 515.197808] loop1: rw=1, want=133, limit=112 06:07:15 executing program 2: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = socket$inet6(0xa, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp={0x2c, 0x0, 0x0, 0x3d}, 0x80) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r2, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000900)="b6", 0x1}], 0x1, &(0x7f00000009c0)=[{0xa0, 0x1ff, 0x800, "434c94cf096ca2c6e3a8a6433ea1ccf960ad859f9cabeb13bbcd113f89069f10afdedfc1c2c2a6455dc4d1cc5b8c42e105db6d89e5394ec484d7db74d839a1021c616111655c01f0d6840a2cc4a77a0a2613073b0d1e9ab634a70c9cafd212450fe14e5e32b6ee05d11e22515b1b820c7425d601c3c41b459046978582375e37f0268020620ba8c96a1cf8de5399"}, {0x20, 0x113, 0x3, "64bc63fb1e5bc65e5043"}], 0xc0, 0x4040000}, 0x4000040) r3 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r3, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) [ 515.210823] attempt to access beyond end of device [ 515.228146] loop1: rw=1, want=142, limit=112 [ 515.250614] attempt to access beyond end of device 06:07:16 executing program 3: r0 = memfd_create(&(0x7f0000000040)='iocharset', 0x2) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r2, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x3, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="10001e5d1300004fc4fa7f1201000005000000"], 0x10, 0x20040000}, 0x8001) sendto$unix(0xffffffffffffffff, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) r3 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r3, &(0x7f0000deb000)={0x2, 0x3, @broadcast}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r3, 0x6, 0xd, &(0x7f00000001c0)='dctcp\x00', 0x6) setsockopt$SO_ATTACH_FILTER(r3, 0x1, 0x1a, &(0x7f0000b86000)={0x1, &(0x7f00006dc000)=[{0x6, 0x0, 0x0, 0xa1}]}, 0x10) ioctl$KVM_CHECK_EXTENSION(r1, 0xae03, 0x6) sendto$inet(r3, &(0x7f00000001c0), 0x0, 0x200007fc, &(0x7f0000deaff0)={0x2, 0x3, @loopback}, 0x10) sendto$inet(r3, &(0x7f00000005c0)="1a8c443d3a568c81cc096aa87ddab0f1b182da383fd71795f41053261e63b0b9f1283f7431b6146106716c21b43625f9194bf4b6a5dba53c46b82862a2f804121cda7e6be8fd507bb1545de629746d878f10be8036e98a270c42d6458f97b342303464e94ccb6d6f4f81941e3f3fa371596cdf17e160c992140c9dc81362f019f017", 0x82, 0x0, &(0x7f0000000100)={0x2, 0x0, @multicast2}, 0x10) readv(r3, &(0x7f0000000140)=[{&(0x7f0000000000)=""/226, 0xfffffd85}], 0x1) setsockopt$inet_tcp_TCP_CONGESTION(r3, 0x6, 0xd, &(0x7f0000000200)='yeah\x00', 0x5) recvfrom(r3, &(0x7f0000000380)=""/239, 0xff4e, 0x0, 0x0, 0x307) close(r3) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) setsockopt$inet_sctp_SCTP_FRAGMENT_INTERLEAVE(r0, 0x84, 0x12, &(0x7f0000000080)=0x8000, 0x4) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) [ 515.265787] attempt to access beyond end of device [ 515.270740] loop2: rw=1, want=130, limit=112 [ 515.276713] loop1: rw=1, want=143, limit=112 [ 515.286961] attempt to access beyond end of device [ 515.294243] attempt to access beyond end of device [ 515.302998] loop2: rw=1, want=131, limit=112 06:07:16 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca58050000009effffffb893123f89dedb03442000000000000000000000", @ANYRES32], 0x2}}, 0x0) [ 515.313289] loop1: rw=1, want=144, limit=112 [ 515.314768] attempt to access beyond end of device [ 515.329374] attempt to access beyond end of device [ 515.338858] loop1: rw=1, want=145, limit=112 [ 515.340364] loop2: rw=1, want=132, limit=112 [ 515.352456] attempt to access beyond end of device [ 515.358832] loop2: rw=1, want=133, limit=112 [ 515.359205] attempt to access beyond end of device [ 515.371199] attempt to access beyond end of device [ 515.381941] loop2: rw=1, want=142, limit=112 [ 515.397039] attempt to access beyond end of device [ 515.399576] loop1: rw=1, want=2178, limit=112 [ 515.404527] loop2: rw=1, want=143, limit=112 [ 515.415506] attempt to access beyond end of device [ 515.431719] loop2: rw=1, want=144, limit=112 [ 515.467581] attempt to access beyond end of device [ 515.484741] loop2: rw=1, want=145, limit=112 [ 515.496781] attempt to access beyond end of device [ 515.505771] loop2: rw=1, want=425, limit=112 [ 515.576236] attempt to access beyond end of device [ 515.588307] loop5: rw=1, want=130, limit=112 [ 515.592765] attempt to access beyond end of device [ 515.645529] loop5: rw=1, want=131, limit=112 [ 515.689435] attempt to access beyond end of device [ 515.724943] loop5: rw=1, want=132, limit=112 [ 515.729412] attempt to access beyond end of device [ 515.770657] loop5: rw=1, want=133, limit=112 [ 515.791746] attempt to access beyond end of device [ 515.808660] loop5: rw=1, want=142, limit=112 [ 515.822608] attempt to access beyond end of device [ 515.860251] loop5: rw=1, want=143, limit=112 [ 515.889031] attempt to access beyond end of device [ 515.926150] loop5: rw=1, want=144, limit=112 [ 515.959447] attempt to access beyond end of device [ 515.983765] loop5: rw=1, want=145, limit=112 [ 516.031334] attempt to access beyond end of device [ 516.100262] loop5: rw=1, want=2178, limit=112 [ 516.216185] attempt to access beyond end of device [ 516.221153] loop2: rw=1, want=130, limit=112 [ 516.225673] attempt to access beyond end of device [ 516.230623] loop2: rw=1, want=131, limit=112 [ 516.235140] attempt to access beyond end of device [ 516.240087] loop2: rw=1, want=132, limit=112 [ 516.247331] attempt to access beyond end of device [ 516.252281] loop2: rw=1, want=133, limit=112 [ 516.282386] attempt to access beyond end of device [ 516.314515] loop2: rw=1, want=142, limit=112 [ 516.318997] attempt to access beyond end of device [ 516.323935] loop2: rw=1, want=143, limit=112 06:07:17 executing program 1: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) socket$inet6(0xa, 0x0, 0x0) r0 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp, 0x80) gettid() ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000440)="bd5281e90e382e49bc31c58bec93575c69955b99c59ad4bd0fe49bfd7fe94d8885ab76161d9ce31d5d33721046808670be4653c0cc84b9da38535652f4ed2dc5c76b973366cda5cd22c8854b38e0bd58358a1c4321e295b32e956b0a7b25eb0cb616e08644cfab02fce229997b4ca12d8723eff6b59433fc01a0bd53b5f45a48e6ca29d035", 0x85}, {&(0x7f0000000600)="ee02b064c6289979b056ec862d34542624a8ef094eb3a6d305a6b17837f96191c27fc94f9efbd066e7e2aafbbf5452c61d49dff03991631cf6114f7113ed7e182e0d1b123bef992a4116ec55c036280818e436412b534c08c3dc283c7c9b4b455a38317ada3f0c861359a91d527f65a55a36cf34ce77f48745b116b0e4b4ef2b2ed9e1b16e6fb87b15bc5525f19be536cfb606be0f5e94fb6d503ebea5d3a1ed62d5ed5ada217fa9f737221eb398002f72faccd90f01e2fac7fb2097abded2aad0df01", 0xc3}, {&(0x7f0000000900)="b6d35518b48becfbd314d1fa96a307da879125869c71d40c5a385ce1d3af47c69a6acba0142b27475f2f890e1446d7e0851a8c84b5cc192ecdcc36e574f7f7996872b86ab02a1483169b257a8026ce3c23855275080d876355a8d08d92386b82dc72cc793a6ae4", 0x67}], 0x3, &(0x7f00000009c0)=[{0xa0, 0x1ff, 0x800, "434c94cf096ca2c6e3a8a6433ea1ccf960ad859f9cabeb13bbcd113f89069f10afdedfc1c2c2a6455dc4d1cc5b8c42e105db6d89e5394ec484d7db74d839a1021c616111655c01f0d6840a2cc4a77a0a2613073b0d1e9ab634a70c9cafd212450fe14e5e32b6ee05d11e22515b1b820c7425d601c3c41b459046978582375e37f0268020620ba8c96a1cf8de5399"}, {0x20, 0x113, 0x3, "64bc63fb1e5bc65e5043"}], 0xc0, 0x4040000}, 0x4000040) r1 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r1, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r0) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:07:17 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca5805000000f0ffffffb893123f89dedb03442000000000000000000000", @ANYRES32], 0x2}}, 0x0) 06:07:17 executing program 4: r0 = socket$inet6_sctp(0xa, 0x400000001, 0x84) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x23, &(0x7f00000002c0)={0x0, @in={{0xa, 0x0, @dev, [0x0, 0x300000000000000, 0x0, 0x0, 0x4000000]}}}, 0x98) 06:07:17 executing program 5: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = socket$inet6(0xa, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp={0x2c, 0x0, 0x0, 0x3d}, 0x80) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r2, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000900)="b6d35518b48becfbd314d1fa96a307da879125869c71d40c5a385ce1d3af47c69a6acba0142b27475f2f890e1446d7e0851a8c84b5", 0x35}], 0x1, &(0x7f00000009c0)=[{0x58, 0x1ff, 0x800, "434c94cf096ca2c6e3a8a6433ea1ccf960ad859f9cabeb13bbcd113f89069f10afdedfc1c2c2a6455dc4d1cc5b8c42e105db6d89e5394ec484d7db74d839a1021c616111655c01"}], 0x58, 0x4040000}, 0x4000040) r3 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r3, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:07:17 executing program 2: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = socket$inet6(0xa, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp={0x2c, 0x0, 0x0, 0x3d}, 0x80) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r2, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000900)="b6", 0x1}], 0x1, &(0x7f00000009c0)=[{0xa0, 0x1ff, 0x800, "434c94cf096ca2c6e3a8a6433ea1ccf960ad859f9cabeb13bbcd113f89069f10afdedfc1c2c2a6455dc4d1cc5b8c42e105db6d89e5394ec484d7db74d839a1021c616111655c01f0d6840a2cc4a77a0a2613073b0d1e9ab634a70c9cafd212450fe14e5e32b6ee05d11e22515b1b820c7425d601c3c41b459046978582375e37f0268020620ba8c96a1cf8de5399"}, {0x20, 0x113, 0x3, "64bc63fb1e5bc65e5043"}], 0xc0, 0x4040000}, 0x4000040) r3 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r3, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) [ 516.371620] attempt to access beyond end of device [ 516.378444] loop2: rw=1, want=144, limit=112 [ 516.383474] attempt to access beyond end of device [ 516.405097] attempt to access beyond end of device [ 516.410083] loop1: rw=1, want=130, limit=112 [ 516.423058] loop2: rw=1, want=145, limit=112 [ 516.429154] attempt to access beyond end of device [ 516.448963] loop1: rw=1, want=131, limit=112 [ 516.460334] attempt to access beyond end of device 06:07:17 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca580500000000f0ffffb893123f89dedb03442000000000000000000000", @ANYRES32], 0x2}}, 0x0) [ 516.476446] attempt to access beyond end of device [ 516.487871] loop2: rw=1, want=2178, limit=112 [ 516.506634] loop1: rw=1, want=132, limit=112 [ 516.511122] attempt to access beyond end of device 06:07:17 executing program 4: socket$key(0xf, 0x3, 0x2) r0 = perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0xfffffffffffffffe}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x7fffe, 0x7ffffffa) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) pwritev(r1, &(0x7f00000006c0)=[{&(0x7f0000000600)="217d6446fd2578fc535c9174b148f19e8260d97ef455bee1f9936269c4f54f883f84b758bda5d94df1e346847ff7119d4ba32ca6333555b0952dc9c16add5fac4919de815aa0d9901fc612e26339ec54bd54eb72557ca016693026e97febfca4da918ec0b3670eb4c807a47304f2e03054cc2dc91dd14ad05a98b7f931effef44943436000357fba79ac455579c4e579452a740b6dfad0e4aeff9f01aceb935bc2fd68e3bd2a6c5a70ea915b1179ae2fb9105afd668c659ce4bc90d58f6045", 0xbf}], 0x1, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$setflags(0xffffffffffffffff, 0x2, 0x1) getresgid(&(0x7f0000000240), &(0x7f0000000280), &(0x7f00000002c0)) r2 = socket$inet6(0xa, 0x400000000001, 0x0) r3 = creat(&(0x7f00000001c0)='./bus\x00', 0x0) ioctl$LOOP_CHANGE_FD(r3, 0x4c06, 0xffffffffffffffff) r4 = dup(r2) ioctl$FS_IOC_GETFLAGS(r0, 0x80086601, &(0x7f0000000100)) setsockopt$inet6_tcp_int(r4, 0x6, 0x12, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r2, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r2, &(0x7f00000004c0), 0x0, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f0000000200)='syz_tun\x00', 0x10) r5 = open(&(0x7f0000000440)='./bus\x00', 0x141042, 0x0) ftruncate(r5, 0x2007fff) sendfile(r4, r5, &(0x7f0000d83ff8), 0x8000fffffffe) [ 516.534501] loop1: rw=1, want=133, limit=112 [ 516.539072] attempt to access beyond end of device [ 516.544347] loop1: rw=1, want=142, limit=112 [ 516.550029] attempt to access beyond end of device [ 516.561087] loop1: rw=1, want=143, limit=112 [ 516.569696] attempt to access beyond end of device [ 516.574917] loop1: rw=1, want=144, limit=112 [ 516.579513] attempt to access beyond end of device 06:07:17 executing program 3: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x40000000, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r1, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x3, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)=[{0x10, 0x107, 0x5}], 0x10, 0x20040000}, 0x8001) sendto$unix(0xffffffffffffffff, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r0) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) socket$pptp(0x18, 0x1, 0x2) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) [ 516.636298] loop1: rw=1, want=145, limit=112 [ 516.658583] attempt to access beyond end of device [ 516.663552] loop1: rw=1, want=1977, limit=112 06:07:17 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca580500000082050000b893123f89dedb03442000000000000000000000", @ANYRES32], 0x2}}, 0x0) [ 516.798713] nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead. 06:07:17 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca580500000002000000b893123f89dedb03442000000000000000000000", @ANYRES32], 0x2}}, 0x0) 06:07:17 executing program 2: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = socket$inet6(0xa, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp={0x2c, 0x0, 0x0, 0x3d}, 0x80) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r2, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000900)="b6", 0x1}], 0x1, &(0x7f00000009c0)=[{0xa0, 0x1ff, 0x800, "434c94cf096ca2c6e3a8a6433ea1ccf960ad859f9cabeb13bbcd113f89069f10afdedfc1c2c2a6455dc4d1cc5b8c42e105db6d89e5394ec484d7db74d839a1021c616111655c01f0d6840a2cc4a77a0a2613073b0d1e9ab634a70c9cafd212450fe14e5e32b6ee05d11e22515b1b820c7425d601c3c41b459046978582375e37f0268020620ba8c96a1cf8de5399"}, {0x20, 0x113, 0x3, "64bc63fb1e5bc65e5043"}], 0xc0, 0x4040000}, 0x4000040) r3 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r3, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:07:18 executing program 5: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = socket$inet6(0xa, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp={0x2c, 0x0, 0x0, 0x3d}, 0x80) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r2, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000900)="b6d35518b48becfbd314d1fa96a307da879125869c71d40c5a385ce1d3af47c69a6acba0142b27475f2f890e1446d7e0851a8c84b5", 0x35}], 0x1, &(0x7f00000009c0)=[{0x58, 0x1ff, 0x800, "434c94cf096ca2c6e3a8a6433ea1ccf960ad859f9cabeb13bbcd113f89069f10afdedfc1c2c2a6455dc4d1cc5b8c42e105db6d89e5394ec484d7db74d839a1021c616111655c01"}], 0x58, 0x4040000}, 0x4000040) r3 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r3, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) [ 517.350881] attempt to access beyond end of device [ 517.364452] loop5: rw=1, want=130, limit=112 [ 517.407361] attempt to access beyond end of device [ 517.443552] loop5: rw=1, want=131, limit=112 [ 517.469603] attempt to access beyond end of device [ 517.496619] loop5: rw=1, want=132, limit=112 [ 517.501076] attempt to access beyond end of device [ 517.550393] loop5: rw=1, want=133, limit=112 [ 517.587202] attempt to access beyond end of device [ 517.603095] loop5: rw=1, want=142, limit=112 [ 517.613393] attempt to access beyond end of device [ 517.631999] loop5: rw=1, want=143, limit=112 [ 517.642636] attempt to access beyond end of device [ 517.653096] loop5: rw=1, want=144, limit=112 [ 517.661768] attempt to access beyond end of device [ 517.670288] loop5: rw=1, want=145, limit=112 [ 517.692889] attempt to access beyond end of device [ 517.706255] loop5: rw=1, want=585, limit=112 06:07:18 executing program 1: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) socket$inet6(0xa, 0x0, 0x0) r0 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp, 0x80) gettid() ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000440)="bd5281e90e382e49bc31c58bec93575c69955b99c59ad4bd0fe49bfd7fe94d8885ab76161d9ce31d5d33721046808670be4653c0cc84b9da38535652f4ed2dc5c76b973366cda5cd22c8854b38e0bd58358a1c4321e295b32e956b0a7b25eb0cb616e08644cfab02fce229997b4ca12d8723eff6b59433fc01a0bd53b5f45a48e6ca29d035", 0x85}, {&(0x7f0000000600)="ee02b064c6289979b056ec862d34542624a8ef094eb3a6d305a6b17837f96191c27fc94f9efbd066e7e2aafbbf5452c61d49dff03991631cf6114f7113ed7e182e0d1b123bef992a4116ec55c036280818e436412b534c08c3dc283c7c9b4b455a38317ada3f0c861359a91d527f65a55a36cf34ce77f48745b116b0e4b4ef2b2ed9e1b16e6fb87b15bc5525f19be536cfb606be0f5e94fb6d503ebea5d3a1ed62d5ed5ada217fa9f737221eb398002f72faccd90f01e2fac7fb2097abded2aad0df01", 0xc3}], 0x2, &(0x7f00000009c0)=[{0xa0, 0x1ff, 0x800, "434c94cf096ca2c6e3a8a6433ea1ccf960ad859f9cabeb13bbcd113f89069f10afdedfc1c2c2a6455dc4d1cc5b8c42e105db6d89e5394ec484d7db74d839a1021c616111655c01f0d6840a2cc4a77a0a2613073b0d1e9ab634a70c9cafd212450fe14e5e32b6ee05d11e22515b1b820c7425d601c3c41b459046978582375e37f0268020620ba8c96a1cf8de5399"}, {0x20, 0x113, 0x3, "64bc63fb1e5bc65e5043"}], 0xc0, 0x4040000}, 0x4000040) r1 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r1, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r0) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:07:18 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca5805000000fffff000b893123f89dedb03442000000000000000000000", @ANYRES32], 0x2}}, 0x0) 06:07:18 executing program 2: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = socket$inet6(0xa, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp={0x2c, 0x0, 0x0, 0x3d}, 0x80) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r2, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000900)="b6", 0x1}], 0x1, &(0x7f00000009c0)=[{0xa0, 0x1ff, 0x800, "434c94cf096ca2c6e3a8a6433ea1ccf960ad859f9cabeb13bbcd113f89069f10afdedfc1c2c2a6455dc4d1cc5b8c42e105db6d89e5394ec484d7db74d839a1021c616111655c01f0d6840a2cc4a77a0a2613073b0d1e9ab634a70c9cafd212450fe14e5e32b6ee05d11e22515b1b820c7425d601c3c41b459046978582375e37f0268020620ba8c96a1cf8de5399"}, {0x20, 0x113, 0x3, "64bc63fb1e5bc65e5043"}], 0xc0, 0x4040000}, 0x4000040) r3 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r3, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:07:18 executing program 3: r0 = memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) r2 = accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) r5 = gettid() ioctl$LOOP_CTL_REMOVE(r4, 0x5421, 0x0) lookup_dcookie(0x80000000, &(0x7f00000001c0)=""/41, 0x29) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x3, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)=[{0x10, 0x107, 0x5}], 0x10, 0x20040000}, 0x8001) ioctl$KVM_SET_SIGNAL_MASK(r0, 0x4004ae8b, &(0x7f0000000480)={0x56, "3717fec31fc9a1b25d8aaf59c7ef00d4f8513ac359d9775616446aad264c608fbae7dd8593cdd6f952fcd86aff0e4322ac0a80cdcf20bd954739dba497939e7158d34dc1e6c3f722a37d52b402315aec662376018977"}) sendto$unix(0xffffffffffffffff, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) perf_event_open(&(0x7f0000000080)={0x0, 0x70, 0x3, 0xe9a, 0x4, 0x1, 0x0, 0x4, 0x4000, 0x1, 0x1, 0xfffffffffffffeff, 0x0, 0x7fc0000000000, 0x1, 0x1, 0x580, 0x0, 0x91, 0xea6, 0x8, 0x4, 0x6, 0x9, 0x7, 0x5, 0x6, 0x8, 0x2, 0x8, 0x4, 0xee3, 0xffffffffffffffe1, 0x9, 0x1, 0x2, 0x8, 0x20, 0x0, 0x8000, 0x4, @perf_config_ext={0x10001, 0x8000}, 0x4050, 0x1, 0x4, 0x7, 0x20, 0x4, 0x6}, r5, 0xe, r3, 0x1) fchdir(r1) getsockopt$inet_sctp6_SCTP_RTOINFO(r2, 0x84, 0x0, &(0x7f0000000280)={0x0, 0x9, 0x6, 0x7fff}, &(0x7f0000000380)=0x10) setsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r0, 0x84, 0x6, &(0x7f00000003c0)={r6, @in={{0x2, 0x4e22, @rand_addr=0xc01}}}, 0x84) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000340)='.\x00', 0x1) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:07:18 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) r1 = syz_open_procfs(0x0, &(0x7f00000006c0)='pagemap\x00') sendfile(r0, r1, &(0x7f0000000040)=0x100000, 0x8001) [ 517.895964] attempt to access beyond end of device [ 517.904154] loop1: rw=1, want=130, limit=112 [ 517.908679] attempt to access beyond end of device [ 517.913619] loop1: rw=1, want=131, limit=112 06:07:18 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca580500000000000001b893123f89dedb03442000000000000000000000", @ANYRES32], 0x2}}, 0x0) [ 517.982013] attempt to access beyond end of device [ 518.011672] loop1: rw=1, want=132, limit=112 06:07:18 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2000000000000001, 0x8010000000000084) bind$inet6(r0, &(0x7f00002aafe4)={0xa, 0x4e23, 0x0, @ipv4}, 0x1c) listen(r0, 0x9) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) sendto$inet6(r1, &(0x7f0000000100)='F', 0x1, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback, 0xf000000}, 0x1c) [ 518.035295] attempt to access beyond end of device [ 518.094314] loop1: rw=1, want=133, limit=112 [ 518.098825] attempt to access beyond end of device [ 518.154869] loop1: rw=1, want=142, limit=112 [ 518.173154] attempt to access beyond end of device [ 518.200463] loop1: rw=1, want=143, limit=112 06:07:18 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca580500000000f00000b893123f89dedb03442000000000000000000000", @ANYRES32], 0x2}}, 0x0) 06:07:19 executing program 3: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r1, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x3, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)=[{0x10, 0x107, 0x5}], 0x10, 0x20040000}, 0x8001) sendto$unix(0xffffffffffffffff, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r0) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) [ 518.228613] attempt to access beyond end of device [ 518.354501] loop1: rw=1, want=144, limit=112 06:07:19 executing program 2: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = socket$inet6(0xa, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp={0x2c, 0x0, 0x0, 0x3d}, 0x80) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r2, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000900)="b6", 0x1}], 0x1, &(0x7f00000009c0)=[{0xa0, 0x1ff, 0x800, "434c94cf096ca2c6e3a8a6433ea1ccf960ad859f9cabeb13bbcd113f89069f10afdedfc1c2c2a6455dc4d1cc5b8c42e105db6d89e5394ec484d7db74d839a1021c616111655c01f0d6840a2cc4a77a0a2613073b0d1e9ab634a70c9cafd212450fe14e5e32b6ee05d11e22515b1b820c7425d601c3c41b459046978582375e37f0268020620ba8c96a1cf8de5399"}, {0x20, 0x113, 0x3, "64bc63fb1e5bc65e5043"}], 0xc0, 0x4040000}, 0x4000040) r3 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r3, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) [ 518.392787] buffer_io_error: 52 callbacks suppressed [ 518.392798] Buffer I/O error on dev loop1, logical block 143, lost async page write [ 518.406860] attempt to access beyond end of device [ 518.415149] loop1: rw=1, want=145, limit=112 [ 518.419615] Buffer I/O error on dev loop1, logical block 144, lost async page write [ 518.437475] attempt to access beyond end of device 06:07:19 executing program 5: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = socket$inet6(0xa, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp={0x2c, 0x0, 0x0, 0x3d}, 0x80) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r2, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000900)="b6d35518b48becfbd314d1fa96a307da879125869c71d40c5a385ce1d3af47c69a6acba0142b27475f2f890e1446d7e0851a8c84b5", 0x35}], 0x1, &(0x7f00000009c0)=[{0x58, 0x1ff, 0x800, "434c94cf096ca2c6e3a8a6433ea1ccf960ad859f9cabeb13bbcd113f89069f10afdedfc1c2c2a6455dc4d1cc5b8c42e105db6d89e5394ec484d7db74d839a1021c616111655c01"}], 0x58, 0x4040000}, 0x4000040) r3 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r3, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) [ 518.442446] loop1: rw=1, want=1993, limit=112 06:07:19 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca5805000000f0000000b893123f89dedb03442000000000000000000000", @ANYRES32], 0x2}}, 0x0) 06:07:19 executing program 1: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) socket$inet6(0xa, 0x0, 0x0) r0 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp, 0x80) gettid() ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000440)="bd5281e90e382e49bc31c58bec93575c69955b99c59ad4bd0fe49bfd7fe94d8885ab76161d9ce31d5d33721046808670be4653c0cc84b9da38535652f4ed2dc5c76b973366cda5cd22c8854b38e0bd58358a1c4321e295b32e956b0a7b25eb0cb616e08644cfab02fce229997b4ca12d8723eff6b59433fc01a0bd53b5f45a48e6ca29d035", 0x85}, {&(0x7f0000000600)="ee02b064c6289979b056ec862d34542624a8ef094eb3a6d305a6b17837f96191c27fc94f9efbd066e7e2aafbbf5452c61d49dff03991631cf6114f7113ed7e182e0d1b123bef992a4116ec55c036280818e436412b534c08c3dc283c7c9b4b455a38317ada3f0c861359a91d527f65a55a36cf34ce77f48745b116b0e4b4ef2b2ed9e1b16e6fb87b15bc5525f19be536cfb606be0f5e94fb6d503ebea5d3a1ed62d5ed5ada217fa9f737221eb398002f72faccd90f01e2fac7fb2097abded2aad0df01", 0xc3}], 0x2, &(0x7f00000009c0)=[{0xa0, 0x1ff, 0x800, "434c94cf096ca2c6e3a8a6433ea1ccf960ad859f9cabeb13bbcd113f89069f10afdedfc1c2c2a6455dc4d1cc5b8c42e105db6d89e5394ec484d7db74d839a1021c616111655c01f0d6840a2cc4a77a0a2613073b0d1e9ab634a70c9cafd212450fe14e5e32b6ee05d11e22515b1b820c7425d601c3c41b459046978582375e37f0268020620ba8c96a1cf8de5399"}, {0x20, 0x113, 0x3, "64bc63fb1e5bc65e5043"}], 0xc0, 0x4040000}, 0x4000040) r1 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r1, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r0) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:07:19 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca5805000000ffffff9eb893123f89dedb03442000000000000000000000", @ANYRES32], 0x2}}, 0x0) 06:07:19 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000000)) r1 = syz_open_pts(r0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000fd0ffc)=0x2) perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x71}, 0x0, 0x0, 0xffffffffffffffff, 0x0) readv(r1, &(0x7f00000000c0)=[{&(0x7f0000000180)=""/180, 0xb4}], 0x1) 06:07:19 executing program 5: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = socket$inet6(0xa, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp={0x2c, 0x0, 0x0, 0x3d}, 0x80) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r2, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000900)="b6d35518b48becfbd314d1fa96a307da879125869c71d40c5a385ce1d3af47c69a6acba0142b27475f2f890e1446d7e0851a8c84b5", 0x35}], 0x1, &(0x7f00000009c0)=[{0x80, 0x1ff, 0x800, "434c94cf096ca2c6e3a8a6433ea1ccf960ad859f9cabeb13bbcd113f89069f10afdedfc1c2c2a6455dc4d1cc5b8c42e105db6d89e5394ec484d7db74d839a1021c616111655c01f0d6840a2cc4a77a0a2613073b0d1e9ab634a70c9cafd212450fe14e5e32b6ee05d11e22"}], 0x80, 0x4040000}, 0x4000040) r3 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r3, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) [ 519.251599] serio: Serial port pts0 06:07:20 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca5805000000fffffff0b893123f89dedb03442000000000000000000000", @ANYRES32], 0x2}}, 0x0) 06:07:20 executing program 3: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() r2 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/qat_adf_ctl\x00', 0x8010401, 0x0) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r2, 0x84, 0x8, &(0x7f00000000c0), &(0x7f00000001c0)=0x4) ioctl$LOOP_CTL_REMOVE(r1, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x3, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)=ANY=[@ANYBLOB="1001000005000000"], 0x10, 0x20040000}, 0x8001) sendto$unix(0xffffffffffffffff, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r0) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet6_MRT6_ADD_MFC_PROXY(r0, 0x29, 0xd2, &(0x7f0000000340)={{0xa, 0x4e20, 0x1, @remote}, {0xa, 0x4e21, 0x7, @dev={0xfe, 0x80, [], 0x16}}, 0xbdd2, [0x3, 0x6, 0x4, 0x4, 0x12000000000, 0x2, 0x5, 0x193]}, 0x5c) [ 519.369686] audit: type=1804 audit(1539756440.123:121): pid=24116 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor3" name="/root/syzkaller-testdir399687728/syzkaller.SA5dD7/369/file0/file0" dev="loop3" ino=236 res=1 [ 519.395318] audit: type=1804 audit(1539756440.153:122): pid=24159 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor3" name="/root/syzkaller-testdir399687728/syzkaller.SA5dD7/369/file0/file0" dev="loop3" ino=236 res=1 [ 519.476617] attempt to access beyond end of device [ 519.481642] loop3: rw=1, want=130, limit=112 [ 519.517170] Buffer I/O error on dev loop3, logical block 129, lost async page write [ 519.543111] attempt to access beyond end of device [ 519.560696] loop3: rw=1, want=131, limit=112 06:07:20 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca580500000000000002b893123f89dedb03442000000000000000000000", @ANYRES32], 0x2}}, 0x0) [ 519.580214] Buffer I/O error on dev loop3, logical block 130, lost async page write [ 519.599868] attempt to access beyond end of device [ 519.611462] loop3: rw=1, want=132, limit=112 [ 519.632387] Buffer I/O error on dev loop3, logical block 131, lost async page write [ 519.654459] attempt to access beyond end of device [ 519.670468] loop3: rw=1, want=133, limit=112 06:07:20 executing program 2: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = socket$inet6(0xa, 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp={0x2c, 0x0, 0x0, 0x3d}, 0x80) r1 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r1, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000900)="b6", 0x1}], 0x1, &(0x7f00000009c0)=[{0xa0, 0x1ff, 0x800, "434c94cf096ca2c6e3a8a6433ea1ccf960ad859f9cabeb13bbcd113f89069f10afdedfc1c2c2a6455dc4d1cc5b8c42e105db6d89e5394ec484d7db74d839a1021c616111655c01f0d6840a2cc4a77a0a2613073b0d1e9ab634a70c9cafd212450fe14e5e32b6ee05d11e22515b1b820c7425d601c3c41b459046978582375e37f0268020620ba8c96a1cf8de5399"}, {0x20, 0x113, 0x3, "64bc63fb1e5bc65e5043"}], 0xc0, 0x4040000}, 0x4000040) r2 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r2, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(0xffffffffffffffff) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:07:20 executing program 5: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = socket$inet6(0xa, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp={0x2c, 0x0, 0x0, 0x3d}, 0x80) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r2, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000900)="b6d35518b48becfbd314d1fa96a307da879125869c71d40c5a385ce1d3af47c69a6acba0142b27475f2f890e1446d7e0851a8c84b5", 0x35}], 0x1, &(0x7f00000009c0)=[{0x80, 0x1ff, 0x800, "434c94cf096ca2c6e3a8a6433ea1ccf960ad859f9cabeb13bbcd113f89069f10afdedfc1c2c2a6455dc4d1cc5b8c42e105db6d89e5394ec484d7db74d839a1021c616111655c01f0d6840a2cc4a77a0a2613073b0d1e9ab634a70c9cafd212450fe14e5e32b6ee05d11e22"}], 0x80, 0x4040000}, 0x4000040) r3 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r3, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) [ 519.678139] Buffer I/O error on dev loop3, logical block 132, lost async page write [ 519.690819] attempt to access beyond end of device [ 519.700700] loop3: rw=1, want=142, limit=112 [ 519.716910] Buffer I/O error on dev loop3, logical block 141, lost async page write [ 519.729686] attempt to access beyond end of device [ 519.737919] loop3: rw=1, want=143, limit=112 [ 519.745646] attempt to access beyond end of device [ 519.750596] loop2: rw=1, want=130, limit=112 [ 519.757864] Buffer I/O error on dev loop3, logical block 142, lost async page write [ 519.768756] Buffer I/O error on dev loop2, logical block 129, lost async page write 06:07:20 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca58050000007fffffffb893123f89dedb03442000000000000000000000", @ANYRES32], 0x2}}, 0x0) [ 519.781923] attempt to access beyond end of device [ 519.788365] attempt to access beyond end of device [ 519.796019] loop3: rw=1, want=144, limit=112 [ 519.802894] loop2: rw=1, want=131, limit=112 [ 519.810149] Buffer I/O error on dev loop3, logical block 143, lost async page write [ 519.826462] attempt to access beyond end of device [ 519.849467] loop2: rw=1, want=132, limit=112 [ 519.854682] attempt to access beyond end of device [ 519.877605] attempt to access beyond end of device [ 519.884914] loop3: rw=1, want=145, limit=112 [ 519.906532] loop2: rw=1, want=133, limit=112 [ 519.919222] attempt to access beyond end of device [ 519.928972] attempt to access beyond end of device [ 519.938085] loop3: rw=1, want=1073, limit=112 [ 519.957048] loop2: rw=1, want=142, limit=112 06:07:20 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca580500000000000582b893123f89dedb03442000000000000000000000", @ANYRES32], 0x2}}, 0x0) [ 520.004705] attempt to access beyond end of device [ 520.009679] loop2: rw=1, want=143, limit=112 06:07:20 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0xc0046209, 0x705000) [ 520.063245] attempt to access beyond end of device [ 520.068532] loop2: rw=1, want=144, limit=112 [ 520.073197] attempt to access beyond end of device [ 520.078452] loop2: rw=1, want=145, limit=112 [ 520.083523] attempt to access beyond end of device [ 520.088737] loop2: rw=1, want=393, limit=112 06:07:21 executing program 1: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) socket$inet6(0xa, 0x0, 0x0) r0 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp, 0x80) gettid() ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000440)="bd5281e90e382e49bc31c58bec93575c69955b99c59ad4bd0fe49bfd7fe94d8885ab76161d9ce31d5d33721046808670be4653c0cc84b9da38535652f4ed2dc5c76b973366cda5cd22c8854b38e0bd58358a1c4321e295b32e956b0a7b25eb0cb616e08644cfab02fce229997b4ca12d8723eff6b59433fc01a0bd53b5f45a48e6ca29d035", 0x85}], 0x1, &(0x7f00000009c0)=[{0xa0, 0x1ff, 0x800, "434c94cf096ca2c6e3a8a6433ea1ccf960ad859f9cabeb13bbcd113f89069f10afdedfc1c2c2a6455dc4d1cc5b8c42e105db6d89e5394ec484d7db74d839a1021c616111655c01f0d6840a2cc4a77a0a2613073b0d1e9ab634a70c9cafd212450fe14e5e32b6ee05d11e22515b1b820c7425d601c3c41b459046978582375e37f0268020620ba8c96a1cf8de5399"}, {0x20, 0x113, 0x3, "64bc63fb1e5bc65e5043"}], 0xc0, 0x4040000}, 0x4000040) r1 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r1, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r0) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:07:21 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca580500000005820000b893123f89dedb03442000000000000000000000", @ANYRES32], 0x2}}, 0x0) 06:07:21 executing program 5: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = socket$inet6(0xa, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp={0x2c, 0x0, 0x0, 0x3d}, 0x80) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r2, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000900)="b6d35518b48becfbd314d1fa96a307da879125869c71d40c5a385ce1d3af47c69a6acba0142b27475f2f890e1446d7e0851a8c84b5", 0x35}], 0x1, &(0x7f00000009c0)=[{0x80, 0x1ff, 0x800, "434c94cf096ca2c6e3a8a6433ea1ccf960ad859f9cabeb13bbcd113f89069f10afdedfc1c2c2a6455dc4d1cc5b8c42e105db6d89e5394ec484d7db74d839a1021c616111655c01f0d6840a2cc4a77a0a2613073b0d1e9ab634a70c9cafd212450fe14e5e32b6ee05d11e22"}], 0x80, 0x4040000}, 0x4000040) r3 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r3, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:07:21 executing program 4: [ 520.315898] attempt to access beyond end of device [ 520.320889] loop1: rw=1, want=130, limit=112 [ 520.385166] attempt to access beyond end of device [ 520.417891] loop1: rw=1, want=131, limit=112 [ 520.442636] attempt to access beyond end of device 06:07:21 executing program 2: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = socket$inet6(0xa, 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp={0x2c, 0x0, 0x0, 0x3d}, 0x80) r1 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r1, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000900)="b6", 0x1}], 0x1, &(0x7f00000009c0)=[{0xa0, 0x1ff, 0x800, "434c94cf096ca2c6e3a8a6433ea1ccf960ad859f9cabeb13bbcd113f89069f10afdedfc1c2c2a6455dc4d1cc5b8c42e105db6d89e5394ec484d7db74d839a1021c616111655c01f0d6840a2cc4a77a0a2613073b0d1e9ab634a70c9cafd212450fe14e5e32b6ee05d11e22515b1b820c7425d601c3c41b459046978582375e37f0268020620ba8c96a1cf8de5399"}, {0x20, 0x113, 0x3, "64bc63fb1e5bc65e5043"}], 0xc0, 0x4040000}, 0x4000040) r2 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r2, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(0xffffffffffffffff) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) [ 520.463146] loop1: rw=1, want=132, limit=112 [ 520.485704] attempt to access beyond end of device [ 520.525629] loop1: rw=1, want=133, limit=112 [ 520.531415] attempt to access beyond end of device [ 520.548284] loop1: rw=1, want=142, limit=112 [ 520.567091] attempt to access beyond end of device [ 520.577772] loop1: rw=1, want=143, limit=112 [ 520.582317] attempt to access beyond end of device [ 520.588551] loop1: rw=1, want=144, limit=112 [ 520.600339] attempt to access beyond end of device [ 520.609951] loop1: rw=1, want=145, limit=112 [ 520.641663] attempt to access beyond end of device [ 520.662193] loop1: rw=1, want=1353, limit=112 06:07:21 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca580500000000058200b893123f89dedb03442000000000000000000000", @ANYRES32], 0x2}}, 0x0) 06:07:21 executing program 3: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r1, 0x5421, 0x0) faccessat(r0, &(0x7f0000000080)='./file0/file0/file0\x00', 0x24, 0x300) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x3, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)=[{0x10, 0x107, 0x5}], 0x10, 0x20040000}, 0x8001) sendto$unix(0xffffffffffffffff, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r0) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:07:21 executing program 4: 06:07:21 executing program 5: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = socket$inet6(0xa, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp={0x2c, 0x0, 0x0, 0x3d}, 0x80) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r2, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000900)="b6d35518b48becfbd314d1fa96a307da879125869c71d40c5a385ce1d3af47c69a6acba0142b27475f2f890e1446d7e0851a8c84b5", 0x35}], 0x1, &(0x7f00000009c0)=[{0x90, 0x1ff, 0x800, "434c94cf096ca2c6e3a8a6433ea1ccf960ad859f9cabeb13bbcd113f89069f10afdedfc1c2c2a6455dc4d1cc5b8c42e105db6d89e5394ec484d7db74d839a1021c616111655c01f0d6840a2cc4a77a0a2613073b0d1e9ab634a70c9cafd212450fe14e5e32b6ee05d11e22515b1b820c7425d601c3c41b459046978582"}], 0x90, 0x4040000}, 0x4000040) r3 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r3, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:07:21 executing program 4: 06:07:21 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca58050000000000f000b893123f89dedb03442000000000000000000000", @ANYRES32], 0x2}}, 0x0) 06:07:21 executing program 4: 06:07:21 executing program 1: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) socket$inet6(0xa, 0x0, 0x0) r0 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp, 0x80) gettid() ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000440)="bd5281e90e382e49bc31c58bec93575c69955b99c59ad4bd0fe49bfd7fe94d8885ab76161d9ce31d5d33721046808670be4653c0cc84b9da38535652f4ed2dc5c76b973366cda5cd22c8854b38e0bd58358a1c4321e295b32e956b0a7b25eb0cb616e08644cfab02fce229997b4ca12d8723eff6b59433fc01a0bd53b5f45a48e6ca29d035", 0x85}], 0x1, &(0x7f00000009c0)=[{0xa0, 0x1ff, 0x800, "434c94cf096ca2c6e3a8a6433ea1ccf960ad859f9cabeb13bbcd113f89069f10afdedfc1c2c2a6455dc4d1cc5b8c42e105db6d89e5394ec484d7db74d839a1021c616111655c01f0d6840a2cc4a77a0a2613073b0d1e9ab634a70c9cafd212450fe14e5e32b6ee05d11e22515b1b820c7425d601c3c41b459046978582375e37f0268020620ba8c96a1cf8de5399"}, {0x20, 0x113, 0x3, "64bc63fb1e5bc65e5043"}], 0xc0, 0x4040000}, 0x4000040) r1 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r1, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r0) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:07:21 executing program 2: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = socket$inet6(0xa, 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp={0x2c, 0x0, 0x0, 0x3d}, 0x80) r1 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r1, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000900)="b6", 0x1}], 0x1, &(0x7f00000009c0)=[{0xa0, 0x1ff, 0x800, "434c94cf096ca2c6e3a8a6433ea1ccf960ad859f9cabeb13bbcd113f89069f10afdedfc1c2c2a6455dc4d1cc5b8c42e105db6d89e5394ec484d7db74d839a1021c616111655c01f0d6840a2cc4a77a0a2613073b0d1e9ab634a70c9cafd212450fe14e5e32b6ee05d11e22515b1b820c7425d601c3c41b459046978582375e37f0268020620ba8c96a1cf8de5399"}, {0x20, 0x113, 0x3, "64bc63fb1e5bc65e5043"}], 0xc0, 0x4040000}, 0x4000040) r2 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r2, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(0xffffffffffffffff) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:07:21 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca580500000000820500b893123f89dedb03442000000000000000000000", @ANYRES32], 0x2}}, 0x0) 06:07:21 executing program 4: 06:07:22 executing program 3: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r1, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x3, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="1000000000da0bdbbad4c8077000000002ae135e83fc44a8065c60ecd2334ca21321d622fea7abcf15f70306e5429547197981b9561d57ed7f14cecd80f7a04a83ff734c0f4be638104cabe09035f25de0d434ef4088f2b5d6f2f33831f4292dc96cc03d21d057f37182e46b6c1eb3f03df4b3db78412d2fe603095488028c55e70dc1252c91dea35d3aeb63f03909839a4c104edf1c10875ebdd7f42e05b1f3f72adc93c16a58a588757821e32fecd079ed64307dd811eac8904ffa5af96c4efb77043e4edcec6575616cbd19ab810c2026f22b5f31021a01fb65c1ac51d03d479b84aafe35115ed07db97927d9f36963a489154bc3d3e1c68802591432b18b78deb86c3f1aa7b57b8ad4d28d171aa2819352f61b06ea38"], 0x10, 0x20040000}, 0x8001) sendto$unix(0xffffffffffffffff, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r0) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:07:22 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca580500000000020000b893123f89dedb03442000000000000000000000", @ANYRES32], 0x2}}, 0x0) 06:07:22 executing program 4: 06:07:22 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca580500000000f00000b893123f89dedb03442000000000000000000000", @ANYRES32], 0x2}}, 0x0) [ 521.675000] FAT-fs (loop3): Unrecognized mount option "" or missing value 06:07:22 executing program 2: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp={0x2c, 0x0, 0x0, 0x3d}, 0x80) r1 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r1, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000900)="b6", 0x1}], 0x1, &(0x7f00000009c0)=[{0xa0, 0x1ff, 0x800, "434c94cf096ca2c6e3a8a6433ea1ccf960ad859f9cabeb13bbcd113f89069f10afdedfc1c2c2a6455dc4d1cc5b8c42e105db6d89e5394ec484d7db74d839a1021c616111655c01f0d6840a2cc4a77a0a2613073b0d1e9ab634a70c9cafd212450fe14e5e32b6ee05d11e22515b1b820c7425d601c3c41b459046978582375e37f0268020620ba8c96a1cf8de5399"}, {0x20, 0x113, 0x3, "64bc63fb1e5bc65e5043"}], 0xc0, 0x4040000}, 0x4000040) r2 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r2, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r0) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:07:22 executing program 4: 06:07:22 executing program 5: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = socket$inet6(0xa, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp={0x2c, 0x0, 0x0, 0x3d}, 0x80) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r2, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000900)="b6d35518b48becfbd314d1fa96a307da879125869c71d40c5a385ce1d3af47c69a6acba0142b27475f2f890e1446d7e0851a8c84b5", 0x35}], 0x1, &(0x7f00000009c0)=[{0x80, 0x1ff, 0x800, "434c94cf096ca2c6e3a8a6433ea1ccf960ad859f9cabeb13bbcd113f89069f10afdedfc1c2c2a6455dc4d1cc5b8c42e105db6d89e5394ec484d7db74d839a1021c616111655c01f0d6840a2cc4a77a0a2613073b0d1e9ab634a70c9cafd212450fe14e5e32b6ee05d11e2251"}], 0x80, 0x4040000}, 0x4000040) r3 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r3, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:07:22 executing program 1: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) socket$inet6(0xa, 0x0, 0x0) r0 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp, 0x80) gettid() ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000440)="bd5281e90e382e49bc31c58bec93575c69955b99c59ad4bd0fe49bfd7fe94d8885ab76161d9ce31d5d33721046808670be4653c0cc84b9da38535652f4ed2dc5c76b973366cda5cd22c8854b38e0bd58358a1c4321e295b32e956b0a7b25eb0cb616e08644cfab02fce229997b4ca12d8723eff6b59433fc01a0bd53b5f45a48e6ca29d035", 0x85}], 0x1, &(0x7f00000009c0)=[{0xa0, 0x1ff, 0x800, "434c94cf096ca2c6e3a8a6433ea1ccf960ad859f9cabeb13bbcd113f89069f10afdedfc1c2c2a6455dc4d1cc5b8c42e105db6d89e5394ec484d7db74d839a1021c616111655c01f0d6840a2cc4a77a0a2613073b0d1e9ab634a70c9cafd212450fe14e5e32b6ee05d11e22515b1b820c7425d601c3c41b459046978582375e37f0268020620ba8c96a1cf8de5399"}, {0x20, 0x113, 0x3, "64bc63fb1e5bc65e5043"}], 0xc0, 0x4040000}, 0x4000040) r1 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r1, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r0) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:07:22 executing program 4: 06:07:22 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca5805000000000000f0b893123f89dedb03442000000000000000000000", @ANYRES32], 0x2}}, 0x0) [ 521.807768] FAT-fs (loop3): Unrecognized mount option "" or missing value [ 521.815674] attempt to access beyond end of device [ 521.821019] loop5: rw=1, want=130, limit=112 [ 521.839137] attempt to access beyond end of device [ 521.897928] loop5: rw=1, want=131, limit=112 [ 521.902451] attempt to access beyond end of device [ 521.941300] loop5: rw=1, want=132, limit=112 [ 521.957507] attempt to access beyond end of device 06:07:22 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca580500000000000582b893123f89dedb03442000000000000000000000", @ANYRES32], 0x2}}, 0x0) [ 521.984929] loop5: rw=1, want=133, limit=112 [ 522.001242] attempt to access beyond end of device [ 522.020530] loop5: rw=1, want=142, limit=112 06:07:22 executing program 4: 06:07:22 executing program 3: r0 = memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$SNDRV_TIMER_IOCTL_INFO(r0, 0x80e85411, &(0x7f00000001c0)=""/11) ioctl$EVIOCGBITSW(r0, 0x80404525, &(0x7f0000000080)=""/69) ioctl$LOOP_CTL_REMOVE(r2, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x3, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)=[{0x10, 0x107, 0x5}], 0x10, 0x20040000}, 0x8001) sendto$unix(0xffffffffffffffff, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:07:22 executing program 2: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp={0x2c, 0x0, 0x0, 0x3d}, 0x80) r1 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r1, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000900)="b6", 0x1}], 0x1, &(0x7f00000009c0)=[{0xa0, 0x1ff, 0x800, "434c94cf096ca2c6e3a8a6433ea1ccf960ad859f9cabeb13bbcd113f89069f10afdedfc1c2c2a6455dc4d1cc5b8c42e105db6d89e5394ec484d7db74d839a1021c616111655c01f0d6840a2cc4a77a0a2613073b0d1e9ab634a70c9cafd212450fe14e5e32b6ee05d11e22515b1b820c7425d601c3c41b459046978582375e37f0268020620ba8c96a1cf8de5399"}, {0x20, 0x113, 0x3, "64bc63fb1e5bc65e5043"}], 0xc0, 0x4040000}, 0x4000040) r2 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r2, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r0) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) [ 522.040025] attempt to access beyond end of device [ 522.052109] loop5: rw=1, want=143, limit=112 [ 522.084277] attempt to access beyond end of device [ 522.140187] loop5: rw=1, want=144, limit=112 06:07:22 executing program 4: [ 522.164504] attempt to access beyond end of device [ 522.169467] loop5: rw=1, want=145, limit=112 [ 522.208965] attempt to access beyond end of device [ 522.213939] loop5: rw=1, want=713, limit=112 06:07:23 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca58050000000000f000b893123f89dedb03442000000000000000000000", @ANYRES32], 0x2}}, 0x0) 06:07:23 executing program 4: 06:07:23 executing program 4: 06:07:23 executing program 5: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = socket$inet6(0xa, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp={0x2c, 0x0, 0x0, 0x3d}, 0x80) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r2, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000900)="b6d35518b48becfbd314d1fa96a307da879125869c71d40c5a385ce1d3af47c69a6acba0142b27475f2f890e1446d7e0851a8c84b5", 0x35}], 0x1, &(0x7f00000009c0)=[{0x80, 0x1ff, 0x800, "434c94cf096ca2c6e3a8a6433ea1ccf960ad859f9cabeb13bbcd113f89069f10afdedfc1c2c2a6455dc4d1cc5b8c42e105db6d89e5394ec484d7db74d839a1021c616111655c01f0d6840a2cc4a77a0a2613073b0d1e9ab634a70c9cafd212450fe14e5e32b6ee05d11e2251"}], 0x80, 0x4040000}, 0x4000040) r3 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r3, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:07:23 executing program 2: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp={0x2c, 0x0, 0x0, 0x3d}, 0x80) r1 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r1, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000900)="b6", 0x1}], 0x1, &(0x7f00000009c0)=[{0xa0, 0x1ff, 0x800, "434c94cf096ca2c6e3a8a6433ea1ccf960ad859f9cabeb13bbcd113f89069f10afdedfc1c2c2a6455dc4d1cc5b8c42e105db6d89e5394ec484d7db74d839a1021c616111655c01f0d6840a2cc4a77a0a2613073b0d1e9ab634a70c9cafd212450fe14e5e32b6ee05d11e22515b1b820c7425d601c3c41b459046978582375e37f0268020620ba8c96a1cf8de5399"}, {0x20, 0x113, 0x3, "64bc63fb1e5bc65e5043"}], 0xc0, 0x4040000}, 0x4000040) r2 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r2, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r0) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:07:23 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca580500000000008205b893123f89dedb03442000000000000000000000", @ANYRES32], 0x2}}, 0x0) 06:07:23 executing program 4: r0 = socket$alg(0x26, 0x5, 0x0) r1 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r1, 0x8912, &(0x7f00000001c0)="153f6234488dd25d766070") bind$alg(r0, &(0x7f0000000080)={0x26, 'hash\x00', 0x0, 0x0, 'cbcmac(des3_ede)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000100)="de75e1fe7d0e7634b214a3765ba0017995103a08917fc2a1", 0x18) r2 = accept(r0, 0x0, &(0x7f0000000000)=0x391) sendmsg$TEAM_CMD_OPTIONS_GET(r2, &(0x7f0000001ac0)={&(0x7f0000000040), 0xc, &(0x7f0000001a80)={&(0x7f0000001400)={0x14}, 0x7ffff000}}, 0x0) 06:07:23 executing program 1: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) socket$inet6(0xa, 0x0, 0x0) r0 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp, 0x80) gettid() ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000440)="bd5281e90e382e49bc31c58bec93575c69955b99c59ad4bd0fe49bfd7fe94d8885ab76161d9ce31d5d33721046808670be4653c0cc84b9da38535652f4ed2dc5c76b973366cda5cd22c8854b38e0bd58358a1c4321e295b32e956b0a7b25eb0cb616e08644cfab02fce229997b4ca12d8723eff6b59433fc01a0bd53b5f45a48e6ca29d035", 0x85}, {&(0x7f0000000600)}], 0x2, &(0x7f00000009c0)=[{0xa0, 0x1ff, 0x800, "434c94cf096ca2c6e3a8a6433ea1ccf960ad859f9cabeb13bbcd113f89069f10afdedfc1c2c2a6455dc4d1cc5b8c42e105db6d89e5394ec484d7db74d839a1021c616111655c01f0d6840a2cc4a77a0a2613073b0d1e9ab634a70c9cafd212450fe14e5e32b6ee05d11e22515b1b820c7425d601c3c41b459046978582375e37f0268020620ba8c96a1cf8de5399"}, {0x20, 0x113, 0x3, "64bc63fb1e5bc65e5043"}], 0xc0, 0x4040000}, 0x4000040) r1 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r1, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r0) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:07:23 executing program 3: r0 = memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r2, 0x5421, 0x0) getsockopt$inet6_tcp_buf(r0, 0x6, 0xd, &(0x7f0000000340)=""/223, &(0x7f0000000080)=0xdf) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x3, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)=[{0x10, 0x107, 0x5}], 0x10, 0x20040000}, 0x8001) sendto$unix(0xffffffffffffffff, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:07:23 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca580500000000000200b893123f89dedb03442000000000000000000000", @ANYRES32], 0x2}}, 0x0) [ 523.035711] attempt to access beyond end of device [ 523.040711] loop1: rw=1, want=130, limit=112 [ 523.046529] attempt to access beyond end of device [ 523.083270] loop1: rw=1, want=131, limit=112 [ 523.093764] attempt to access beyond end of device [ 523.102225] loop1: rw=1, want=132, limit=112 [ 523.107771] attempt to access beyond end of device [ 523.114479] loop1: rw=1, want=133, limit=112 [ 523.119079] attempt to access beyond end of device [ 523.124362] loop1: rw=1, want=142, limit=112 [ 523.129005] attempt to access beyond end of device [ 523.134373] loop1: rw=1, want=143, limit=112 [ 523.138960] attempt to access beyond end of device [ 523.144158] loop1: rw=1, want=144, limit=112 [ 523.148747] attempt to access beyond end of device [ 523.162706] loop1: rw=1, want=145, limit=112 [ 523.185445] attempt to access beyond end of device [ 523.228353] loop1: rw=1, want=1841, limit=112 06:07:24 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca580500000000000002b893123f89dedb03442000000000000000000000", @ANYRES32], 0x2}}, 0x0) 06:07:24 executing program 2: memfd_create(&(0x7f0000000040)='iocharset', 0x2) r0 = socket$inet6(0xa, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp={0x2c, 0x0, 0x0, 0x3d}, 0x80) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r2, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000900)="b6", 0x1}], 0x1, &(0x7f00000009c0)=[{0xa0, 0x1ff, 0x800, "434c94cf096ca2c6e3a8a6433ea1ccf960ad859f9cabeb13bbcd113f89069f10afdedfc1c2c2a6455dc4d1cc5b8c42e105db6d89e5394ec484d7db74d839a1021c616111655c01f0d6840a2cc4a77a0a2613073b0d1e9ab634a70c9cafd212450fe14e5e32b6ee05d11e22515b1b820c7425d601c3c41b459046978582375e37f0268020620ba8c96a1cf8de5399"}, {0x20, 0x113, 0x3, "64bc63fb1e5bc65e5043"}], 0xc0, 0x4040000}, 0x4000040) r3 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r3, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:07:24 executing program 5: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = socket$inet6(0xa, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp={0x2c, 0x0, 0x0, 0x3d}, 0x80) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r2, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000900)="b6d35518b48becfbd314d1fa96a307da879125869c71d40c5a385ce1d3af47c69a6acba0142b27475f2f890e1446d7e0851a8c84b5", 0x35}], 0x1, &(0x7f00000009c0)=[{0x80, 0x1ff, 0x800, "434c94cf096ca2c6e3a8a6433ea1ccf960ad859f9cabeb13bbcd113f89069f10afdedfc1c2c2a6455dc4d1cc5b8c42e105db6d89e5394ec484d7db74d839a1021c616111655c01f0d6840a2cc4a77a0a2613073b0d1e9ab634a70c9cafd212450fe14e5e32b6ee05d11e2251"}], 0x80, 0x4040000}, 0x4000040) r3 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r3, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:07:24 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca580500000000000000b893123f89dedb03442000000000000000000000", @ANYRES32], 0x33fe0}}, 0x0) 06:07:24 executing program 3: r0 = memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(r0, &(0x7f0000000340)=@rc, &(0x7f0000000040)=0xffffffffffffff68, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r2, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x3, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)=[{0x10, 0x107, 0x5}], 0x10, 0x20040000}, 0x8001) sendto$unix(0xffffffffffffffff, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:07:24 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca580500000000000000b893123f89dedb03442000000000000000000000", @ANYRES32], 0x7ffff000}}, 0x0) 06:07:24 executing program 5: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = socket$inet6(0xa, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp={0x2c, 0x0, 0x0, 0x3d}, 0x80) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r2, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000900)="b6d35518b48becfbd314d1fa96a307da879125869c71d40c5a385ce1d3af47c69a6acba0142b27475f2f890e1446d7e0851a8c84b5", 0x35}], 0x1, &(0x7f00000009c0)=[{0x88, 0x1ff, 0x800, "434c94cf096ca2c6e3a8a6433ea1ccf960ad859f9cabeb13bbcd113f89069f10afdedfc1c2c2a6455dc4d1cc5b8c42e105db6d89e5394ec484d7db74d839a1021c616111655c01f0d6840a2cc4a77a0a2613073b0d1e9ab634a70c9cafd212450fe14e5e32b6ee05d11e22515b1b820c7425d601c3"}], 0x88, 0x4040000}, 0x4000040) r3 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r3, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:07:24 executing program 2: memfd_create(&(0x7f0000000040)='iocharset', 0x2) r0 = socket$inet6(0xa, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp={0x2c, 0x0, 0x0, 0x3d}, 0x80) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r2, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000900)="b6", 0x1}], 0x1, &(0x7f00000009c0)=[{0xa0, 0x1ff, 0x800, "434c94cf096ca2c6e3a8a6433ea1ccf960ad859f9cabeb13bbcd113f89069f10afdedfc1c2c2a6455dc4d1cc5b8c42e105db6d89e5394ec484d7db74d839a1021c616111655c01f0d6840a2cc4a77a0a2613073b0d1e9ab634a70c9cafd212450fe14e5e32b6ee05d11e22515b1b820c7425d601c3c41b459046978582375e37f0268020620ba8c96a1cf8de5399"}, {0x20, 0x113, 0x3, "64bc63fb1e5bc65e5043"}], 0xc0, 0x4040000}, 0x4000040) r3 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r3, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) [ 524.385379] attempt to access beyond end of device [ 524.390378] loop1: rw=1, want=130, limit=112 [ 524.396828] buffer_io_error: 32 callbacks suppressed [ 524.396839] Buffer I/O error on dev loop1, logical block 129, lost async page write [ 524.410333] attempt to access beyond end of device [ 524.415454] loop1: rw=1, want=131, limit=112 [ 524.419963] Buffer I/O error on dev loop1, logical block 130, lost async page write [ 524.427949] attempt to access beyond end of device [ 524.432991] loop1: rw=1, want=132, limit=112 [ 524.449516] Buffer I/O error on dev loop1, logical block 131, lost async page write [ 524.461000] attempt to access beyond end of device [ 524.471802] loop1: rw=1, want=133, limit=112 [ 524.476792] Buffer I/O error on dev loop1, logical block 132, lost async page write [ 524.484778] attempt to access beyond end of device [ 524.489806] loop1: rw=1, want=142, limit=112 [ 524.495468] Buffer I/O error on dev loop1, logical block 141, lost async page write [ 524.515230] attempt to access beyond end of device [ 524.520208] loop1: rw=1, want=143, limit=112 [ 524.524752] Buffer I/O error on dev loop1, logical block 142, lost async page write 06:07:25 executing program 4: socket$inet_udp(0x2, 0x2, 0x0) write$FUSE_NOTIFY_POLL(0xffffffffffffffff, &(0x7f00000000c0)={0x18}, 0x18) r0 = socket$inet(0x2, 0x200000002, 0x0) setsockopt$inet_mreqn(r0, 0x0, 0x27, &(0x7f0000000080)={@multicast1, @local}, 0xc) setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f00000001c0)={@multicast1, @local, 0x0, 0x1, [@loopback]}, 0x14) 06:07:25 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca580500000000000000b893123f89dedb03442000000000000000000000", @ANYRES32], 0x3}}, 0x0) 06:07:25 executing program 1: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) socket$inet6(0xa, 0x0, 0x0) r0 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp, 0x80) gettid() ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000440)="bd5281e90e382e49bc31c58bec93575c69955b99c59ad4bd0fe49bfd7fe94d8885ab76161d9ce31d5d33721046808670be4653c0cc84b9da38535652f4ed2dc5c76b973366cda5cd22c8854b38e0bd58358a1c4321e295b32e956b0a7b25eb0cb616e08644cfab02fce229997b4ca12d8723eff6b59433fc01a0bd53b5f45a48e6ca29d035", 0x85}, {&(0x7f0000000600)}], 0x2, &(0x7f00000009c0)=[{0xa0, 0x1ff, 0x800, "434c94cf096ca2c6e3a8a6433ea1ccf960ad859f9cabeb13bbcd113f89069f10afdedfc1c2c2a6455dc4d1cc5b8c42e105db6d89e5394ec484d7db74d839a1021c616111655c01f0d6840a2cc4a77a0a2613073b0d1e9ab634a70c9cafd212450fe14e5e32b6ee05d11e22515b1b820c7425d601c3c41b459046978582375e37f0268020620ba8c96a1cf8de5399"}, {0x20, 0x113, 0x3, "64bc63fb1e5bc65e5043"}], 0xc0, 0x4040000}, 0x4000040) r1 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r1, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r0) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:07:25 executing program 2: memfd_create(&(0x7f0000000040)='iocharset', 0x2) r0 = socket$inet6(0xa, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp={0x2c, 0x0, 0x0, 0x3d}, 0x80) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r2, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000900)="b6", 0x1}], 0x1, &(0x7f00000009c0)=[{0xa0, 0x1ff, 0x800, "434c94cf096ca2c6e3a8a6433ea1ccf960ad859f9cabeb13bbcd113f89069f10afdedfc1c2c2a6455dc4d1cc5b8c42e105db6d89e5394ec484d7db74d839a1021c616111655c01f0d6840a2cc4a77a0a2613073b0d1e9ab634a70c9cafd212450fe14e5e32b6ee05d11e22515b1b820c7425d601c3c41b459046978582375e37f0268020620ba8c96a1cf8de5399"}, {0x20, 0x113, 0x3, "64bc63fb1e5bc65e5043"}], 0xc0, 0x4040000}, 0x4000040) r3 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r3, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:07:25 executing program 3: r0 = memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r2, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x3, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)=[{0x10, 0x107, 0x5}], 0x10, 0x20040000}, 0x8001) ioctl$KVM_CREATE_PIT2(r0, 0x4040ae77, &(0x7f00000000c0)={0x8}) sendto$unix(0xffffffffffffffff, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) chroot(&(0x7f0000000080)='./file0\x00') perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:07:25 executing program 5: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = socket$inet6(0xa, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp={0x2c, 0x0, 0x0, 0x3d}, 0x80) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r2, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000900)="b6d35518b48becfbd314d1fa96a307da879125869c71d40c5a385ce1d3af47c69a6acba0142b27475f2f890e1446d7e0851a8c84b5", 0x35}], 0x1, &(0x7f00000009c0)=[{0x88, 0x1ff, 0x800, "434c94cf096ca2c6e3a8a6433ea1ccf960ad859f9cabeb13bbcd113f89069f10afdedfc1c2c2a6455dc4d1cc5b8c42e105db6d89e5394ec484d7db74d839a1021c616111655c01f0d6840a2cc4a77a0a2613073b0d1e9ab634a70c9cafd212450fe14e5e32b6ee05d11e22515b1b820c7425d601c3"}], 0x88, 0x4040000}, 0x4000040) r3 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r3, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) [ 524.532589] attempt to access beyond end of device [ 524.537613] loop1: rw=1, want=144, limit=112 [ 524.542037] Buffer I/O error on dev loop1, logical block 143, lost async page write [ 524.549935] attempt to access beyond end of device [ 524.555744] loop1: rw=1, want=145, limit=112 [ 524.560178] Buffer I/O error on dev loop1, logical block 144, lost async page write [ 524.569201] attempt to access beyond end of device [ 524.574802] loop1: rw=1, want=809, limit=112 06:07:25 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca580500000000000000b893123f89dedb03442000000000000000000000", @ANYRES32], 0xc0}}, 0x0) 06:07:25 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) perf_event_open(&(0x7f0000aaa000)={0x2, 0x70, 0x85a, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) 06:07:25 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca580500000000000000b893123f89dedb03442000000000000000000000", @ANYRES32], 0xf}}, 0x0) 06:07:26 executing program 2: syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = socket$inet6(0xa, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp={0x2c, 0x0, 0x0, 0x3d}, 0x80) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r2, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000900)="b6", 0x1}], 0x1, &(0x7f00000009c0)=[{0xa0, 0x1ff, 0x800, "434c94cf096ca2c6e3a8a6433ea1ccf960ad859f9cabeb13bbcd113f89069f10afdedfc1c2c2a6455dc4d1cc5b8c42e105db6d89e5394ec484d7db74d839a1021c616111655c01f0d6840a2cc4a77a0a2613073b0d1e9ab634a70c9cafd212450fe14e5e32b6ee05d11e22515b1b820c7425d601c3c41b459046978582375e37f0268020620ba8c96a1cf8de5399"}, {0x20, 0x113, 0x3, "64bc63fb1e5bc65e5043"}], 0xc0, 0x4040000}, 0x4000040) r3 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r3, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:07:26 executing program 5: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = socket$inet6(0xa, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp={0x2c, 0x0, 0x0, 0x3d}, 0x80) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r2, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000900)="b6d35518b48becfbd314d1fa96a307da879125869c71d40c5a385ce1d3af47c69a6acba0142b27475f2f890e1446d7e0851a8c84b5", 0x35}], 0x1, &(0x7f00000009c0)=[{0x88, 0x1ff, 0x800, "434c94cf096ca2c6e3a8a6433ea1ccf960ad859f9cabeb13bbcd113f89069f10afdedfc1c2c2a6455dc4d1cc5b8c42e105db6d89e5394ec484d7db74d839a1021c616111655c01f0d6840a2cc4a77a0a2613073b0d1e9ab634a70c9cafd212450fe14e5e32b6ee05d11e22515b1b820c7425d601c3"}], 0x88, 0x4040000}, 0x4000040) r3 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r3, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:07:26 executing program 3: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) ioctl$KVM_GET_VCPU_EVENTS(r0, 0x8040ae9f, &(0x7f0000000080)) gettid() ioctl$LOOP_CTL_REMOVE(r1, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x3, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)=ANY=[@ANYBLOB="9308"], 0x10, 0x20040000}, 0x8001) sendto$unix(0xffffffffffffffff, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r0) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x8) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:07:26 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca580500000000000000b893123f89dedb03442000000000000000000000", @ANYRES32], 0xec0}}, 0x0) 06:07:26 executing program 4: perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) close(r0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000280)="2e2f6367726f75702e6e65742f73797a31eb", 0x1ff) socketpair$inet_tcp(0x2, 0x1, 0x0, &(0x7f0000000000)) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000580)='./cgroup.net/syz1\x00', 0x200002, 0x0) socketpair$inet6_udplite(0xa, 0x2, 0x88, &(0x7f00000000c0)) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000380)={0xffffffffffffffff, 0x3, 0x0, 0x0, &(0x7f0000000340)}, 0x20) 06:07:26 executing program 1: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) socket$inet6(0xa, 0x0, 0x0) r0 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp, 0x80) gettid() ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000600)}], 0x1, &(0x7f00000009c0)=[{0xa0, 0x1ff, 0x800, "434c94cf096ca2c6e3a8a6433ea1ccf960ad859f9cabeb13bbcd113f89069f10afdedfc1c2c2a6455dc4d1cc5b8c42e105db6d89e5394ec484d7db74d839a1021c616111655c01f0d6840a2cc4a77a0a2613073b0d1e9ab634a70c9cafd212450fe14e5e32b6ee05d11e22515b1b820c7425d601c3c41b459046978582375e37f0268020620ba8c96a1cf8de5399"}, {0x20, 0x113, 0x3, "64bc63fb1e5bc65e5043"}], 0xc0, 0x4040000}, 0x4000040) r1 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r1, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r0) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:07:26 executing program 5: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = socket$inet6(0xa, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp={0x2c, 0x0, 0x0, 0x3d}, 0x80) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r2, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000900)="b6d35518b48becfbd314d1fa96a307da879125869c71d40c5a385ce1d3af47c69a6acba0142b27475f2f890e1446d7e0851a8c84b5", 0x35}], 0x1, &(0x7f00000009c0)=[{0x90, 0x1ff, 0x800, "434c94cf096ca2c6e3a8a6433ea1ccf960ad859f9cabeb13bbcd113f89069f10afdedfc1c2c2a6455dc4d1cc5b8c42e105db6d89e5394ec484d7db74d839a1021c616111655c01f0d6840a2cc4a77a0a2613073b0d1e9ab634a70c9cafd212450fe14e5e32b6ee05d11e22515b1b820c7425d601c3c41b4590"}], 0x90, 0x4040000}, 0x4000040) r3 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r3, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:07:26 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca580500000000000000b893123f89dedb03442000000000000000000000", @ANYRES32], 0xfffffdef}}, 0x0) [ 525.685063] attempt to access beyond end of device [ 525.690079] loop1: rw=1, want=130, limit=112 [ 525.715794] Buffer I/O error on dev loop1, logical block 129, lost async page write [ 525.780993] attempt to access beyond end of device [ 525.844497] loop1: rw=1, want=131, limit=112 [ 525.848965] Buffer I/O error on dev loop1, logical block 130, lost async page write 06:07:26 executing program 2: syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = socket$inet6(0xa, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp={0x2c, 0x0, 0x0, 0x3d}, 0x80) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r2, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000900)="b6", 0x1}], 0x1, &(0x7f00000009c0)=[{0xa0, 0x1ff, 0x800, "434c94cf096ca2c6e3a8a6433ea1ccf960ad859f9cabeb13bbcd113f89069f10afdedfc1c2c2a6455dc4d1cc5b8c42e105db6d89e5394ec484d7db74d839a1021c616111655c01f0d6840a2cc4a77a0a2613073b0d1e9ab634a70c9cafd212450fe14e5e32b6ee05d11e22515b1b820c7425d601c3c41b459046978582375e37f0268020620ba8c96a1cf8de5399"}, {0x20, 0x113, 0x3, "64bc63fb1e5bc65e5043"}], 0xc0, 0x4040000}, 0x4000040) r3 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r3, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:07:26 executing program 4: socket$inet(0x2, 0x0, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000480)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@allow_other='allow_other'}]}}) read$FUSE(r0, &(0x7f0000003000), 0x4ea) read$FUSE(r0, &(0x7f0000005000), 0xe83) write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50) memfd_create(&(0x7f0000000500)='*\x00', 0x0) read$FUSE(r0, &(0x7f0000008000), 0x139f) lstat(&(0x7f0000000000)='./file0/file0\x00', &(0x7f0000000340)) open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) read$FUSE(r0, &(0x7f0000002000), 0x10165) write$FUSE_OPEN(r0, &(0x7f0000000640)={0x20, 0x0, 0x3}, 0x20) write$FUSE_INIT(r0, &(0x7f0000000180)={0x50, 0x0, 0x4}, 0x50) [ 525.896298] attempt to access beyond end of device [ 525.901795] loop1: rw=1, want=132, limit=112 [ 525.927229] attempt to access beyond end of device [ 525.932190] loop1: rw=1, want=133, limit=112 [ 525.937845] attempt to access beyond end of device 06:07:26 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca580500000000000000b893123f89dedb03442000000000000000000000", @ANYRES32], 0x20000042}}, 0x0) [ 525.942887] loop1: rw=1, want=142, limit=112 [ 525.947416] attempt to access beyond end of device [ 525.952403] loop1: rw=1, want=143, limit=112 [ 525.958020] attempt to access beyond end of device [ 525.963317] loop1: rw=1, want=144, limit=112 [ 525.968543] attempt to access beyond end of device [ 525.973488] loop1: rw=1, want=145, limit=112 [ 525.992264] attempt to access beyond end of device [ 526.033328] loop1: rw=1, want=937, limit=112 06:07:26 executing program 3: r0 = memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r2, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x3, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)=[{0x10, 0x107, 0x5}], 0x10, 0x20040000}, 0x8001) sendto$unix(0xffffffffffffffff, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) ioctl$KVM_SET_DEVICE_ATTR(r0, 0x4018aee1, &(0x7f00000000c0)={0x0, 0xd4d, 0x1, &(0x7f0000000080)=0x81}) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:07:27 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca580500000000000000b893123f89dedb03442000000000000000000000", @ANYRES32], 0x2}, 0x2}, 0x0) 06:07:27 executing program 5: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = socket$inet6(0xa, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp={0x2c, 0x0, 0x0, 0x3d}, 0x80) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r2, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000900)="b6d35518b48becfbd314d1fa96a307da879125869c71d40c5a385ce1d3af47c69a6acba0142b27475f2f890e1446d7e0851a8c84b5", 0x35}], 0x1, &(0x7f00000009c0)=[{0x90, 0x1ff, 0x800, "434c94cf096ca2c6e3a8a6433ea1ccf960ad859f9cabeb13bbcd113f89069f10afdedfc1c2c2a6455dc4d1cc5b8c42e105db6d89e5394ec484d7db74d839a1021c616111655c01f0d6840a2cc4a77a0a2613073b0d1e9ab634a70c9cafd212450fe14e5e32b6ee05d11e22515b1b820c7425d601c3c41b4590"}], 0x90, 0x4040000}, 0x4000040) r3 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r3, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:07:27 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca580500000000000000b893123f89dedb03442000000000000000000000", @ANYRES32], 0x2}, 0x8}, 0x0) 06:07:27 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca580500000000000000b893123f89dedb03442000000000000000000000", @ANYRES32], 0x2}, 0xffffff1f}, 0x0) 06:07:27 executing program 2: syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = socket$inet6(0xa, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp={0x2c, 0x0, 0x0, 0x3d}, 0x80) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r2, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000900)="b6", 0x1}], 0x1, &(0x7f00000009c0)=[{0xa0, 0x1ff, 0x800, "434c94cf096ca2c6e3a8a6433ea1ccf960ad859f9cabeb13bbcd113f89069f10afdedfc1c2c2a6455dc4d1cc5b8c42e105db6d89e5394ec484d7db74d839a1021c616111655c01f0d6840a2cc4a77a0a2613073b0d1e9ab634a70c9cafd212450fe14e5e32b6ee05d11e22515b1b820c7425d601c3c41b459046978582375e37f0268020620ba8c96a1cf8de5399"}, {0x20, 0x113, 0x3, "64bc63fb1e5bc65e5043"}], 0xc0, 0x4040000}, 0x4000040) r3 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r3, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) [ 526.745804] attempt to access beyond end of device [ 526.750792] loop2: rw=1, want=130, limit=112 [ 526.772092] attempt to access beyond end of device [ 526.801318] loop2: rw=1, want=131, limit=112 [ 526.819666] attempt to access beyond end of device [ 526.840403] loop2: rw=1, want=132, limit=112 [ 526.882623] attempt to access beyond end of device [ 526.912651] loop2: rw=1, want=133, limit=112 [ 526.936072] attempt to access beyond end of device [ 526.973696] loop2: rw=1, want=142, limit=112 [ 526.988371] attempt to access beyond end of device [ 527.001102] loop2: rw=1, want=143, limit=112 [ 527.005751] attempt to access beyond end of device [ 527.010777] loop2: rw=1, want=144, limit=112 [ 527.015645] attempt to access beyond end of device [ 527.020671] loop2: rw=1, want=145, limit=112 [ 527.028993] attempt to access beyond end of device [ 527.034009] loop2: rw=1, want=2178, limit=112 06:07:27 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca580500000000000000b893123f89dedb03442000000000000000000000", @ANYRES32], 0x2}, 0x300}, 0x0) 06:07:27 executing program 3: r0 = memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) r2 = accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) setsockopt$netlink_NETLINK_RX_RING(r4, 0x10e, 0x6, &(0x7f0000000480)={0x100000000, 0x3, 0x8, 0xf8}, 0x10) fsetxattr(r3, &(0x7f00000000c0)=ANY=[@ANYBLOB="6f1fcce4b8ff3dfb9c"], &(0x7f00000001c0)='system.\x00', 0x8, 0x1) gettid() ioctl$LOOP_CTL_REMOVE(r4, 0x5421, 0x0) r5 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) connect$inet(r5, &(0x7f0000000240)={0x2, 0x0, @local}, 0x10) r6 = socket$inet(0x2, 0x1, 0x0) setsockopt$inet_int(r5, 0x0, 0x17, &(0x7f0000000040)=0x8001, 0x4) setsockopt$inet_group_source_req(r6, 0x0, 0x2e, &(0x7f0000000100)={0x1, {{0x2, 0x0, @multicast1}}, {{0x2, 0x0, @dev}}}, 0x108) setsockopt$inet_int(r5, 0x0, 0x17, &(0x7f00000002c0), 0x4) getsockopt$inet6_int(r0, 0x29, 0x3a, &(0x7f00000004c0), &(0x7f0000000580)=0x4) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x3, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)=[{0x10, 0x107, 0x5}], 0x10, 0x20040000}, 0x8001) sendto$unix(0xffffffffffffffff, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r1) getsockopt$inet_dccp_buf(r0, 0x21, 0xcf, &(0x7f0000000340)=""/129, &(0x7f0000000080)=0x81) getsockopt$inet_sctp_SCTP_AUTOCLOSE(r2, 0x84, 0x4, &(0x7f0000000400), &(0x7f0000000440)=0x4) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:07:27 executing program 1: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) socket$inet6(0xa, 0x0, 0x0) r0 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp, 0x80) gettid() ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000600)}], 0x1, &(0x7f00000009c0)=[{0xa0, 0x1ff, 0x800, "434c94cf096ca2c6e3a8a6433ea1ccf960ad859f9cabeb13bbcd113f89069f10afdedfc1c2c2a6455dc4d1cc5b8c42e105db6d89e5394ec484d7db74d839a1021c616111655c01f0d6840a2cc4a77a0a2613073b0d1e9ab634a70c9cafd212450fe14e5e32b6ee05d11e22515b1b820c7425d601c3c41b459046978582375e37f0268020620ba8c96a1cf8de5399"}], 0xa0, 0x4040000}, 0x4000040) r1 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r1, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r0) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:07:27 executing program 5: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = socket$inet6(0xa, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp={0x2c, 0x0, 0x0, 0x3d}, 0x80) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r2, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000900)="b6d35518b48becfbd314d1fa96a307da879125869c71d40c5a385ce1d3af47c69a6acba0142b27475f2f890e1446d7e0851a8c84b5", 0x35}], 0x1, &(0x7f00000009c0)=[{0x90, 0x1ff, 0x800, "434c94cf096ca2c6e3a8a6433ea1ccf960ad859f9cabeb13bbcd113f89069f10afdedfc1c2c2a6455dc4d1cc5b8c42e105db6d89e5394ec484d7db74d839a1021c616111655c01f0d6840a2cc4a77a0a2613073b0d1e9ab634a70c9cafd212450fe14e5e32b6ee05d11e22515b1b820c7425d601c3c41b4590"}], 0x90, 0x4040000}, 0x4000040) r3 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r3, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:07:27 executing program 4: syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = socket$inet6(0xa, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp={0x2c, 0x0, 0x0, 0x3d}, 0x80) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r2, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000900)="b6", 0x1}], 0x1, &(0x7f00000009c0)=[{0xa0, 0x1ff, 0x800, "434c94cf096ca2c6e3a8a6433ea1ccf960ad859f9cabeb13bbcd113f89069f10afdedfc1c2c2a6455dc4d1cc5b8c42e105db6d89e5394ec484d7db74d839a1021c616111655c01f0d6840a2cc4a77a0a2613073b0d1e9ab634a70c9cafd212450fe14e5e32b6ee05d11e22515b1b820c7425d601c3c41b459046978582375e37f0268020620ba8c96a1cf8de5399"}, {0x20, 0x113, 0x3, "64bc63fb1e5bc65e5043"}], 0xc0, 0x4040000}, 0x4000040) r3 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r3, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) [ 527.135952] attempt to access beyond end of device [ 527.147618] loop1: rw=1, want=130, limit=112 [ 527.152079] attempt to access beyond end of device [ 527.177722] loop1: rw=1, want=131, limit=112 [ 527.244223] attempt to access beyond end of device [ 527.271537] loop1: rw=1, want=132, limit=112 [ 527.298773] attempt to access beyond end of device 06:07:28 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca580500000000000000b893123f89dedb03442000000000000000000000", @ANYRES32], 0x2}, 0x1, 0x9effffff}, 0x0) [ 527.321331] loop1: rw=1, want=133, limit=112 [ 527.375878] attempt to access beyond end of device [ 527.412066] loop1: rw=1, want=142, limit=112 [ 527.449858] attempt to access beyond end of device [ 527.484014] loop1: rw=1, want=143, limit=112 06:07:28 executing program 4: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = socket$inet6(0xa, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp={0x2c, 0x0, 0x0, 0x3d}, 0x80) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r2, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000900)="b6d35518b48becfbd314d1fa96a307da879125869c71d40c5a385ce1d3af47c69a6acba0142b27475f2f890e1446d7e0851a8c84b5", 0x35}], 0x1, &(0x7f00000009c0)=[{0x80, 0x1ff, 0x800, "434c94cf096ca2c6e3a8a6433ea1ccf960ad859f9cabeb13bbcd113f89069f10afdedfc1c2c2a6455dc4d1cc5b8c42e105db6d89e5394ec484d7db74d839a1021c616111655c01f0d6840a2cc4a77a0a2613073b0d1e9ab634a70c9cafd212450fe14e5e32b6ee05d11e2251"}], 0x80, 0x4040000}, 0x4000040) r3 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r3, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:07:28 executing program 2: memfd_create(&(0x7f0000000040)='iocharset', 0x0) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = socket$inet6(0xa, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp={0x2c, 0x0, 0x0, 0x3d}, 0x80) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r2, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000900)="b6", 0x1}], 0x1, &(0x7f00000009c0)=[{0xa0, 0x1ff, 0x800, "434c94cf096ca2c6e3a8a6433ea1ccf960ad859f9cabeb13bbcd113f89069f10afdedfc1c2c2a6455dc4d1cc5b8c42e105db6d89e5394ec484d7db74d839a1021c616111655c01f0d6840a2cc4a77a0a2613073b0d1e9ab634a70c9cafd212450fe14e5e32b6ee05d11e22515b1b820c7425d601c3c41b459046978582375e37f0268020620ba8c96a1cf8de5399"}, {0x20, 0x113, 0x3, "64bc63fb1e5bc65e5043"}], 0xc0, 0x4040000}, 0x4000040) r3 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r3, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:07:28 executing program 3: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) r1 = accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) r3 = gettid() ioctl$LOOP_CTL_REMOVE(r2, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x3, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)=[{0x10, 0x107, 0x5}], 0x10, 0x20040000}, 0x8001) r4 = msgget$private(0x0, 0x180) r5 = getuid() stat(&(0x7f0000000080)='./file0/file0/file0\x00', &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) getsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f00000003c0)={{{@in=@loopback, @in6=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast2}, 0x0, @in6=@mcast1}}, &(0x7f00000000c0)=0xe8) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f00000001c0)={0x0, 0x0, 0x0}, &(0x7f00000004c0)=0xc) msgctl$IPC_SET(r4, 0x1, &(0x7f0000000580)={{0x7, r5, r6, r7, r8, 0x80, 0x5e}, 0x5, 0x3, 0x80000000, 0x9, 0xfffffffffffffffe, 0x0, r3, r3}) sendto$unix(0xffffffffffffffff, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r0) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) [ 527.507821] attempt to access beyond end of device [ 527.512884] loop1: rw=1, want=144, limit=112 [ 527.517797] attempt to access beyond end of device [ 527.534608] loop1: rw=1, want=145, limit=112 [ 527.541616] attempt to access beyond end of device 06:07:28 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca580500000000000000b893123f89dedb03442000000000000000000000", @ANYRES32], 0x2}, 0x1, 0xf0ffffff}, 0x0) 06:07:28 executing program 5: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = socket$inet6(0xa, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp={0x2c, 0x0, 0x0, 0x3d}, 0x80) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r2, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000900)="b6d35518b48becfbd314d1fa96a307da879125869c71d40c5a385ce1d3af47c69a6acba0142b27475f2f890e1446d7e0851a8c84b5", 0x35}], 0x1, &(0x7f00000009c0)=[{0x90, 0x1ff, 0x800, "434c94cf096ca2c6e3a8a6433ea1ccf960ad859f9cabeb13bbcd113f89069f10afdedfc1c2c2a6455dc4d1cc5b8c42e105db6d89e5394ec484d7db74d839a1021c616111655c01f0d6840a2cc4a77a0a2613073b0d1e9ab634a70c9cafd212450fe14e5e32b6ee05d11e22515b1b820c7425d601c3c41b45904697"}], 0x90, 0x4040000}, 0x4000040) r3 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r3, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) [ 527.554291] loop1: rw=1, want=1729, limit=112 06:07:28 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca580500000000000000b893123f89dedb03442000000000000000000000", @ANYRES32], 0x2}, 0x1, 0xf000}, 0x0) 06:07:28 executing program 1: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) socket$inet6(0xa, 0x0, 0x0) r0 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp, 0x80) gettid() ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000600)}], 0x1, &(0x7f00000009c0)=[{0xa0, 0x1ff, 0x800, "434c94cf096ca2c6e3a8a6433ea1ccf960ad859f9cabeb13bbcd113f89069f10afdedfc1c2c2a6455dc4d1cc5b8c42e105db6d89e5394ec484d7db74d839a1021c616111655c01f0d6840a2cc4a77a0a2613073b0d1e9ab634a70c9cafd212450fe14e5e32b6ee05d11e22515b1b820c7425d601c3c41b459046978582375e37f0268020620ba8c96a1cf8de5399"}], 0xa0, 0x4040000}, 0x4000040) r1 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r1, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r0) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:07:28 executing program 2: memfd_create(&(0x7f0000000040)='iocharset', 0x0) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = socket$inet6(0xa, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp={0x2c, 0x0, 0x0, 0x3d}, 0x80) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r2, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000900)="b6", 0x1}], 0x1, &(0x7f00000009c0)=[{0xa0, 0x1ff, 0x800, "434c94cf096ca2c6e3a8a6433ea1ccf960ad859f9cabeb13bbcd113f89069f10afdedfc1c2c2a6455dc4d1cc5b8c42e105db6d89e5394ec484d7db74d839a1021c616111655c01f0d6840a2cc4a77a0a2613073b0d1e9ab634a70c9cafd212450fe14e5e32b6ee05d11e22515b1b820c7425d601c3c41b459046978582375e37f0268020620ba8c96a1cf8de5399"}, {0x20, 0x113, 0x3, "64bc63fb1e5bc65e5043"}], 0xc0, 0x4040000}, 0x4000040) r3 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r3, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:07:28 executing program 3: r0 = memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) getsockopt$IP6T_SO_GET_REVISION_MATCH(r1, 0x29, 0x44, &(0x7f00000001c0)={'ah\x00'}, &(0x7f0000000340)=0x1e) gettid() ioctl$LOOP_CTL_REMOVE(r2, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x3, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)=ANY=[@ANYBLOB="10000000000000000701003f05000000"], 0x10, 0x20040000}, 0x8001) sendto$unix(0xffffffffffffffff, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r1) accept4(r0, 0x0, &(0x7f00000000c0), 0x800) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) bind$netlink(r0, &(0x7f0000000080)={0x10, 0x0, 0x25dfdbfc, 0x200001}, 0xc) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:07:28 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca580500000000000000b893123f89dedb03442000000000000000000000", @ANYRES32], 0x2}, 0x1, 0xfffffffffffff000}, 0x0) 06:07:28 executing program 5: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = socket$inet6(0xa, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp={0x2c, 0x0, 0x0, 0x3d}, 0x80) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r2, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000900)="b6d35518b48becfbd314d1fa96a307da879125869c71d40c5a385ce1d3af47c69a6acba0142b27475f2f890e1446d7e0851a8c84b5", 0x35}], 0x1, &(0x7f00000009c0)=[{0x90, 0x1ff, 0x800, "434c94cf096ca2c6e3a8a6433ea1ccf960ad859f9cabeb13bbcd113f89069f10afdedfc1c2c2a6455dc4d1cc5b8c42e105db6d89e5394ec484d7db74d839a1021c616111655c01f0d6840a2cc4a77a0a2613073b0d1e9ab634a70c9cafd212450fe14e5e32b6ee05d11e22515b1b820c7425d601c3c41b45904697"}], 0x90, 0x4040000}, 0x4000040) r3 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r3, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) [ 528.196693] attempt to access beyond end of device [ 528.201679] loop2: rw=1, want=130, limit=112 [ 528.208161] attempt to access beyond end of device [ 528.213223] loop2: rw=1, want=131, limit=112 [ 528.235476] attempt to access beyond end of device 06:07:29 executing program 4: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = socket$inet6(0xa, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp={0x2c, 0x0, 0x0, 0x3d}, 0x80) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r2, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000900)="b6d35518b48becfbd314d1fa96a307da879125869c71d40c5a385ce1d3af47c69a6acba0142b27475f2f890e1446d7e0851a8c84b5", 0x35}], 0x1, &(0x7f00000009c0)=[{0x90, 0x1ff, 0x800, "434c94cf096ca2c6e3a8a6433ea1ccf960ad859f9cabeb13bbcd113f89069f10afdedfc1c2c2a6455dc4d1cc5b8c42e105db6d89e5394ec484d7db74d839a1021c616111655c01f0d6840a2cc4a77a0a2613073b0d1e9ab634a70c9cafd212450fe14e5e32b6ee05d11e22515b1b820c7425d601c3c41b459046978582"}], 0x90, 0x4040000}, 0x4000040) r3 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r3, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) [ 528.246624] loop2: rw=1, want=132, limit=112 [ 528.256255] attempt to access beyond end of device [ 528.261343] loop2: rw=1, want=133, limit=112 [ 528.269378] attempt to access beyond end of device [ 528.274567] loop2: rw=1, want=142, limit=112 [ 528.279545] attempt to access beyond end of device 06:07:29 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca580500000000000000b893123f89dedb03442000000000000000000000", @ANYRES32], 0x2}, 0x1, 0xf0ffffffffffff}, 0x0) [ 528.295557] loop2: rw=1, want=143, limit=112 [ 528.300146] attempt to access beyond end of device [ 528.308238] loop2: rw=1, want=144, limit=112 [ 528.313676] attempt to access beyond end of device [ 528.319170] loop2: rw=1, want=145, limit=112 [ 528.328376] attempt to access beyond end of device [ 528.333757] loop2: rw=1, want=2178, limit=112 06:07:29 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca580500000000000000b893123f89dedb03442000000000000000000000", @ANYRES32], 0x2}, 0x1, 0xffffff7f00000000}, 0x0) [ 528.550264] FAT-fs (loop3): Unrecognized mount option "" or missing value 06:07:29 executing program 1: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) socket$inet6(0xa, 0x0, 0x0) r0 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp, 0x80) gettid() ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000600)}], 0x1, &(0x7f00000009c0)=[{0xa0, 0x1ff, 0x800, "434c94cf096ca2c6e3a8a6433ea1ccf960ad859f9cabeb13bbcd113f89069f10afdedfc1c2c2a6455dc4d1cc5b8c42e105db6d89e5394ec484d7db74d839a1021c616111655c01f0d6840a2cc4a77a0a2613073b0d1e9ab634a70c9cafd212450fe14e5e32b6ee05d11e22515b1b820c7425d601c3c41b459046978582375e37f0268020620ba8c96a1cf8de5399"}], 0xa0, 0x4040000}, 0x4000040) r1 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r1, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r0) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) [ 528.753682] FAT-fs (loop3): Unrecognized mount option "" or missing value 06:07:29 executing program 2: memfd_create(&(0x7f0000000040)='iocharset', 0x0) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = socket$inet6(0xa, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp={0x2c, 0x0, 0x0, 0x3d}, 0x80) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r2, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000900)="b6", 0x1}], 0x1, &(0x7f00000009c0)=[{0xa0, 0x1ff, 0x800, "434c94cf096ca2c6e3a8a6433ea1ccf960ad859f9cabeb13bbcd113f89069f10afdedfc1c2c2a6455dc4d1cc5b8c42e105db6d89e5394ec484d7db74d839a1021c616111655c01f0d6840a2cc4a77a0a2613073b0d1e9ab634a70c9cafd212450fe14e5e32b6ee05d11e22515b1b820c7425d601c3c41b459046978582375e37f0268020620ba8c96a1cf8de5399"}, {0x20, 0x113, 0x3, "64bc63fb1e5bc65e5043"}], 0xc0, 0x4040000}, 0x4000040) r3 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r3, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:07:29 executing program 4: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = socket$inet6(0xa, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp={0x2c, 0x0, 0x0, 0x3d}, 0x80) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r2, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000900)="b6d35518b48becfbd314d1fa96a307da879125869c71d40c5a385ce1d3af47c69a6acba0142b27475f2f890e1446d7e0851a8c84b5", 0x35}], 0x1, &(0x7f00000009c0)=[{0x80, 0x1ff, 0x800, "434c94cf096ca2c6e3a8a6433ea1ccf960ad859f9cabeb13bbcd113f89069f10afdedfc1c2c2a6455dc4d1cc5b8c42e105db6d89e5394ec484d7db74d839a1021c616111655c01f0d6840a2cc4a77a0a2613073b0d1e9ab634a70c9cafd212450fe14e5e32b6ee05d11e22"}], 0x80, 0x4040000}, 0x4000040) r3 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r3, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:07:29 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca580500000000000000b893123f89dedb03442000000000000000000000", @ANYRES32], 0x2}, 0x1, 0x1000000}, 0x0) 06:07:29 executing program 3: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r1, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x3, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB="10000000000000000701000005086700f3ccf6f7744ebe0a5dc8516572a74ff5930157228b3b283b4a0298b587ab25d99033fc9cd37418d98da6b8d4bdc130b24a9ad51dc777e24a87c3114b4bdb4e8a7d01d9d74297d7b2e004675a6045bfa265fe7ac56301b986a0d1b314989f8a3c80318a1aebb10000f501586e046dbfb2c36c7660b7f3ff460fbf8c7831de975d73ec55619160ca185b13995adb223f47cb2d2f8fe31280ff227a1753bda8e04deea3dda05358"], 0x10, 0x20040000}, 0x8001) sendto$unix(0xffffffffffffffff, &(0x7f0000000100)="9b1fc8c6445750cd60df6190e1c894ab06871030fc490859", 0x18, 0x844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r0) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) ioctl$LOOP_SET_FD(r0, 0x4c00, r0) truncate(&(0x7f0000000080)='./file0\x00', 0x100007) getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f0000000340)={'nat\x00', 0x0, 0x3, 0x24, [], 0x1, &(0x7f00000000c0)=[{}], &(0x7f00000001c0)=""/36}, &(0x7f0000000280)=0x78) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:07:29 executing program 5: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = socket$inet6(0xa, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp={0x2c, 0x0, 0x0, 0x3d}, 0x80) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r2, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000900)="b6d35518b48becfbd314d1fa96a307da879125869c71d40c5a385ce1d3af47c69a6acba0142b27475f2f890e1446d7e0851a8c84b5", 0x35}], 0x1, &(0x7f00000009c0)=[{0x90, 0x1ff, 0x800, "434c94cf096ca2c6e3a8a6433ea1ccf960ad859f9cabeb13bbcd113f89069f10afdedfc1c2c2a6455dc4d1cc5b8c42e105db6d89e5394ec484d7db74d839a1021c616111655c01f0d6840a2cc4a77a0a2613073b0d1e9ab634a70c9cafd212450fe14e5e32b6ee05d11e22515b1b820c7425d601c3c41b45904697"}], 0x90, 0x4040000}, 0x4000040) r3 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r3, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:07:29 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca580500000000000000b893123f89dedb03442000000000000000000000", @ANYRES32], 0x2}, 0x1, 0x2000000}, 0x0) 06:07:30 executing program 2: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x0, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = socket$inet6(0xa, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp={0x2c, 0x0, 0x0, 0x3d}, 0x80) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r2, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000900)="b6", 0x1}], 0x1, &(0x7f00000009c0)=[{0xa0, 0x1ff, 0x800, "434c94cf096ca2c6e3a8a6433ea1ccf960ad859f9cabeb13bbcd113f89069f10afdedfc1c2c2a6455dc4d1cc5b8c42e105db6d89e5394ec484d7db74d839a1021c616111655c01f0d6840a2cc4a77a0a2613073b0d1e9ab634a70c9cafd212450fe14e5e32b6ee05d11e22515b1b820c7425d601c3c41b459046978582375e37f0268020620ba8c96a1cf8de5399"}, {0x20, 0x113, 0x3, "64bc63fb1e5bc65e5043"}], 0xc0, 0x4040000}, 0x4000040) r3 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r3, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:07:30 executing program 5: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = socket$inet6(0xa, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp={0x2c, 0x0, 0x0, 0x3d}, 0x80) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r2, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000900)="b6d35518b48becfbd314d1fa96a307da879125869c71d40c5a385ce1d3af47c69a6acba0142b27475f2f890e1446d7e0851a8c84b5", 0x35}], 0x1, &(0x7f00000009c0)=[{0x90, 0x1ff, 0x800, "434c94cf096ca2c6e3a8a6433ea1ccf960ad859f9cabeb13bbcd113f89069f10afdedfc1c2c2a6455dc4d1cc5b8c42e105db6d89e5394ec484d7db74d839a1021c616111655c01f0d6840a2cc4a77a0a2613073b0d1e9ab634a70c9cafd212450fe14e5e32b6ee05d11e22515b1b820c7425d601c3c41b4590469785"}], 0x90, 0x4040000}, 0x4000040) r3 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r3, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) [ 529.440812] FAT-fs (loop3): Unrecognized mount option "nat" or missing value 06:07:30 executing program 4: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = socket$inet6(0xa, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp={0x2c, 0x0, 0x0, 0x3d}, 0x80) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r2, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000900)="b6", 0x1}], 0x1, &(0x7f00000009c0)=[{0xa0, 0x1ff, 0x800, "434c94cf096ca2c6e3a8a6433ea1ccf960ad859f9cabeb13bbcd113f89069f10afdedfc1c2c2a6455dc4d1cc5b8c42e105db6d89e5394ec484d7db74d839a1021c616111655c01f0d6840a2cc4a77a0a2613073b0d1e9ab634a70c9cafd212450fe14e5e32b6ee05d11e22515b1b820c7425d601c3c41b459046978582375e37f0268020620ba8c96a1cf8de5399"}, {0x20, 0x113, 0x3, "64bc63fb1e5bc65e5043"}], 0xc0, 0x4040000}, 0x4000040) r3 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r3, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:07:30 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca580500000000000000b893123f89dedb03442000000000000000000000", @ANYRES32], 0x2}, 0x1, 0x9effffff00000000}, 0x0) 06:07:30 executing program 3: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r0, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x3, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)=[{0x10, 0x107, 0x5}], 0x10, 0x20040000}, 0x8001) sendto$unix(0xffffffffffffffff, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(0xffffffffffffffff) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:07:30 executing program 1: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) socket$inet6(0xa, 0x0, 0x0) r0 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp, 0x80) gettid() ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000600)}], 0x1, &(0x7f00000009c0), 0x0, 0x4040000}, 0x4000040) r1 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r1, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r0) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:07:30 executing program 2: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x0, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = socket$inet6(0xa, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp={0x2c, 0x0, 0x0, 0x3d}, 0x80) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r2, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000900)="b6", 0x1}], 0x1, &(0x7f00000009c0)=[{0xa0, 0x1ff, 0x800, "434c94cf096ca2c6e3a8a6433ea1ccf960ad859f9cabeb13bbcd113f89069f10afdedfc1c2c2a6455dc4d1cc5b8c42e105db6d89e5394ec484d7db74d839a1021c616111655c01f0d6840a2cc4a77a0a2613073b0d1e9ab634a70c9cafd212450fe14e5e32b6ee05d11e22515b1b820c7425d601c3c41b459046978582375e37f0268020620ba8c96a1cf8de5399"}, {0x20, 0x113, 0x3, "64bc63fb1e5bc65e5043"}], 0xc0, 0x4040000}, 0x4000040) r3 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r3, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:07:30 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca580500000000000000b893123f89dedb03442000000000000000000000", @ANYRES32], 0x2}, 0x1, 0x82050000}, 0x0) [ 529.965182] attempt to access beyond end of device [ 529.970669] loop1: rw=1, want=130, limit=112 [ 529.998596] buffer_io_error: 30 callbacks suppressed [ 529.998606] Buffer I/O error on dev loop1, logical block 129, lost async page write [ 530.026948] FAT-fs (loop2): bogus number of reserved sectors [ 530.068555] attempt to access beyond end of device [ 530.075987] FAT-fs (loop2): Can't find a valid FAT filesystem [ 530.085117] loop1: rw=1, want=131, limit=112 [ 530.095677] Buffer I/O error on dev loop1, logical block 130, lost async page write [ 530.111574] attempt to access beyond end of device [ 530.146780] loop1: rw=1, want=132, limit=112 06:07:30 executing program 3: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r0, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x3, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)=ANY=[@ANYBLOB="10060000000000004000000005000000"], 0x10, 0x20040000}, 0x8001) sendto$unix(0xffffffffffffffff, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) fchdir(0xffffffffffffffff) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:07:30 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca580500000000000000b893123f89dedb03442000000000000000000000", @ANYRES32], 0x2}, 0x1, 0xfffffff0}, 0x0) [ 530.167594] Buffer I/O error on dev loop1, logical block 131, lost async page write [ 530.206279] attempt to access beyond end of device [ 530.211246] loop1: rw=1, want=133, limit=112 06:07:31 executing program 4: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = socket$inet6(0xa, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp, 0x80) gettid() ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000440)="bd5281e90e382e49bc31c58bec93575c69955b99c59ad4bd0fe49bfd7fe94d8885ab76161d9ce31d5d33721046808670be4653c0cc84b9da38535652f4ed2dc5c76b973366cda5cd22c8854b38e0bd58358a1c4321e295b32e956b0a7b25eb0cb616e08644cfab02fce229997b4ca12d8723eff6b59433fc01a0bd53b5f45a48e6ca29d035", 0x85}, {&(0x7f0000000600)="ee02b064c6289979b056ec862d34542624a8ef094eb3a6d305a6b17837f96191c27fc94f9efbd066e7e2aafbbf5452c61d49dff03991631cf6114f7113ed7e182e0d1b123bef992a4116ec55c036280818e436412b534c08c3dc283c7c9b4b455a38317ada3f0c861359a91d527f65a55a36cf34ce77f48745b116b0e4b4ef2b2ed9e1b16e6fb87b15bc5525f19be536cfb606be0f5e94fb6d503ebea5d3a1ed62d5ed5ada217fa9f737221eb398002f72faccd90f01e2fac7fb2097abded2aad0df01", 0xc3}, {&(0x7f0000000900)="b6d35518b48becfbd314d1fa96a307da879125869c71d40c5a385ce1d3af47c69a6acba0142b27475f2f890e1446d7e0851a8c84b5cc192ecdcc36e574f7f7996872b86ab02a1483169b257a8026ce3c23855275080d876355a8d08d92386b82dc72cc793a6ae4", 0x67}], 0x3, &(0x7f00000009c0)=[{0xa0, 0x1ff, 0x800, "434c94cf096ca2c6e3a8a6433ea1ccf960ad859f9cabeb13bbcd113f89069f10afdedfc1c2c2a6455dc4d1cc5b8c42e105db6d89e5394ec484d7db74d839a1021c616111655c01f0d6840a2cc4a77a0a2613073b0d1e9ab634a70c9cafd212450fe14e5e32b6ee05d11e22515b1b820c7425d601c3c41b459046978582375e37f0268020620ba8c96a1cf8de5399"}, {0x20, 0x113, 0x3, "64bc63fb1e5bc65e5043"}], 0xc0, 0x4040000}, 0x4000040) r2 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r2, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) [ 530.268159] Buffer I/O error on dev loop1, logical block 132, lost async page write [ 530.309176] attempt to access beyond end of device [ 530.324129] audit: type=1804 audit(1539756451.043:123): pid=24877 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor5" name="/root/syzkaller-testdir239058742/syzkaller.b5Qjqx/302/file0/file0" dev="loop5" ino=254 res=1 06:07:31 executing program 2: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x0, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = socket$inet6(0xa, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp={0x2c, 0x0, 0x0, 0x3d}, 0x80) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r2, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000900)="b6", 0x1}], 0x1, &(0x7f00000009c0)=[{0xa0, 0x1ff, 0x800, "434c94cf096ca2c6e3a8a6433ea1ccf960ad859f9cabeb13bbcd113f89069f10afdedfc1c2c2a6455dc4d1cc5b8c42e105db6d89e5394ec484d7db74d839a1021c616111655c01f0d6840a2cc4a77a0a2613073b0d1e9ab634a70c9cafd212450fe14e5e32b6ee05d11e22515b1b820c7425d601c3c41b459046978582375e37f0268020620ba8c96a1cf8de5399"}, {0x20, 0x113, 0x3, "64bc63fb1e5bc65e5043"}], 0xc0, 0x4040000}, 0x4000040) r3 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r3, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:07:31 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca580500000000000000b893123f89dedb03442000000000000000000000", @ANYRES32], 0x2}, 0x1, 0x582}, 0x0) [ 530.364350] loop1: rw=1, want=142, limit=112 [ 530.380396] Buffer I/O error on dev loop1, logical block 141, lost async page write [ 530.472712] attempt to access beyond end of device [ 530.509265] loop1: rw=1, want=143, limit=112 [ 530.534549] Buffer I/O error on dev loop1, logical block 142, lost async page write [ 530.548132] audit: type=1800 audit(1539756451.303:124): pid=24877 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor5" name="file0" dev="loop5" ino=254 res=0 06:07:31 executing program 5: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = socket$inet6(0xa, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp={0x2c, 0x0, 0x0, 0x3d}, 0x80) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r2, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000900)="b6d35518b48becfbd314d1fa96a307da879125869c71d40c5a385ce1d3af47c69a6acba0142b27475f2f890e1446d7e0851a8c84b5", 0x35}], 0x1, &(0x7f00000009c0)=[{0x90, 0x1ff, 0x800, "434c94cf096ca2c6e3a8a6433ea1ccf960ad859f9cabeb13bbcd113f89069f10afdedfc1c2c2a6455dc4d1cc5b8c42e105db6d89e5394ec484d7db74d839a1021c616111655c01f0d6840a2cc4a77a0a2613073b0d1e9ab634a70c9cafd212450fe14e5e32b6ee05d11e22515b1b820c7425d601c3c41b4590469785"}], 0x90, 0x4040000}, 0x4000040) r3 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r3, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:07:31 executing program 3: r0 = memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) accept4(r0, &(0x7f0000000080)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @remote}}}, &(0x7f00000001c0)=0x80, 0x800) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r2, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x3, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)=ANY=[@ANYBLOB="10000000080000000701000005000000"], 0x10, 0x20040000}, 0x8001) sendto$unix(0xffffffffffffffff, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) [ 530.591787] attempt to access beyond end of device [ 530.598324] FAT-fs (loop2): bogus number of reserved sectors [ 530.630374] loop1: rw=1, want=144, limit=112 06:07:31 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca580500000000000000b893123f89dedb03442000000000000000000000", @ANYRES32], 0x2}, 0x1, 0xffffff9e}, 0x0) [ 530.637497] FAT-fs (loop2): Can't find a valid FAT filesystem [ 530.651538] attempt to access beyond end of device [ 530.657276] loop5: rw=1, want=130, limit=112 [ 530.661749] Buffer I/O error on dev loop5, logical block 129, lost async page write [ 530.678534] Buffer I/O error on dev loop1, logical block 143, lost async page write [ 530.701190] attempt to access beyond end of device [ 530.707535] attempt to access beyond end of device [ 530.717100] loop5: rw=1, want=131, limit=112 [ 530.721615] loop1: rw=1, want=145, limit=112 [ 530.754202] Buffer I/O error on dev loop5, logical block 130, lost async page write [ 530.762127] Buffer I/O error on dev loop1, logical block 144, lost async page write [ 530.781832] attempt to access beyond end of device 06:07:31 executing program 2: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x0, &(0x7f0000000140), 0x0, &(0x7f0000000340)=ANY=[]) r0 = socket$inet6(0xa, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp={0x2c, 0x0, 0x0, 0x3d}, 0x80) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r2, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000900)="b6", 0x1}], 0x1, &(0x7f00000009c0)=[{0xa0, 0x1ff, 0x800, "434c94cf096ca2c6e3a8a6433ea1ccf960ad859f9cabeb13bbcd113f89069f10afdedfc1c2c2a6455dc4d1cc5b8c42e105db6d89e5394ec484d7db74d839a1021c616111655c01f0d6840a2cc4a77a0a2613073b0d1e9ab634a70c9cafd212450fe14e5e32b6ee05d11e22515b1b820c7425d601c3c41b459046978582375e37f0268020620ba8c96a1cf8de5399"}, {0x20, 0x113, 0x3, "64bc63fb1e5bc65e5043"}], 0xc0, 0x4040000}, 0x4000040) r3 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r3, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) [ 530.817288] attempt to access beyond end of device [ 530.826768] loop5: rw=1, want=132, limit=112 [ 530.837415] loop1: rw=1, want=1721, limit=112 [ 530.842491] attempt to access beyond end of device [ 530.867931] loop5: rw=1, want=133, limit=112 [ 530.881062] attempt to access beyond end of device [ 530.913341] loop5: rw=1, want=142, limit=112 [ 530.950623] attempt to access beyond end of device [ 530.974685] loop5: rw=1, want=143, limit=112 [ 530.996132] attempt to access beyond end of device [ 531.031171] FAT-fs (loop2): bogus number of reserved sectors [ 531.047593] loop5: rw=1, want=144, limit=112 [ 531.062612] attempt to access beyond end of device [ 531.070256] FAT-fs (loop2): Can't find a valid FAT filesystem [ 531.103354] loop5: rw=1, want=145, limit=112 [ 531.152040] attempt to access beyond end of device [ 531.207638] loop5: rw=1, want=2178, limit=112 06:07:32 executing program 1: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) socket$inet6(0xa, 0x0, 0x0) r0 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp, 0x80) gettid() ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000600)}], 0x1, &(0x7f00000009c0), 0x0, 0x4040000}, 0x4000040) r1 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r1, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r0) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:07:32 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca580500000000000000b893123f89dedb03442000000000000000000000", @ANYRES32], 0x2}, 0x1, 0x8205000000000000}, 0x0) 06:07:32 executing program 3: r0 = memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r2, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x3, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)=[{0x10, 0x107, 0x5}], 0x10, 0x20040000}, 0x8001) sendto$unix(0xffffffffffffffff, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r1) r3 = msgget$private(0x0, 0xc8) msgctl$IPC_RMID(r3, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:07:32 executing program 2: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x0, &(0x7f0000000140), 0x0, &(0x7f0000000340)=ANY=[]) r0 = socket$inet6(0xa, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp={0x2c, 0x0, 0x0, 0x3d}, 0x80) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r2, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000900)="b6", 0x1}], 0x1, &(0x7f00000009c0)=[{0xa0, 0x1ff, 0x800, "434c94cf096ca2c6e3a8a6433ea1ccf960ad859f9cabeb13bbcd113f89069f10afdedfc1c2c2a6455dc4d1cc5b8c42e105db6d89e5394ec484d7db74d839a1021c616111655c01f0d6840a2cc4a77a0a2613073b0d1e9ab634a70c9cafd212450fe14e5e32b6ee05d11e22515b1b820c7425d601c3c41b459046978582375e37f0268020620ba8c96a1cf8de5399"}, {0x20, 0x113, 0x3, "64bc63fb1e5bc65e5043"}], 0xc0, 0x4040000}, 0x4000040) r3 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r3, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:07:32 executing program 4: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = socket$inet6(0xa, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp, 0x80) gettid() ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000440)="bd5281e90e382e49bc31c58bec93575c69955b99c59ad4bd0fe49bfd7fe94d8885ab76161d9ce31d5d33721046808670be4653c0cc84b9da38535652f4ed2dc5c76b973366cda5cd22c8854b38e0bd58358a1c4321e295b32e956b0a7b25eb0cb616e08644cfab02fce229997b4ca12d8723eff6b59433fc01a0bd53b5f45a48e6ca29d035", 0x85}, {&(0x7f0000000600)="ee02b064c6289979b056ec862d34542624a8ef094eb3a6d305a6b17837f96191c27fc94f9efbd066e7e2aafbbf5452c61d49dff03991631cf6114f7113ed7e182e0d1b123bef992a4116ec55c036280818e436412b534c08c3dc283c7c9b4b455a38317ada3f0c861359a91d527f65a55a36cf34ce77f48745b116b0e4b4ef2b2ed9e1b16e6fb87b15bc5525f19be536cfb606be0f5e94fb6d503ebea5d3a1ed62d5ed5ada217fa9f737221eb398002f72faccd90f01e2fac7fb2097abded2aad0df01", 0xc3}, {&(0x7f0000000900)="b6d35518b48becfbd314d1fa96a307da879125869c71d40c5a385ce1d3af47c69a6acba0142b27475f2f890e1446d7e0851a8c84b5cc192ecdcc36e574f7f7996872b86ab02a1483169b257a8026ce3c23855275080d876355a8d08d92386b82dc72cc793a6ae4", 0x67}], 0x3, &(0x7f00000009c0)=[{0xa0, 0x1ff, 0x800, "434c94cf096ca2c6e3a8a6433ea1ccf960ad859f9cabeb13bbcd113f89069f10afdedfc1c2c2a6455dc4d1cc5b8c42e105db6d89e5394ec484d7db74d839a1021c616111655c01f0d6840a2cc4a77a0a2613073b0d1e9ab634a70c9cafd212450fe14e5e32b6ee05d11e22515b1b820c7425d601c3c41b459046978582375e37f0268020620ba8c96a1cf8de5399"}, {0x20, 0x113, 0x3, "64bc63fb1e5bc65e5043"}], 0xc0, 0x4040000}, 0x4000040) r2 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r2, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) [ 531.516017] attempt to access beyond end of device [ 531.521193] loop4: rw=1, want=130, limit=112 [ 531.533932] attempt to access beyond end of device 06:07:32 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca580500000000000000b893123f89dedb03442000000000000000000000", @ANYRES32], 0x2}, 0x1, 0x200000000000000}, 0x0) [ 531.563591] loop4: rw=1, want=131, limit=112 [ 531.578105] attempt to access beyond end of device [ 531.632601] loop4: rw=1, want=132, limit=112 [ 531.664721] attempt to access beyond end of device [ 531.670467] FAT-fs (loop2): bogus number of reserved sectors [ 531.679985] loop4: rw=1, want=133, limit=112 [ 531.691852] FAT-fs (loop2): Can't find a valid FAT filesystem [ 531.702909] attempt to access beyond end of device [ 531.739169] loop4: rw=1, want=142, limit=112 06:07:32 executing program 3: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r1, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x3, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)=[{0x10, 0x107, 0x5}], 0x10, 0x20040000}, 0x8001) sendto$unix(0xffffffffffffffff, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r0) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) write$uinput_user_dev(r0, &(0x7f0000000900)={'syz0\x00', {0x100000000, 0xe075, 0x2, 0x100000001}, 0x3e, [0x80000000, 0xe52a, 0x4, 0xfffffffffffffffb, 0x401, 0x6, 0x9, 0x7ff, 0x3, 0x0, 0x4000, 0x6b6, 0x8, 0x3, 0x100, 0xad45, 0xfffffffffffffe01, 0x7, 0x7, 0xfff, 0x3, 0x800, 0x5, 0x465, 0x1, 0x4, 0x5, 0x10001, 0x10000, 0xffffffff80000000, 0x56, 0x4, 0xeec, 0x1f, 0x9, 0x8, 0x401, 0x6, 0x3221, 0x10000, 0x5, 0x4, 0x9, 0xcf3, 0x401, 0x81, 0x7, 0xbd, 0x0, 0x2, 0x2, 0x3, 0xb98, 0x55d, 0x4, 0xfbb5, 0xbc89, 0x1, 0x8, 0x1, 0x2, 0xfffffffffffffffc, 0x1, 0x7], [0x5b, 0x1, 0x6, 0x1, 0x3, 0x7fffffff, 0xffff, 0x1000, 0x7, 0x5, 0x2, 0xae, 0x9, 0x100, 0x2, 0x4, 0x1, 0x10001, 0xffff, 0x8, 0xfffffffffffffff9, 0x5, 0x2, 0x5, 0x3, 0x8, 0x6, 0x64, 0x0, 0x0, 0x4, 0x9, 0x81, 0x6, 0x9, 0xffff, 0x9, 0x1, 0x8, 0x9edf, 0x8, 0x1f, 0x8, 0x7, 0x3f, 0x0, 0x3, 0x6, 0x6, 0x3, 0x400, 0x8001, 0xffffffffffff8000, 0x8, 0x2, 0x3, 0x4, 0x80000001, 0x690, 0x3f, 0x0, 0x1, 0x7, 0xffffffffffffffe1], [0x9426, 0x7fff, 0x7f, 0x7, 0x51e, 0x8, 0xfffffffffffffffb, 0x3, 0x4, 0x80, 0x0, 0x2, 0x8, 0x4, 0x9, 0x8000, 0x1f, 0x4, 0xbd8, 0x3, 0x0, 0x2, 0x1, 0x1, 0x2, 0x23e107b2, 0x401, 0x1, 0x1f, 0x9, 0xfffffffffffffffd, 0x5, 0x100000000, 0x8, 0x1, 0x8, 0x415fd017, 0x3b1, 0x7, 0x5, 0x3, 0x1f, 0x10001, 0x7, 0x6, 0xffffffff, 0x8, 0x8f9, 0x7fff, 0xf8, 0x100000000, 0x1f, 0x8, 0x880, 0x4, 0x7897, 0x1800000000, 0xb900, 0x101, 0x4, 0x0, 0x80, 0x7, 0x1], [0x4a52, 0x7, 0x7, 0x9, 0x4, 0x200, 0x4, 0x4, 0xfffffffffffffffc, 0x3, 0x76d9, 0xfffffffffffffff9, 0x6, 0x5, 0x2, 0x3, 0x1, 0x4, 0x0, 0x7, 0x800, 0x1, 0x3ff, 0x200000000, 0xfffffffffffffbae, 0x7d39, 0x7ff, 0x4, 0x9, 0x80000001, 0x30000000000, 0x5, 0x81, 0x6, 0x5, 0x0, 0x9, 0x8, 0x6, 0x3, 0x5, 0x81, 0x10001, 0x100000001, 0x8, 0x100, 0x100, 0x3f, 0xb77, 0x5, 0x4c0e, 0x7, 0x5d7fd8d4, 0x2, 0x100, 0x7ff, 0x48c, 0x5, 0x5, 0xfffffffffffffffd, 0x81, 0x4, 0x80000000, 0xe88]}, 0x45c) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) [ 531.776263] attempt to access beyond end of device 06:07:32 executing program 2: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x0, &(0x7f0000000140), 0x0, &(0x7f0000000340)=ANY=[]) r0 = socket$inet6(0xa, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp={0x2c, 0x0, 0x0, 0x3d}, 0x80) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r2, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000900)="b6", 0x1}], 0x1, &(0x7f00000009c0)=[{0xa0, 0x1ff, 0x800, "434c94cf096ca2c6e3a8a6433ea1ccf960ad859f9cabeb13bbcd113f89069f10afdedfc1c2c2a6455dc4d1cc5b8c42e105db6d89e5394ec484d7db74d839a1021c616111655c01f0d6840a2cc4a77a0a2613073b0d1e9ab634a70c9cafd212450fe14e5e32b6ee05d11e22515b1b820c7425d601c3c41b459046978582375e37f0268020620ba8c96a1cf8de5399"}, {0x20, 0x113, 0x3, "64bc63fb1e5bc65e5043"}], 0xc0, 0x4040000}, 0x4000040) r3 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r3, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) [ 531.804208] loop4: rw=1, want=143, limit=112 [ 531.815097] attempt to access beyond end of device [ 531.820100] loop4: rw=1, want=144, limit=112 [ 531.827348] attempt to access beyond end of device [ 531.832346] loop4: rw=1, want=145, limit=112 [ 531.836120] attempt to access beyond end of device [ 531.842096] loop4: rw=1, want=1985, limit=112 [ 531.849191] attempt to access beyond end of device [ 531.856227] loop3: rw=1, want=130, limit=112 [ 531.878301] attempt to access beyond end of device 06:07:32 executing program 5: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = socket$inet6(0xa, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp={0x2c, 0x0, 0x0, 0x3d}, 0x80) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r2, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000900)="b6d35518b48becfbd314d1fa96a307da879125869c71d40c5a385ce1d3af47c69a6acba0142b27475f2f890e1446d7e0851a8c84b5", 0x35}], 0x1, &(0x7f00000009c0)=[{0x90, 0x1ff, 0x800, "434c94cf096ca2c6e3a8a6433ea1ccf960ad859f9cabeb13bbcd113f89069f10afdedfc1c2c2a6455dc4d1cc5b8c42e105db6d89e5394ec484d7db74d839a1021c616111655c01f0d6840a2cc4a77a0a2613073b0d1e9ab634a70c9cafd212450fe14e5e32b6ee05d11e22515b1b820c7425d601c3c41b4590469785"}], 0x90, 0x4040000}, 0x4000040) r3 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r3, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:07:32 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca580500000000000000b893123f89dedb03442000000000000000000000", @ANYRES32], 0x2}, 0x1, 0xfffff000}, 0x0) [ 531.902528] loop3: rw=1, want=131, limit=112 [ 531.917465] attempt to access beyond end of device 06:07:32 executing program 1: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) socket$inet6(0xa, 0x0, 0x0) r0 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp, 0x80) gettid() ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000600)}], 0x1, &(0x7f00000009c0), 0x0, 0x4040000}, 0x4000040) r1 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r1, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r0) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) [ 531.950246] loop3: rw=1, want=132, limit=112 [ 531.955664] attempt to access beyond end of device [ 531.960677] loop3: rw=1, want=133, limit=112 [ 531.966944] attempt to access beyond end of device [ 531.972405] loop3: rw=1, want=142, limit=112 [ 531.978937] attempt to access beyond end of device [ 531.992753] loop3: rw=1, want=143, limit=112 06:07:32 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca580500000000000000b893123f89dedb03442000000000000000000000", @ANYRES32], 0x2}, 0x1, 0xf0ffff}, 0x0) [ 531.997835] attempt to access beyond end of device [ 532.002783] loop3: rw=1, want=144, limit=112 [ 532.016256] attempt to access beyond end of device [ 532.021211] loop3: rw=1, want=145, limit=112 [ 532.026102] attempt to access beyond end of device [ 532.031051] loop3: rw=1, want=153, limit=112 06:07:32 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca580500000000000000b893123f89dedb03442000000000000000000000", @ANYRES32], 0x2}, 0x1, 0x8205}, 0x0) [ 532.166932] FAT-fs (loop2): bogus number of reserved sectors [ 532.172806] FAT-fs (loop2): Can't find a valid FAT filesystem 06:07:33 executing program 2: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = socket$inet6(0xa, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp={0x2c, 0x0, 0x0, 0x3d}, 0x80) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r2, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000900)="b6", 0x1}], 0x1, &(0x7f00000009c0)=[{0xa0, 0x1ff, 0x800, "434c94cf096ca2c6e3a8a6433ea1ccf960ad859f9cabeb13bbcd113f89069f10afdedfc1c2c2a6455dc4d1cc5b8c42e105db6d89e5394ec484d7db74d839a1021c616111655c01f0d6840a2cc4a77a0a2613073b0d1e9ab634a70c9cafd212450fe14e5e32b6ee05d11e22515b1b820c7425d601c3c41b459046978582375e37f0268020620ba8c96a1cf8de5399"}, {0x20, 0x113, 0x3, "64bc63fb1e5bc65e5043"}], 0xc0, 0x4040000}, 0x4000040) r3 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r3, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:07:33 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca580500000000000000b893123f89dedb03442000000000000000000000", @ANYRES32], 0x2}, 0x1, 0x2}, 0x0) 06:07:33 executing program 4: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = socket$inet6(0xa, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp, 0x80) gettid() ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000440)="bd5281e90e382e49bc31c58bec93575c69955b99c59ad4bd0fe49bfd7fe94d8885ab76161d9ce31d5d33721046808670be4653c0cc84b9da38535652f4ed2dc5c76b973366cda5cd22c8854b38e0bd58358a1c4321e295b32e956b0a7b25eb0cb616e08644cfab02fce229997b4ca12d8723eff6b59433fc01a0bd53b5f45a48e6ca29d035", 0x85}, {&(0x7f0000000600)="ee02b064c6289979b056ec862d34542624a8ef094eb3a6d305a6b17837f96191c27fc94f9efbd066e7e2aafbbf5452c61d49dff03991631cf6114f7113ed7e182e0d1b123bef992a4116ec55c036280818e436412b534c08c3dc283c7c9b4b455a38317ada3f0c861359a91d527f65a55a36cf34ce77f48745b116b0e4b4ef2b2ed9e1b16e6fb87b15bc5525f19be536cfb606be0f5e94fb6d503ebea5d3a1ed62d5ed5ada217fa9f737221eb398002f72faccd90f01e2fac7fb2097abded2aad0df01", 0xc3}, {&(0x7f0000000900)="b6d35518b48becfbd314d1fa96a307da879125869c71d40c5a385ce1d3af47c69a6acba0142b27475f2f890e1446d7e0851a8c84b5cc192ecdcc36e574f7f7996872b86ab02a1483169b257a8026ce3c23855275080d876355a8d08d92386b82dc72cc793a6ae4", 0x67}], 0x3, &(0x7f00000009c0)=[{0xa0, 0x1ff, 0x800, "434c94cf096ca2c6e3a8a6433ea1ccf960ad859f9cabeb13bbcd113f89069f10afdedfc1c2c2a6455dc4d1cc5b8c42e105db6d89e5394ec484d7db74d839a1021c616111655c01f0d6840a2cc4a77a0a2613073b0d1e9ab634a70c9cafd212450fe14e5e32b6ee05d11e22515b1b820c7425d601c3c41b459046978582375e37f0268020620ba8c96a1cf8de5399"}, {0x20, 0x113, 0x3, "64bc63fb1e5bc65e5043"}], 0xc0, 0x4040000}, 0x4000040) r2 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r2, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:07:33 executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) fcntl$getown(r0, 0x9) memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) r2 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r3, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x3, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)=[{0x10, 0x107, 0x5}], 0x10, 0x20040000}, 0x8001) sendto$unix(0xffffffffffffffff, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) getsockopt$inet_tcp_TCP_REPAIR_WINDOW(r2, 0x6, 0x1d, &(0x7f00000000c0), &(0x7f00000001c0)=0x14) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r1) open$dir(&(0x7f0000000080)='./file0/file0/file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:07:33 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca580500000000000000b893123f89dedb03442000000000000000000000", @ANYRES32], 0x2}, 0x1, 0x100000000000000}, 0x0) [ 532.729001] FAT-fs (loop2): bogus number of reserved sectors [ 532.735280] FAT-fs (loop2): Can't find a valid FAT filesystem 06:07:33 executing program 2: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = socket$inet6(0xa, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp={0x2c, 0x0, 0x0, 0x3d}, 0x80) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r2, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000900)="b6", 0x1}], 0x1, &(0x7f00000009c0)=[{0xa0, 0x1ff, 0x800, "434c94cf096ca2c6e3a8a6433ea1ccf960ad859f9cabeb13bbcd113f89069f10afdedfc1c2c2a6455dc4d1cc5b8c42e105db6d89e5394ec484d7db74d839a1021c616111655c01f0d6840a2cc4a77a0a2613073b0d1e9ab634a70c9cafd212450fe14e5e32b6ee05d11e22515b1b820c7425d601c3c41b459046978582375e37f0268020620ba8c96a1cf8de5399"}, {0x20, 0x113, 0x3, "64bc63fb1e5bc65e5043"}], 0xc0, 0x4040000}, 0x4000040) r3 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r3, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:07:33 executing program 5: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = socket$inet6(0xa, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp={0x2c, 0x0, 0x0, 0x3d}, 0x80) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r2, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000900)="b6d35518b48becfbd314d1fa96a307da879125869c71d40c5a385ce1d3af47c69a6acba0142b27475f2f890e1446d7e0851a8c84b5", 0x35}], 0x1, &(0x7f00000009c0)=[{0x90, 0x1ff, 0x800, "434c94cf096ca2c6e3a8a6433ea1ccf960ad859f9cabeb13bbcd113f89069f10afdedfc1c2c2a6455dc4d1cc5b8c42e105db6d89e5394ec484d7db74d839a1021c616111655c01f0d6840a2cc4a77a0a2613073b0d1e9ab634a70c9cafd212450fe14e5e32b6ee05d11e22515b1b820c7425d601c3c41b459046978582"}], 0x90}, 0x4000040) r3 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r3, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:07:33 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca580500000000000000b893123f89dedb03442000000000000000000000", @ANYRES32], 0x2}, 0x1, 0xf0ffffff00000000}, 0x0) 06:07:33 executing program 1: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) socket$inet6(0xa, 0x0, 0x0) r0 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp, 0x80) gettid() ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000600)}], 0x1, &(0x7f00000009c0)}, 0x4000040) r1 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r1, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r0) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) [ 533.071182] FAT-fs (loop2): bogus number of reserved sectors 06:07:33 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca580500000000000000b893123f89dedb03442000000000000000000000", @ANYRES32], 0x2}, 0x1, 0xffffff7f}, 0x0) [ 533.117932] FAT-fs (loop2): Can't find a valid FAT filesystem [ 533.135376] attempt to access beyond end of device [ 533.140345] loop1: rw=1, want=130, limit=112 06:07:33 executing program 4: r0 = dup2(0xffffffffffffff9c, 0xffffffffffffff9c) r1 = socket(0x10, 0x2, 0xc) r2 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x2, 0x2010, r0, 0x0) write(r2, &(0x7f0000000040)="1f00000000000000200a0501000800010003f2511a10df00", 0xfffffeff) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(r1, 0x84, 0x66, &(0x7f0000000100), &(0x7f0000000140)=0x8) setsockopt$inet_sctp_SCTP_DELAYED_SACK(0xffffffffffffffff, 0x84, 0x10, &(0x7f0000000180)=@assoc_value={0x0, 0xffffffffffffff7f}, 0x8) prctl$intptr(0x4000000021, 0x2) [ 533.204286] attempt to access beyond end of device [ 533.221297] loop1: rw=1, want=131, limit=112 06:07:34 executing program 3: r0 = memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r2, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x3, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)=[{0x10, 0x107, 0x5}], 0x10, 0x20040000}, 0x8001) sendto$unix(0xffffffffffffffff, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r1) accept4$inet6(r0, 0x0, &(0x7f0000000080), 0x80000) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) [ 533.260127] attempt to access beyond end of device [ 533.292179] loop1: rw=1, want=132, limit=112 [ 533.310289] attempt to access beyond end of device 06:07:34 executing program 2: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = socket$inet6(0xa, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp={0x2c, 0x0, 0x0, 0x3d}, 0x80) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r2, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000900)="b6", 0x1}], 0x1, &(0x7f00000009c0)=[{0xa0, 0x1ff, 0x800, "434c94cf096ca2c6e3a8a6433ea1ccf960ad859f9cabeb13bbcd113f89069f10afdedfc1c2c2a6455dc4d1cc5b8c42e105db6d89e5394ec484d7db74d839a1021c616111655c01f0d6840a2cc4a77a0a2613073b0d1e9ab634a70c9cafd212450fe14e5e32b6ee05d11e22515b1b820c7425d601c3c41b459046978582375e37f0268020620ba8c96a1cf8de5399"}, {0x20, 0x113, 0x3, "64bc63fb1e5bc65e5043"}], 0xc0, 0x4040000}, 0x4000040) r3 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r3, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) [ 533.334396] loop1: rw=1, want=133, limit=112 [ 533.338868] attempt to access beyond end of device [ 533.343802] loop1: rw=1, want=142, limit=112 [ 533.351773] attempt to access beyond end of device 06:07:34 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca580500000000000000b893123f89dedb03442000000000000000000000", @ANYRES32], 0x2}, 0x1, 0xf0}, 0x0) [ 533.376877] loop1: rw=1, want=143, limit=112 [ 533.387178] attempt to access beyond end of device [ 533.405738] loop1: rw=1, want=144, limit=112 [ 533.440712] attempt to access beyond end of device [ 533.475150] loop1: rw=1, want=145, limit=112 [ 533.505888] attempt to access beyond end of device [ 533.526888] loop1: rw=1, want=929, limit=112 06:07:34 executing program 4: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x0) readv(r0, &(0x7f0000000000)=[{&(0x7f0000000440)=""/128, 0x80}], 0x1) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) clock_gettime(0x0, &(0x7f00000000c0)={0x0, 0x0}) timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x8}, {r2, r3+30000000}}, &(0x7f0000040000)) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0) tkill(r1, 0x1000000000016) [ 533.615470] FAT-fs (loop2): bogus number of reserved sectors 06:07:34 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca580500000000000000b893123f89dedb03442000000000000000000000", @ANYRES32], 0x2}, 0x1, 0x0, 0x2}, 0x0) [ 533.720575] FAT-fs (loop2): Can't find a valid FAT filesystem 06:07:34 executing program 5: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = socket$inet6(0xa, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp={0x2c, 0x0, 0x0, 0x3d}, 0x80) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r2, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000900)="b6d35518b48becfbd314d1fa96a307da879125869c71d40c5a385ce1d3af47c69a6acba0142b27475f2f890e1446d7e0851a8c84b5", 0x35}], 0x1, &(0x7f00000009c0)=[{0x90, 0x1ff, 0x800, "434c94cf096ca2c6e3a8a6433ea1ccf960ad859f9cabeb13bbcd113f89069f10afdedfc1c2c2a6455dc4d1cc5b8c42e105db6d89e5394ec484d7db74d839a1021c616111655c01f0d6840a2cc4a77a0a2613073b0d1e9ab634a70c9cafd212450fe14e5e32b6ee05d11e22515b1b820c7425d601c3c41b459046978582"}], 0x90}, 0x4000040) r3 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r3, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:07:34 executing program 3: r0 = memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r2, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x3, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)=[{0x10, 0x107, 0x5}], 0x10, 0x20040000}, 0x8001) sendto$unix(0xffffffffffffffff, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000000340)={{{@in6=@loopback, @in6=@mcast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{}, 0x0, @in=@remote}}, &(0x7f00000001c0)=0xe8) setxattr$security_capability(&(0x7f0000000080)='./file0/file0/file0\x00', &(0x7f00000000c0)='security.capability\x00', &(0x7f0000000440)=@v3={0x3000000, [{0x7, 0x7d0}, {0xf7, 0x1}], r3}, 0x18, 0x0) 06:07:34 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca580500000000000000b893123f89dedb03442000000000000000000000", @ANYRES32], 0x2}, 0x1, 0x0, 0xf0ffffffffffff}, 0x0) 06:07:34 executing program 2: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174", 0xb}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = socket$inet6(0xa, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp={0x2c, 0x0, 0x0, 0x3d}, 0x80) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r2, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000900)="b6", 0x1}], 0x1, &(0x7f00000009c0)=[{0xa0, 0x1ff, 0x800, "434c94cf096ca2c6e3a8a6433ea1ccf960ad859f9cabeb13bbcd113f89069f10afdedfc1c2c2a6455dc4d1cc5b8c42e105db6d89e5394ec484d7db74d839a1021c616111655c01f0d6840a2cc4a77a0a2613073b0d1e9ab634a70c9cafd212450fe14e5e32b6ee05d11e22515b1b820c7425d601c3c41b459046978582375e37f0268020620ba8c96a1cf8de5399"}, {0x20, 0x113, 0x3, "64bc63fb1e5bc65e5043"}], 0xc0, 0x4040000}, 0x4000040) r3 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r3, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) [ 533.955520] attempt to access beyond end of device [ 533.960510] loop5: rw=1, want=130, limit=112 [ 534.003794] attempt to access beyond end of device [ 534.009237] loop5: rw=1, want=131, limit=112 [ 534.013759] attempt to access beyond end of device [ 534.020344] loop5: rw=1, want=132, limit=112 [ 534.025212] attempt to access beyond end of device [ 534.030238] loop5: rw=1, want=133, limit=112 [ 534.049631] attempt to access beyond end of device [ 534.067398] FAT-fs (loop2): bogus number of reserved sectors [ 534.072715] loop5: rw=1, want=142, limit=112 [ 534.097153] attempt to access beyond end of device [ 534.108273] FAT-fs (loop2): Can't find a valid FAT filesystem [ 534.126850] loop5: rw=1, want=143, limit=112 [ 534.150853] attempt to access beyond end of device [ 534.163228] loop5: rw=1, want=144, limit=112 [ 534.173605] attempt to access beyond end of device [ 534.218058] loop5: rw=1, want=145, limit=112 [ 534.247463] attempt to access beyond end of device [ 534.282721] loop5: rw=1, want=561, limit=112 06:07:35 executing program 1: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) socket$inet6(0xa, 0x0, 0x0) r0 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp, 0x80) gettid() ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000600)}], 0x1, &(0x7f00000009c0)}, 0x4000040) r1 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r1, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r0) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:07:35 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca580500000000000000b893123f89dedb03442000000000000000000000", @ANYRES32], 0x2}, 0x1, 0x0, 0xf0ffff}, 0x0) 06:07:35 executing program 2: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174", 0xb}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = socket$inet6(0xa, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp={0x2c, 0x0, 0x0, 0x3d}, 0x80) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r2, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000900)="b6", 0x1}], 0x1, &(0x7f00000009c0)=[{0xa0, 0x1ff, 0x800, "434c94cf096ca2c6e3a8a6433ea1ccf960ad859f9cabeb13bbcd113f89069f10afdedfc1c2c2a6455dc4d1cc5b8c42e105db6d89e5394ec484d7db74d839a1021c616111655c01f0d6840a2cc4a77a0a2613073b0d1e9ab634a70c9cafd212450fe14e5e32b6ee05d11e22515b1b820c7425d601c3c41b459046978582375e37f0268020620ba8c96a1cf8de5399"}, {0x20, 0x113, 0x3, "64bc63fb1e5bc65e5043"}], 0xc0, 0x4040000}, 0x4000040) r3 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r3, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:07:35 executing program 3: memfd_create(&(0x7f0000000040)='iocharset', 0x1) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) r1 = accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r2, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x3, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)=[{0x10, 0x107, 0x5}], 0x10, 0x20040000}, 0x8001) io_setup(0x2, &(0x7f0000000080)=0x0) r4 = openat$cgroup_ro(r0, &(0x7f00000001c0)='cgroup.stat\x00', 0x0, 0x0) io_cancel(r3, &(0x7f0000000340)={0x0, 0x0, 0x0, 0xb, 0x6, r1, &(0x7f00000000c0)="eb55a886c842b9d6c3e1188e85649ae174c79601dfc51586d3a9859135f713aed0dcbcd3331c3e824dd2808245461d1a9f3e6d1db6e4f8c420cbe73a0d54", 0x3e, 0x100000000, 0x0, 0x1, r4}, &(0x7f0000000380)) sendto$unix(0xffffffffffffffff, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r0) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) [ 534.605021] attempt to access beyond end of device [ 534.610020] loop1: rw=1, want=130, limit=112 [ 534.623304] attempt to access beyond end of device [ 534.638066] loop1: rw=1, want=131, limit=112 [ 534.646912] attempt to access beyond end of device 06:07:35 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca580500000000000000b893123f89dedb03442000000000000000000000", @ANYRES32], 0x2}, 0x1, 0x0, 0x1000000}, 0x0) [ 534.667296] loop1: rw=1, want=132, limit=112 [ 534.671954] FAT-fs (loop2): bogus number of reserved sectors [ 534.683635] attempt to access beyond end of device [ 534.691180] FAT-fs (loop2): Can't find a valid FAT filesystem [ 534.705960] loop1: rw=1, want=133, limit=112 [ 534.730838] attempt to access beyond end of device [ 534.759803] loop1: rw=1, want=142, limit=112 [ 534.807889] attempt to access beyond end of device [ 534.837461] loop1: rw=1, want=143, limit=112 [ 534.841923] attempt to access beyond end of device 06:07:35 executing program 2: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174", 0xb}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = socket$inet6(0xa, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp={0x2c, 0x0, 0x0, 0x3d}, 0x80) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r2, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000900)="b6", 0x1}], 0x1, &(0x7f00000009c0)=[{0xa0, 0x1ff, 0x800, "434c94cf096ca2c6e3a8a6433ea1ccf960ad859f9cabeb13bbcd113f89069f10afdedfc1c2c2a6455dc4d1cc5b8c42e105db6d89e5394ec484d7db74d839a1021c616111655c01f0d6840a2cc4a77a0a2613073b0d1e9ab634a70c9cafd212450fe14e5e32b6ee05d11e22515b1b820c7425d601c3c41b459046978582375e37f0268020620ba8c96a1cf8de5399"}, {0x20, 0x113, 0x3, "64bc63fb1e5bc65e5043"}], 0xc0, 0x4040000}, 0x4000040) r3 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r3, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) [ 534.881321] loop1: rw=1, want=144, limit=112 [ 534.899847] attempt to access beyond end of device [ 534.918745] loop1: rw=1, want=145, limit=112 [ 534.952915] attempt to access beyond end of device [ 534.974349] loop1: rw=1, want=1497, limit=112 [ 535.074139] FAT-fs (loop2): bogus number of reserved sectors [ 535.131275] FAT-fs (loop2): Can't find a valid FAT filesystem [ 535.294923] attempt to access beyond end of device [ 535.299905] loop5: rw=1, want=130, limit=112 [ 535.304805] buffer_io_error: 46 callbacks suppressed [ 535.304815] Buffer I/O error on dev loop5, logical block 129, lost async page write [ 535.318289] attempt to access beyond end of device [ 535.323236] loop5: rw=1, want=131, limit=112 [ 535.328068] Buffer I/O error on dev loop5, logical block 130, lost async page write [ 535.338380] attempt to access beyond end of device [ 535.349219] loop5: rw=1, want=132, limit=112 [ 535.353652] Buffer I/O error on dev loop5, logical block 131, lost async page write [ 535.362901] attempt to access beyond end of device [ 535.378693] loop5: rw=1, want=133, limit=112 [ 535.383128] Buffer I/O error on dev loop5, logical block 132, lost async page write [ 535.391836] attempt to access beyond end of device [ 535.396929] loop5: rw=1, want=142, limit=112 [ 535.401347] Buffer I/O error on dev loop5, logical block 141, lost async page write [ 535.409218] attempt to access beyond end of device [ 535.414202] loop5: rw=1, want=143, limit=112 [ 535.418612] Buffer I/O error on dev loop5, logical block 142, lost async page write [ 535.427243] attempt to access beyond end of device [ 535.432170] loop5: rw=1, want=144, limit=112 [ 535.436658] Buffer I/O error on dev loop5, logical block 143, lost async page write [ 535.445089] attempt to access beyond end of device [ 535.445775] attempt to access beyond end of device [ 535.450177] loop1: rw=1, want=130, limit=112 [ 535.455062] loop5: rw=1, want=145, limit=112 [ 535.455077] Buffer I/O error on dev loop5, logical block 144, lost async page write [ 535.460087] Buffer I/O error on dev loop1, logical block 129, lost async page write [ 535.465350] attempt to access beyond end of device [ 535.472166] attempt to access beyond end of device [ 535.480606] loop5: rw=1, want=993, limit=112 [ 535.484935] loop1: rw=1, want=131, limit=112 [ 535.498858] Buffer I/O error on dev loop1, logical block 130, lost async page write [ 535.507027] attempt to access beyond end of device [ 535.512010] loop1: rw=1, want=132, limit=112 [ 535.516525] attempt to access beyond end of device [ 535.521481] loop1: rw=1, want=133, limit=112 [ 535.526006] attempt to access beyond end of device [ 535.531807] loop1: rw=1, want=142, limit=112 [ 535.536890] attempt to access beyond end of device [ 535.542498] loop1: rw=1, want=143, limit=112 [ 535.548064] attempt to access beyond end of device [ 535.553025] loop1: rw=1, want=144, limit=112 [ 535.558787] attempt to access beyond end of device [ 535.563763] loop1: rw=1, want=145, limit=112 [ 535.571663] attempt to access beyond end of device [ 535.576914] loop1: rw=1, want=2178, limit=112 06:07:37 executing program 3: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r1, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x3, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)=[{0x10, 0x107, 0x5}], 0x10, 0x20040000}, 0x8001) sendto$unix(0xffffffffffffffff, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r0) open$dir(&(0x7f0000000080)='./file0/file0/file0\x00', 0x80440, 0xfffffffffffffffd) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:07:37 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca580500000000000000b893123f89dedb03442000000000000000000000", @ANYRES32], 0x2}, 0x1, 0x0, 0x82050000}, 0x0) 06:07:37 executing program 4: getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f0000000140)={{{@in6=@ipv4={[], [], @loopback}, @in6=@mcast2}}, {{@in=@remote}, 0x0, @in=@multicast1}}, &(0x7f0000000080)=0xe8) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(0xffffffffffffffff, 0xc00c642d, &(0x7f0000000000)={0x0, 0x80000, 0xffffffffffffff9c}) ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffff9c, 0xc0206434, &(0x7f0000000040)={0x10000, 0x0, 0x1, 0x3f}) ioctl$DRM_IOCTL_AGP_BIND(r0, 0x40106436, &(0x7f0000000280)={r1, 0x80}) syz_mount_image$xfs(&(0x7f00000002c0)='xfs\x00', &(0x7f0000000100)='./file0\x00', 0xffffffff, 0x1, &(0x7f00000000c0)=[{&(0x7f0000010000)="58465342000010000003c6000000100000000000000000000000000000000000984f0b5042b64b06bc86cba3e6cc3f80000000000000004000000000000000800000000000000081000000000000008200000001000010000000000100000000000006c0b4a40200010000100000000000000000000000000c0908040c", 0x7d}], 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB='`']) r2 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000300)='/dev/dsp\x00', 0x4080, 0x0) ioctl$NBD_SET_SIZE(r2, 0xab02, 0x8) 06:07:37 executing program 5: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = socket$inet6(0xa, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp={0x2c, 0x0, 0x0, 0x3d}, 0x80) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r2, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000900)="b6d35518b48becfbd314d1fa96a307da879125869c71d40c5a385ce1d3af47c69a6acba0142b27475f2f890e1446d7e0851a8c84b5", 0x35}], 0x1, &(0x7f00000009c0)=[{0x90, 0x1ff, 0x800, "434c94cf096ca2c6e3a8a6433ea1ccf960ad859f9cabeb13bbcd113f89069f10afdedfc1c2c2a6455dc4d1cc5b8c42e105db6d89e5394ec484d7db74d839a1021c616111655c01f0d6840a2cc4a77a0a2613073b0d1e9ab634a70c9cafd212450fe14e5e32b6ee05d11e22515b1b820c7425d601c3c41b459046978582"}], 0x90}, 0x4000040) r3 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r3, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:07:37 executing program 2: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002", 0x11}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = socket$inet6(0xa, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp={0x2c, 0x0, 0x0, 0x3d}, 0x80) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r2, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000900)="b6", 0x1}], 0x1, &(0x7f00000009c0)=[{0xa0, 0x1ff, 0x800, "434c94cf096ca2c6e3a8a6433ea1ccf960ad859f9cabeb13bbcd113f89069f10afdedfc1c2c2a6455dc4d1cc5b8c42e105db6d89e5394ec484d7db74d839a1021c616111655c01f0d6840a2cc4a77a0a2613073b0d1e9ab634a70c9cafd212450fe14e5e32b6ee05d11e22515b1b820c7425d601c3c41b459046978582375e37f0268020620ba8c96a1cf8de5399"}, {0x20, 0x113, 0x3, "64bc63fb1e5bc65e5043"}], 0xc0, 0x4040000}, 0x4000040) r3 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r3, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:07:37 executing program 1: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) socket$inet6(0xa, 0x0, 0x0) r0 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp, 0x80) gettid() ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000600)}], 0x1, &(0x7f00000009c0)}, 0x4000040) r1 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r1, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r0) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) [ 536.797837] FAT-fs (loop2): invalid media value (0x00) [ 536.841756] FAT-fs (loop2): Can't find a valid FAT filesystem 06:07:37 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca580500000000000000b893123f89dedb03442000000000000000000000", @ANYRES32], 0x2}, 0x1, 0x0, 0xf000}, 0x0) [ 536.960373] XFS (loop4): unknown mount option [`]. 06:07:37 executing program 5: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = socket$inet6(0xa, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp={0x2c, 0x0, 0x0, 0x3d}, 0x80) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r2, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000900)="b6d35518b48becfbd314d1fa96a307da879125869c71d40c5a385ce1d3af47c69a6acba0142b27475f2f890e1446d7e0851a8c84b5", 0x35}], 0x1, &(0x7f00000009c0)=[{0x90, 0x1ff, 0x800, "434c94cf096ca2c6e3a8a6433ea1ccf960ad859f9cabeb13bbcd113f89069f10afdedfc1c2c2a6455dc4d1cc5b8c42e105db6d89e5394ec484d7db74d839a1021c616111655c01f0d6840a2cc4a77a0a2613073b0d1e9ab634a70c9cafd212450fe14e5e32b6ee05d11e22515b1b820c7425d601c3c41b459046978582"}], 0x90, 0x4040000}, 0x0) r3 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r3, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:07:37 executing program 2: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002", 0x11}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = socket$inet6(0xa, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp={0x2c, 0x0, 0x0, 0x3d}, 0x80) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r2, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000900)="b6", 0x1}], 0x1, &(0x7f00000009c0)=[{0xa0, 0x1ff, 0x800, "434c94cf096ca2c6e3a8a6433ea1ccf960ad859f9cabeb13bbcd113f89069f10afdedfc1c2c2a6455dc4d1cc5b8c42e105db6d89e5394ec484d7db74d839a1021c616111655c01f0d6840a2cc4a77a0a2613073b0d1e9ab634a70c9cafd212450fe14e5e32b6ee05d11e22515b1b820c7425d601c3c41b459046978582375e37f0268020620ba8c96a1cf8de5399"}, {0x20, 0x113, 0x3, "64bc63fb1e5bc65e5043"}], 0xc0, 0x4040000}, 0x4000040) r3 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r3, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:07:37 executing program 3: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$SNDRV_CTL_IOCTL_POWER_STATE(r0, 0x800455d1, &(0x7f0000000080)) ioctl$LOOP_CTL_REMOVE(r1, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x3, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)=ANY=[@ANYBLOB="1000000000000b00070100000500000a"], 0x10, 0x20040000}, 0x8001) sendto$unix(0xffffffffffffffff, &(0x7f0000000100)="e15ce5cd1d69f5baae895ab43376", 0xa, 0x4844, &(0x7f0000000700)=@abs={0x91ddda212026d15a, 0x0, 0x4e20}, 0x166) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r0) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:07:37 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca580500000000000000b893123f89dedb03442000000000000000000000", @ANYRES32], 0x2}, 0x1, 0x0, 0x582}, 0x0) [ 537.109525] XFS (loop4): unknown mount option [`]. [ 537.227289] FAT-fs (loop2): invalid media value (0x00) [ 537.256824] FAT-fs (loop2): Can't find a valid FAT filesystem 06:07:38 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca580500000000000000b893123f89dedb03442000000000000000000000", @ANYRES32], 0x2}, 0x1, 0x0, 0xfffffff0}, 0x0) 06:07:38 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x10000, 0x0) ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f0000000040)=0x0) write$cgroup_pid(r1, &(0x7f0000000080)=r2, 0x12) getpgrp(r2) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x0, 0x31, 0xffffffffffffffff, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r1, 0x402c5342, &(0x7f00000000c0)={0x2, 0xad97, 0x4, {0x0, 0x989680}, 0x16c1f64b, 0xbda}) ioctl$TCGETA(r0, 0x5405, &(0x7f0000000140)) 06:07:38 executing program 2: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002", 0x11}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = socket$inet6(0xa, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp={0x2c, 0x0, 0x0, 0x3d}, 0x80) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r2, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000900)="b6", 0x1}], 0x1, &(0x7f00000009c0)=[{0xa0, 0x1ff, 0x800, "434c94cf096ca2c6e3a8a6433ea1ccf960ad859f9cabeb13bbcd113f89069f10afdedfc1c2c2a6455dc4d1cc5b8c42e105db6d89e5394ec484d7db74d839a1021c616111655c01f0d6840a2cc4a77a0a2613073b0d1e9ab634a70c9cafd212450fe14e5e32b6ee05d11e22515b1b820c7425d601c3c41b459046978582375e37f0268020620ba8c96a1cf8de5399"}, {0x20, 0x113, 0x3, "64bc63fb1e5bc65e5043"}], 0xc0, 0x4040000}, 0x4000040) r3 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r3, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:07:38 executing program 5: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = socket$inet6(0xa, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp={0x2c, 0x0, 0x0, 0x3d}, 0x80) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r2, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000900)="b6d35518b48becfbd314d1fa96a307da879125869c71d40c5a385ce1d3af47c69a6acba0142b27475f2f890e1446d7e0851a8c84b5", 0x35}], 0x1, &(0x7f00000009c0)=[{0x90, 0x1ff, 0x800, "434c94cf096ca2c6e3a8a6433ea1ccf960ad859f9cabeb13bbcd113f89069f10afdedfc1c2c2a6455dc4d1cc5b8c42e105db6d89e5394ec484d7db74d839a1021c616111655c01f0d6840a2cc4a77a0a2613073b0d1e9ab634a70c9cafd212450fe14e5e32b6ee05d11e22515b1b820c7425d601c3c41b459046978582"}], 0x90, 0x4040000}, 0x0) r3 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r3, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:07:38 executing program 1: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) socket$inet6(0xa, 0x0, 0x0) r0 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp, 0x80) gettid() ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000600)}], 0x1, &(0x7f00000009c0)}, 0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r1, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r0) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) [ 537.577878] FAT-fs (loop2): invalid media value (0x00) [ 537.583909] FAT-fs (loop2): Can't find a valid FAT filesystem 06:07:38 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca580500000000000000b893123f89dedb03442000000000000000000000", @ANYRES32], 0x2}, 0x1, 0x0, 0x9effffff00000000}, 0x0) 06:07:38 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x0, 0x0, @local, 0x4}, 0x1c) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) ioctl$GIO_FONT(r2, 0x4b60, &(0x7f0000000080)=""/26) sendmsg$nl_xfrm(r2, &(0x7f000014f000)={&(0x7f00003c7ff4), 0xc, &(0x7f00000bfff0)={&(0x7f0000006440)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x0, {{@in6=@mcast1, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0xa}}}, 0xb8}}, 0x0) setsockopt$inet6_mtu(r1, 0x29, 0x12, &(0x7f0000000000), 0x1d) [ 537.685207] attempt to access beyond end of device [ 537.690304] loop1: rw=1, want=130, limit=112 [ 537.738512] attempt to access beyond end of device [ 537.743507] loop1: rw=1, want=131, limit=112 06:07:38 executing program 2: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270", 0x14}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = socket$inet6(0xa, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp={0x2c, 0x0, 0x0, 0x3d}, 0x80) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r2, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000900)="b6", 0x1}], 0x1, &(0x7f00000009c0)=[{0xa0, 0x1ff, 0x800, "434c94cf096ca2c6e3a8a6433ea1ccf960ad859f9cabeb13bbcd113f89069f10afdedfc1c2c2a6455dc4d1cc5b8c42e105db6d89e5394ec484d7db74d839a1021c616111655c01f0d6840a2cc4a77a0a2613073b0d1e9ab634a70c9cafd212450fe14e5e32b6ee05d11e22515b1b820c7425d601c3c41b459046978582375e37f0268020620ba8c96a1cf8de5399"}, {0x20, 0x113, 0x3, "64bc63fb1e5bc65e5043"}], 0xc0, 0x4040000}, 0x4000040) r3 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r3, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) [ 537.796314] attempt to access beyond end of device 06:07:38 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca580500000000000000b893123f89dedb03442000000000000000000000", @ANYRES32], 0x2}, 0x1, 0x0, 0xfffff000}, 0x0) 06:07:38 executing program 3: r0 = memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r2, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x3, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)=[{0x10, 0x107, 0x5}], 0x10, 0x20040000}, 0x8001) sendto$unix(0xffffffffffffffff, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000080)='/dev/vga_arbiter\x00', 0x224400, 0x0) ioctl$LOOP_CTL_GET_FREE(r2, 0x4c82) r3 = ioctl$LOOP_CTL_GET_FREE(r1, 0x4c82) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, r3) fchdir(r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setxattr(&(0x7f00000000c0)='./file1\x00', &(0x7f00000001c0)=@known='trusted.overlay.opaque\x00', &(0x7f0000000340)='\x00', 0x1, 0x1) [ 537.836717] loop1: rw=1, want=132, limit=112 [ 537.880093] attempt to access beyond end of device [ 537.916239] loop1: rw=1, want=133, limit=112 [ 537.938033] attempt to access beyond end of device 06:07:38 executing program 4: r0 = socket$alg(0x26, 0x5, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind$alg(r0, &(0x7f0000002640)={0x26, 'aead\x00', 0x0, 0x0, 'rfc7539(cfb(twofish),rmd128-generic)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000001400)="b7f2288a911993f0265df5cf1cdd8b55b062950b86bc01abc8464d4f8a906151", 0x20) syz_open_dev$amidi(&(0x7f0000000340)='/dev/amidi#\x00', 0x9f, 0x0) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f00000013c0)={0x0, 0x0, &(0x7f0000000200), 0x0, &(0x7f0000000040)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) ioctl$TUNSETGROUP(0xffffffffffffffff, 0x400454ce, 0x0) recvmmsg(r1, &(0x7f0000008e80)=[{{&(0x7f0000000140)=@ethernet={0x0, @remote}, 0x80, &(0x7f0000001600)=[{&(0x7f0000001540)=""/165, 0x536}], 0x1, &(0x7f0000001680)=""/72, 0x48}}], 0x1, 0x0, &(0x7f0000002240)) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x0, 0x32, 0xffffffffffffffff, 0x0) r2 = userfaultfd(0x80000) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000003fe8)) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000001fe2)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) ioctl$UFFDIO_COPY(r2, 0xc028aa03, &(0x7f0000000040)={&(0x7f0000011000/0x1000)=nil, &(0x7f0000010000/0x2000)=nil, 0x1000}) syz_open_dev$amidi(&(0x7f0000000000)='/dev/amidi#\x00', 0x7364b48, 0x80200) 06:07:38 executing program 2: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270", 0x14}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = socket$inet6(0xa, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp={0x2c, 0x0, 0x0, 0x3d}, 0x80) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r2, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000900)="b6", 0x1}], 0x1, &(0x7f00000009c0)=[{0xa0, 0x1ff, 0x800, "434c94cf096ca2c6e3a8a6433ea1ccf960ad859f9cabeb13bbcd113f89069f10afdedfc1c2c2a6455dc4d1cc5b8c42e105db6d89e5394ec484d7db74d839a1021c616111655c01f0d6840a2cc4a77a0a2613073b0d1e9ab634a70c9cafd212450fe14e5e32b6ee05d11e22515b1b820c7425d601c3c41b459046978582375e37f0268020620ba8c96a1cf8de5399"}, {0x20, 0x113, 0x3, "64bc63fb1e5bc65e5043"}], 0xc0, 0x4040000}, 0x4000040) r3 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r3, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) [ 537.962262] loop1: rw=1, want=142, limit=112 [ 537.980215] attempt to access beyond end of device 06:07:38 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca580500000000000000b893123f89dedb03442000000000000000000000", @ANYRES32], 0x2}, 0x1, 0x0, 0x2000000}, 0x0) [ 538.028961] loop1: rw=1, want=143, limit=112 [ 538.062969] attempt to access beyond end of device [ 538.082864] FAT-fs (loop2): invalid media value (0x00) [ 538.095090] loop1: rw=1, want=144, limit=112 [ 538.119645] attempt to access beyond end of device [ 538.147362] FAT-fs (loop2): Can't find a valid FAT filesystem [ 538.176835] loop1: rw=1, want=145, limit=112 06:07:39 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca580500000000000000b893123f89dedb03442000000000000000000000", @ANYRES32], 0x2}, 0x1, 0x0, 0x8205}, 0x0) [ 538.221077] attempt to access beyond end of device [ 538.247992] loop1: rw=1, want=985, limit=112 06:07:39 executing program 3: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r1, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x3, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)=[{0x10, 0x107, 0x5}], 0x10, 0x20040000}, 0x8001) sendto$unix(0xffffffffffffffff, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r0) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) socket$inet_dccp(0x2, 0x6, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:07:39 executing program 4: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040)='/dev/uinput\x00', 0x2, 0x0) r1 = syz_open_dev$midi(&(0x7f0000000000)='/dev/midi#\x00', 0x1000, 0x8000) ioctl$KVM_GET_MSRS(r1, 0xc008ae88, &(0x7f0000000080)={0x1, 0x0, [{}]}) ioctl$UI_DEV_SETUP(r0, 0x405c5503, &(0x7f0000000100)={{}, 'syz0\x00'}) ioctl$UI_DEV_SETUP(r0, 0x5501, &(0x7f0000000300)={{}, 'syz0\x00'}) readv(r0, &(0x7f00000002c0)=[{&(0x7f00000000c0)=""/24, 0x18}, {&(0x7f0000000180)=""/22, 0x16}], 0x2) write$uinput_user_dev(r0, &(0x7f0000000880)={'syz0\x00', {}, 0x0, [], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000]}, 0x45c) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqn(r2, 0x0, 0x27, &(0x7f00000002c0)={@multicast2, @loopback}, 0xc) setsockopt$inet_msfilter(r2, 0x0, 0x29, &(0x7f0000000000)={@multicast2, @loopback, 0x1, 0x1, [@multicast2]}, 0x14) setsockopt$inet_msfilter(r2, 0x0, 0x29, &(0x7f00000000c0)={@multicast2, @loopback, 0x0, 0x2, [@rand_addr=0x3, @empty]}, 0x18) r3 = socket$inet_udp(0x2, 0x2, 0x0) fcntl$setstatus(r2, 0x4, 0x40400) setsockopt$inet_mreqsrc(r3, 0x0, 0x23, &(0x7f00003fdff5)={@multicast2, @loopback, @rand_addr}, 0xc) write$FUSE_NOTIFY_INVAL_INODE(r1, &(0x7f00000001c0)={0x28, 0x2, 0x0, {0x4, 0x8, 0x9}}, 0x28) [ 538.416040] attempt to access beyond end of device [ 538.421041] loop5: rw=1, want=130, limit=112 [ 538.428729] attempt to access beyond end of device [ 538.433740] loop5: rw=1, want=131, limit=112 [ 538.438296] attempt to access beyond end of device [ 538.443232] loop5: rw=1, want=132, limit=112 [ 538.447750] attempt to access beyond end of device [ 538.452689] loop5: rw=1, want=133, limit=112 [ 538.452727] attempt to access beyond end of device [ 538.462136] loop5: rw=1, want=142, limit=112 [ 538.478426] attempt to access beyond end of device [ 538.483412] loop5: rw=1, want=143, limit=112 [ 538.492176] attempt to access beyond end of device [ 538.536338] loop5: rw=1, want=144, limit=112 [ 538.544528] input: syz0 as /devices/virtual/input/input19 [ 538.553396] attempt to access beyond end of device [ 538.559317] loop5: rw=1, want=145, limit=112 [ 538.578533] attempt to access beyond end of device [ 538.610232] loop5: rw=1, want=2178, limit=112 06:07:39 executing program 1: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) socket$inet6(0xa, 0x0, 0x0) r0 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp, 0x80) gettid() ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000600)}], 0x1, &(0x7f00000009c0)}, 0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r1, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r0) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:07:39 executing program 5: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = socket$inet6(0xa, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp={0x2c, 0x0, 0x0, 0x3d}, 0x80) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r2, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000900)="b6d35518b48becfbd314d1fa96a307da879125869c71d40c5a385ce1d3af47c69a6acba0142b27475f2f890e1446d7e0851a8c84b5", 0x35}], 0x1, &(0x7f00000009c0)=[{0x90, 0x1ff, 0x800, "434c94cf096ca2c6e3a8a6433ea1ccf960ad859f9cabeb13bbcd113f89069f10afdedfc1c2c2a6455dc4d1cc5b8c42e105db6d89e5394ec484d7db74d839a1021c616111655c01f0d6840a2cc4a77a0a2613073b0d1e9ab634a70c9cafd212450fe14e5e32b6ee05d11e22515b1b820c7425d601c3c41b459046978582"}], 0x90, 0x4040000}, 0x0) r3 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r3, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:07:39 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca580500000000000000b893123f89dedb03442000000000000000000000", @ANYRES32], 0x2}, 0x1, 0x0, 0x100000000000000}, 0x0) 06:07:39 executing program 2: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270", 0x14}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = socket$inet6(0xa, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp={0x2c, 0x0, 0x0, 0x3d}, 0x80) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r2, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000900)="b6", 0x1}], 0x1, &(0x7f00000009c0)=[{0xa0, 0x1ff, 0x800, "434c94cf096ca2c6e3a8a6433ea1ccf960ad859f9cabeb13bbcd113f89069f10afdedfc1c2c2a6455dc4d1cc5b8c42e105db6d89e5394ec484d7db74d839a1021c616111655c01f0d6840a2cc4a77a0a2613073b0d1e9ab634a70c9cafd212450fe14e5e32b6ee05d11e22515b1b820c7425d601c3c41b459046978582375e37f0268020620ba8c96a1cf8de5399"}, {0x20, 0x113, 0x3, "64bc63fb1e5bc65e5043"}], 0xc0, 0x4040000}, 0x4000040) r3 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r3, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) [ 538.658107] input: syz0 as /devices/virtual/input/input20 06:07:39 executing program 3: r0 = memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f00000000c0)='vfat\x00', &(0x7f00000003c0)='./file0\x00', 0xe004, 0xaaaaeb6, &(0x7f0000000340)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16, 0xe1}], 0x0, &(0x7f0000000080)=ANY=[@ANYRES64=r0]) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) r2 = shmget(0x2, 0x1000, 0x400, &(0x7f0000fff000/0x1000)=nil) shmctl$SHM_LOCK(r2, 0xb) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) shmctl$SHM_LOCK(r2, 0xb) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r4, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x3, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)=[{0x10, 0x107, 0x5}], 0x10, 0x20040000}, 0x8001) sendto$unix(0xffffffffffffffff, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) r5 = ioctl$LOOP_CTL_GET_FREE(r4, 0x4c82) ioctl$LOOP_CTL_REMOVE(r3, 0x4c81, r5) fchdir(r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) [ 538.731995] FAT-fs (loop2): invalid media value (0x00) [ 538.744772] FAT-fs (loop2): Can't find a valid FAT filesystem 06:07:39 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca580500000000000000b893123f89dedb03442000000000000000000000", @ANYRES32], 0x2}, 0x1, 0x0, 0xffffff7f00000000}, 0x0) 06:07:39 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x4, 0x32, 0xffffffffffffffff, 0x0) r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000003fe8)) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000001fe2)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_DISABLE_FRAGMENTS(r2, 0x84, 0x8, &(0x7f0000013e95), 0x4) getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r2, 0x84, 0xf, &(0x7f0000000200)={0x0, @in={{0x2, 0x0, @broadcast}}}, &(0x7f0000000080)=0x97) close(r2) close(r1) 06:07:39 executing program 2: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270ff", 0x15}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = socket$inet6(0xa, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp={0x2c, 0x0, 0x0, 0x3d}, 0x80) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r2, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000900)="b6", 0x1}], 0x1, &(0x7f00000009c0)=[{0xa0, 0x1ff, 0x800, "434c94cf096ca2c6e3a8a6433ea1ccf960ad859f9cabeb13bbcd113f89069f10afdedfc1c2c2a6455dc4d1cc5b8c42e105db6d89e5394ec484d7db74d839a1021c616111655c01f0d6840a2cc4a77a0a2613073b0d1e9ab634a70c9cafd212450fe14e5e32b6ee05d11e22515b1b820c7425d601c3c41b459046978582375e37f0268020620ba8c96a1cf8de5399"}, {0x20, 0x113, 0x3, "64bc63fb1e5bc65e5043"}], 0xc0, 0x4040000}, 0x4000040) r3 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r3, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:07:39 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca580500000000000000b893123f89dedb03442000000000000000000000", @ANYRES32], 0x2}, 0x1, 0x0, 0xf0ffffff}, 0x0) 06:07:39 executing program 1: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) socket$inet6(0xa, 0x0, 0x0) r0 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp, 0x80) gettid() ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000600)}], 0x1, &(0x7f00000009c0)}, 0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r1, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r0) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:07:39 executing program 5: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = socket$inet6(0xa, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp={0x2c, 0x0, 0x0, 0x3d}, 0x80) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r2, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000900)="b6d35518b48becfbd314d1fa96a307da879125869c71d40c5a385ce1d3af47c69a6acba0142b27475f2f890e1446d7e0851a8c84b5", 0x35}], 0x1, &(0x7f00000009c0)=[{0x90, 0x1ff, 0x800, "434c94cf096ca2c6e3a8a6433ea1ccf960ad859f9cabeb13bbcd113f89069f10afdedfc1c2c2a6455dc4d1cc5b8c42e105db6d89e5394ec484d7db74d839a1021c616111655c01f0d6840a2cc4a77a0a2613073b0d1e9ab634a70c9cafd212450fe14e5e32b6ee05d11e22515b1b820c7425d601c3c41b459046978582"}], 0x90, 0x4040000}, 0x4000040) r3 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x0, 0x0) sendto$unix(r3, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) [ 539.131838] FAT-fs (loop2): invalid media value (0x00) [ 539.163856] FAT-fs (loop2): Can't find a valid FAT filesystem 06:07:39 executing program 4: r0 = openat$userio(0xffffffffffffff9c, &(0x7f0000000a00)='/dev/userio\x00', 0x22001, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r0, &(0x7f0000000000)={0x1, 0x1}, 0x2) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r0, &(0x7f0000000140)={0x7ffffffff000, 0x10, 0xfa00, {&(0x7f00000000c0)}}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000200)={0x2, 0x3}, 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f00000001c0), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r0, &(0x7f0000000080)={0x2, 0xfffffffffffffffa}, 0x2) 06:07:39 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca580500000000000000b893123f89dedb03442000000000000000000000", @ANYRES32], 0x2}, 0x1, 0x0, 0xf0}, 0x0) 06:07:40 executing program 2: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270ff", 0x15}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = socket$inet6(0xa, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp={0x2c, 0x0, 0x0, 0x3d}, 0x80) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r2, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000900)="b6", 0x1}], 0x1, &(0x7f00000009c0)=[{0xa0, 0x1ff, 0x800, "434c94cf096ca2c6e3a8a6433ea1ccf960ad859f9cabeb13bbcd113f89069f10afdedfc1c2c2a6455dc4d1cc5b8c42e105db6d89e5394ec484d7db74d839a1021c616111655c01f0d6840a2cc4a77a0a2613073b0d1e9ab634a70c9cafd212450fe14e5e32b6ee05d11e22515b1b820c7425d601c3c41b459046978582375e37f0268020620ba8c96a1cf8de5399"}, {0x20, 0x113, 0x3, "64bc63fb1e5bc65e5043"}], 0xc0, 0x4040000}, 0x4000040) r3 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r3, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:07:40 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca580500000000000000b893123f89dedb03442000000000000000000000", @ANYRES32], 0x2}, 0x1, 0x0, 0xffffff9e}, 0x0) 06:07:40 executing program 3: r0 = memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) r2 = accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$dupfd(r2, 0x0, r1) r3 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) setsockopt$sock_void(r0, 0x1, 0x3f, 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r3, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x3, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)=[{0x10, 0x107, 0x5}], 0x10, 0x20040000}, 0x8001) sendto$unix(0xffffffffffffffff, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) [ 539.404634] FAT-fs (loop2): invalid media value (0x00) [ 539.434162] FAT-fs (loop2): Can't find a valid FAT filesystem 06:07:40 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca580500000000000000b893123f89dedb03442000000000000000000000", @ANYRES32], 0x2}, 0x1, 0x0, 0xfffffffffffff000}, 0x0) 06:07:40 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca580500000000000000b893123f89dedb03442000000000000000000000", @ANYRES32], 0x2}, 0x1, 0x0, 0x8205000000000000}, 0x0) 06:07:40 executing program 5: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = socket$inet6(0xa, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp={0x2c, 0x0, 0x0, 0x3d}, 0x80) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r2, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000900)="b6d35518b48becfbd314d1fa96a307da879125869c71d40c5a385ce1d3af47c69a6acba0142b27475f2f890e1446d7e0851a8c84b5", 0x35}], 0x1, &(0x7f00000009c0)=[{0x90, 0x1ff, 0x800, "434c94cf096ca2c6e3a8a6433ea1ccf960ad859f9cabeb13bbcd113f89069f10afdedfc1c2c2a6455dc4d1cc5b8c42e105db6d89e5394ec484d7db74d839a1021c616111655c01f0d6840a2cc4a77a0a2613073b0d1e9ab634a70c9cafd212450fe14e5e32b6ee05d11e22515b1b820c7425d601c3c41b459046978582"}], 0x90, 0x4040000}, 0x4000040) r3 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x0, 0x0) sendto$unix(r3, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:07:40 executing program 2: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270ff", 0x15}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = socket$inet6(0xa, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp={0x2c, 0x0, 0x0, 0x3d}, 0x80) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r2, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000900)="b6", 0x1}], 0x1, &(0x7f00000009c0)=[{0xa0, 0x1ff, 0x800, "434c94cf096ca2c6e3a8a6433ea1ccf960ad859f9cabeb13bbcd113f89069f10afdedfc1c2c2a6455dc4d1cc5b8c42e105db6d89e5394ec484d7db74d839a1021c616111655c01f0d6840a2cc4a77a0a2613073b0d1e9ab634a70c9cafd212450fe14e5e32b6ee05d11e22515b1b820c7425d601c3c41b459046978582375e37f0268020620ba8c96a1cf8de5399"}, {0x20, 0x113, 0x3, "64bc63fb1e5bc65e5043"}], 0xc0, 0x4040000}, 0x4000040) r3 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r3, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:07:40 executing program 2: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = socket$inet6(0xa, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp={0x2c, 0x0, 0x0, 0x3d}, 0x80) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r2, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000900)="b6", 0x1}], 0x1, &(0x7f00000009c0)=[{0xa0, 0x1ff, 0x800, "434c94cf096ca2c6e3a8a6433ea1ccf960ad859f9cabeb13bbcd113f89069f10afdedfc1c2c2a6455dc4d1cc5b8c42e105db6d89e5394ec484d7db74d839a1021c616111655c01f0d6840a2cc4a77a0a2613073b0d1e9ab634a70c9cafd212450fe14e5e32b6ee05d11e22515b1b820c7425d601c3c41b459046978582375e37f0268020620ba8c96a1cf8de5399"}, {0x20, 0x113, 0x3, "64bc63fb1e5bc65e5043"}], 0xc0, 0x4040000}, 0x4000040) r3 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r3, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:07:41 executing program 1: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) socket$inet6(0xa, 0x0, 0x0) r0 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp, 0x80) gettid() ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000600)}], 0x1, &(0x7f00000009c0)}, 0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x0, 0x0) sendto$unix(r1, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r0) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:07:41 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca580500000000000000b893123f89dedb03442000000000000000000000", @ANYRES32], 0x2}, 0x1, 0x0, 0x200000000000000}, 0x0) [ 540.275146] attempt to access beyond end of device [ 540.280179] loop1: rw=1, want=130, limit=112 [ 540.290984] attempt to access beyond end of device [ 540.312673] loop1: rw=1, want=131, limit=112 [ 540.321623] buffer_io_error: 23 callbacks suppressed [ 540.321634] Buffer I/O error on dev loop1, logical block 130, lost async page write [ 540.345612] attempt to access beyond end of device [ 540.360278] loop1: rw=1, want=132, limit=112 [ 540.366299] attempt to access beyond end of device [ 540.371249] loop2: rw=1, want=130, limit=112 [ 540.373770] Buffer I/O error on dev loop1, logical block 131, lost async page write [ 540.384391] Buffer I/O error on dev loop2, logical block 129, lost async page write [ 540.392253] attempt to access beyond end of device [ 540.392295] attempt to access beyond end of device [ 540.406362] loop1: rw=1, want=133, limit=112 [ 540.410926] Buffer I/O error on dev loop1, logical block 132, lost async page write [ 540.414608] loop2: rw=1, want=131, limit=112 [ 540.419294] attempt to access beyond end of device [ 540.423152] Buffer I/O error on dev loop2, logical block 130, lost async page write [ 540.423188] attempt to access beyond end of device [ 540.423203] loop2: rw=1, want=132, limit=112 [ 540.429919] loop1: rw=1, want=142, limit=112 [ 540.442153] Buffer I/O error on dev loop2, logical block 131, lost async page write [ 540.448684] Buffer I/O error on dev loop1, logical block 141, lost async page write [ 540.450164] attempt to access beyond end of device [ 540.459595] attempt to access beyond end of device [ 540.467217] loop2: rw=1, want=133, limit=112 [ 540.471226] loop1: rw=1, want=143, limit=112 [ 540.475925] Buffer I/O error on dev loop2, logical block 132, lost async page write [ 540.475959] attempt to access beyond end of device [ 540.475971] loop2: rw=1, want=142, limit=112 [ 540.475984] Buffer I/O error on dev loop2, logical block 141, lost async page write [ 540.476021] attempt to access beyond end of device [ 540.476033] loop2: rw=1, want=143, limit=112 [ 540.476046] Buffer I/O error on dev loop2, logical block 142, lost async page write [ 540.476073] attempt to access beyond end of device [ 540.481746] attempt to access beyond end of device [ 540.485115] loop2: rw=1, want=144, limit=112 [ 540.492778] loop5: rw=1, want=130, limit=112 [ 540.497852] attempt to access beyond end of device [ 540.504374] attempt to access beyond end of device [ 540.510104] loop2: rw=1, want=145, limit=112 [ 540.515656] attempt to access beyond end of device [ 540.519944] attempt to access beyond end of device [ 540.527619] loop1: rw=1, want=144, limit=112 [ 540.532314] loop2: rw=1, want=409, limit=112 [ 540.537728] loop5: rw=1, want=131, limit=112 [ 540.551750] attempt to access beyond end of device [ 540.557547] attempt to access beyond end of device [ 540.560678] loop1: rw=1, want=145, limit=112 [ 540.565862] loop5: rw=1, want=132, limit=112 [ 540.571720] attempt to access beyond end of device [ 540.575413] attempt to access beyond end of device [ 540.579502] loop1: rw=1, want=785, limit=112 [ 540.583855] loop5: rw=1, want=133, limit=112 [ 540.583892] attempt to access beyond end of device [ 540.595092] loop5: rw=1, want=142, limit=112 [ 540.602712] attempt to access beyond end of device [ 540.637266] loop5: rw=1, want=143, limit=112 [ 540.641814] attempt to access beyond end of device [ 540.646942] loop5: rw=1, want=144, limit=112 [ 540.651416] attempt to access beyond end of device [ 540.656467] loop5: rw=1, want=145, limit=112 [ 540.662749] attempt to access beyond end of device [ 540.668359] loop5: rw=1, want=2178, limit=112 [ 541.254971] attempt to access beyond end of device [ 541.259984] loop1: rw=1, want=130, limit=112 [ 541.264541] attempt to access beyond end of device [ 541.269536] loop1: rw=1, want=131, limit=112 [ 541.274021] attempt to access beyond end of device [ 541.279051] loop1: rw=1, want=132, limit=112 [ 541.283500] attempt to access beyond end of device [ 541.288521] loop1: rw=1, want=133, limit=112 [ 541.292950] attempt to access beyond end of device [ 541.297963] loop1: rw=1, want=142, limit=112 [ 541.302405] attempt to access beyond end of device [ 541.307403] loop1: rw=1, want=143, limit=112 [ 541.311844] attempt to access beyond end of device [ 541.316819] loop1: rw=1, want=144, limit=112 [ 541.321246] attempt to access beyond end of device [ 541.326237] loop1: rw=1, want=145, limit=112 [ 541.332543] attempt to access beyond end of device [ 541.337574] loop1: rw=1, want=2178, limit=112 [ 541.814222] misc userio: Buffer overflowed, userio client isn't keeping up [ 545.174199] misc userio: Buffer overflowed, userio client isn't keeping up [ 548.954196] misc userio: Buffer overflowed, userio client isn't keeping up [ 552.524169] misc userio: Buffer overflowed, userio client isn't keeping up [ 556.704179] misc userio: Buffer overflowed, userio client isn't keeping up [ 558.805746] input: PS/2 Generic Mouse as /devices/serio3/input/input22 [ 559.024243] psmouse serio3: Failed to enable mouse on 06:08:00 executing program 4: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) socket$inet6(0xa, 0x0, 0x0) r0 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp, 0x80) gettid() ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000600)}], 0x1, &(0x7f00000009c0)}, 0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x0, 0x0) sendto$unix(r1, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r0) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:08:00 executing program 3: r0 = memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r2, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000006c0)={&(0x7f0000000640)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x3, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0xfffffffffffffd81, &(0x7f0000000880), 0x0, &(0x7f0000003b40), 0x10, 0x40000}, 0x8001) sendto$unix(0xffffffffffffffff, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) recvmsg(r0, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000340)=""/157, 0x9d}, {&(0x7f0000000400)=""/149, 0x95}, {&(0x7f0000000580)=""/191, 0xbf}, {&(0x7f0000000080)=""/85, 0x55}], 0x4, 0x0, 0x0, 0x10001}, 0x40000001) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:08:00 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca580500000000000000b893123f89dedb03442000000000000000000000", @ANYRES32], 0x2}, 0x1, 0x0, 0xf0ffffff00000000}, 0x0) 06:08:00 executing program 2: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = socket$inet6(0xa, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp={0x2c, 0x0, 0x0, 0x3d}, 0x80) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r2, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000900)="b6", 0x1}], 0x1, &(0x7f00000009c0)=[{0xa0, 0x1ff, 0x800, "434c94cf096ca2c6e3a8a6433ea1ccf960ad859f9cabeb13bbcd113f89069f10afdedfc1c2c2a6455dc4d1cc5b8c42e105db6d89e5394ec484d7db74d839a1021c616111655c01f0d6840a2cc4a77a0a2613073b0d1e9ab634a70c9cafd212450fe14e5e32b6ee05d11e22515b1b820c7425d601c3c41b459046978582375e37f0268020620ba8c96a1cf8de5399"}, {0x20, 0x113, 0x3, "64bc63fb1e5bc65e5043"}], 0xc0, 0x4040000}, 0x4000040) r3 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r3, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:08:00 executing program 5: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = socket$inet6(0xa, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp={0x2c, 0x0, 0x0, 0x3d}, 0x80) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r2, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000900)="b6d35518b48becfbd314d1fa96a307da879125869c71d40c5a385ce1d3af47c69a6acba0142b27475f2f890e1446d7e0851a8c84b5", 0x35}], 0x1, &(0x7f00000009c0)=[{0x90, 0x1ff, 0x800, "434c94cf096ca2c6e3a8a6433ea1ccf960ad859f9cabeb13bbcd113f89069f10afdedfc1c2c2a6455dc4d1cc5b8c42e105db6d89e5394ec484d7db74d839a1021c616111655c01f0d6840a2cc4a77a0a2613073b0d1e9ab634a70c9cafd212450fe14e5e32b6ee05d11e22515b1b820c7425d601c3c41b459046978582"}], 0x90, 0x4040000}, 0x4000040) r3 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x0, 0x0) sendto$unix(r3, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:08:00 executing program 1: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) socket$inet6(0xa, 0x0, 0x0) r0 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp, 0x80) gettid() ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000600)}], 0x1, &(0x7f00000009c0)}, 0x0) openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x0, 0x0) sendto$unix(0xffffffffffffffff, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r0) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:08:00 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca580500000000000000b893123f89dedb03442000000000000000000000", @ANYRES32], 0x2}, 0x1, 0x0, 0x9effffff}, 0x0) 06:08:00 executing program 2: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = socket$inet6(0xa, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp={0x2c, 0x0, 0x0, 0x3d}, 0x80) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r2, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000900)="b6", 0x1}], 0x1, &(0x7f00000009c0)=[{0xa0, 0x1ff, 0x800, "434c94cf096ca2c6e3a8a6433ea1ccf960ad859f9cabeb13bbcd113f89069f10afdedfc1c2c2a6455dc4d1cc5b8c42e105db6d89e5394ec484d7db74d839a1021c616111655c01f0d6840a2cc4a77a0a2613073b0d1e9ab634a70c9cafd212450fe14e5e32b6ee05d11e22515b1b820c7425d601c3c41b459046978582375e37f0268020620ba8c96a1cf8de5399"}, {0x20, 0x113, 0x3, "64bc63fb1e5bc65e5043"}], 0xc0, 0x4040000}, 0x4000040) r3 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r3, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:08:00 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca580500000000000000b893123f89dedb03442000000000000000000000", @ANYRES32], 0x2}, 0x1, 0x0, 0xffffff7f}, 0x0) 06:08:00 executing program 4: r0 = syz_open_dev$dspn(&(0x7f0000e5bff6)='/dev/dsp#\x00', 0x1, 0x0) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$int_in(r0, 0x800000c004500a, &(0x7f00000015c0)) poll(&(0x7f0000000040)=[{r1, 0x1}, {r1, 0x1008}, {r0, 0x920d}, {r1, 0x9090}, {r1, 0x1000}, {r0, 0x8}, {r0, 0x38}], 0x7, 0x204) 06:08:00 executing program 3: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r1, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x3, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="1000000000eaffa90ead59f45d44545062c51fbc229dbae901000005000000"], 0x10, 0x20040000}, 0x8001) sendto$unix(0xffffffffffffffff, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r0) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:08:00 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca580500000000000000b893123f89dedb03442000000000000000000000", @ANYRES32], 0x2}, 0x1, 0x0, 0x0, 0xfffffffffffff000}, 0x0) 06:08:00 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca580500000000000000b893123f89dedb03442000000000000000000000", @ANYRES32], 0x2}, 0x1, 0x0, 0x0, 0x582}, 0x0) 06:08:00 executing program 1: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) socket$inet6(0xa, 0x0, 0x0) r0 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp, 0x80) gettid() ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000600)}], 0x1, &(0x7f00000009c0)}, 0x0) openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x0, 0x0) sendto$unix(0xffffffffffffffff, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r0) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) [ 560.197075] attempt to access beyond end of device [ 560.202361] loop1: rw=1, want=130, limit=112 [ 560.210279] buffer_io_error: 21 callbacks suppressed [ 560.210285] Buffer I/O error on dev loop1, logical block 129, lost async page write [ 560.224193] attempt to access beyond end of device [ 560.230083] loop1: rw=1, want=131, limit=112 [ 560.234999] Buffer I/O error on dev loop1, logical block 130, lost async page write [ 560.243028] attempt to access beyond end of device [ 560.250479] loop1: rw=1, want=132, limit=112 [ 560.262755] Buffer I/O error on dev loop1, logical block 131, lost async page write [ 560.311026] attempt to access beyond end of device 06:08:01 executing program 2: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = socket$inet6(0xa, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp={0x2c, 0x0, 0x0, 0x3d}, 0x80) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r2, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000900)="b6", 0x1}], 0x1, &(0x7f00000009c0)=[{0xa0, 0x1ff, 0x800, "434c94cf096ca2c6e3a8a6433ea1ccf960ad859f9cabeb13bbcd113f89069f10afdedfc1c2c2a6455dc4d1cc5b8c42e105db6d89e5394ec484d7db74d839a1021c616111655c01f0d6840a2cc4a77a0a2613073b0d1e9ab634a70c9cafd212450fe14e5e32b6ee05d11e22515b1b820c7425d601c3c41b459046978582375e37f0268020620ba8c96a1cf8de5399"}, {0x20, 0x113, 0x3, "64bc63fb1e5bc65e5043"}], 0xc0, 0x4040000}, 0x4000040) r3 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r3, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:08:01 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca580500000000000000b893123f89dedb03442000000000000000000000", @ANYRES32], 0x2}, 0x1, 0x0, 0x0, 0xfffffff0}, 0x0) [ 560.338002] loop1: rw=1, want=133, limit=112 [ 560.375307] Buffer I/O error on dev loop1, logical block 132, lost async page write [ 560.466638] attempt to access beyond end of device [ 560.528357] loop1: rw=1, want=142, limit=112 [ 560.571927] Buffer I/O error on dev loop1, logical block 141, lost async page write [ 560.604277] attempt to access beyond end of device [ 560.609289] loop1: rw=1, want=143, limit=112 [ 560.613705] Buffer I/O error on dev loop1, logical block 142, lost async page write [ 560.621671] attempt to access beyond end of device [ 560.627226] loop1: rw=1, want=144, limit=112 [ 560.631748] Buffer I/O error on dev loop1, logical block 143, lost async page write [ 560.640237] attempt to access beyond end of device [ 560.645644] loop1: rw=1, want=145, limit=112 [ 560.650059] Buffer I/O error on dev loop1, logical block 144, lost async page write [ 560.661949] attempt to access beyond end of device 06:08:01 executing program 5: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = socket$inet6(0xa, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp={0x2c, 0x0, 0x0, 0x3d}, 0x80) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r2, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000900)="b6d35518b48becfbd314d1fa96a307da879125869c71d40c5a385ce1d3af47c69a6acba0142b27475f2f890e1446d7e0851a8c84b5", 0x35}], 0x1, &(0x7f00000009c0)=[{0x90, 0x1ff, 0x800, "434c94cf096ca2c6e3a8a6433ea1ccf960ad859f9cabeb13bbcd113f89069f10afdedfc1c2c2a6455dc4d1cc5b8c42e105db6d89e5394ec484d7db74d839a1021c616111655c01f0d6840a2cc4a77a0a2613073b0d1e9ab634a70c9cafd212450fe14e5e32b6ee05d11e22515b1b820c7425d601c3c41b459046978582"}], 0x90, 0x4040000}, 0x4000040) openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(0xffffffffffffffff, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:08:01 executing program 4: r0 = socket$netlink(0x10, 0x3, 0xfffffe) r1 = syz_open_dev$evdev(&(0x7f0000000600)='/dev/input/event#\x00', 0x2, 0x0) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x1000002, 0x32, 0xffffffffffffffff, 0x0) ioctl$EVIOCGKEYCODE(r1, 0x80084503, &(0x7f0000000100)=""/202) writev(r0, &(0x7f00000000c0)=[{&(0x7f0000000080)="390000001300090468feedffffbf6dff0600ff3f03000000450001070000001419001a000e00020001000a000200000800005d148399a7b338", 0x39}], 0x1) 06:08:01 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca580500000000000000b893123f89dedb03442000000000000000000000", @ANYRES32], 0x2}, 0x1, 0x0, 0x0, 0x1000000}, 0x0) 06:08:01 executing program 2: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = socket$inet6(0xa, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp={0x2c, 0x0, 0x0, 0x3d}, 0x80) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r2, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000900)="b6", 0x1}], 0x1, &(0x7f00000009c0)=[{0xa0, 0x1ff, 0x800, "434c94cf096ca2c6e3a8a6433ea1ccf960ad859f9cabeb13bbcd113f89069f10afdedfc1c2c2a6455dc4d1cc5b8c42e105db6d89e5394ec484d7db74d839a1021c616111655c01f0d6840a2cc4a77a0a2613073b0d1e9ab634a70c9cafd212450fe14e5e32b6ee05d11e22515b1b820c7425d601c3c41b459046978582375e37f0268020620ba8c96a1cf8de5399"}, {0x20, 0x113, 0x3, "64bc63fb1e5bc65e5043"}], 0xc0, 0x4040000}, 0x4000040) r3 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r3, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) [ 560.668258] loop1: rw=1, want=2178, limit=112 06:08:01 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca580500000000000000b893123f89dedb03442000000000000000000000", @ANYRES32], 0x2}, 0x1, 0x0, 0x0, 0x8205}, 0x0) [ 560.737828] attempt to access beyond end of device [ 560.738094] attempt to access beyond end of device [ 560.742819] loop5: rw=1, want=130, limit=112 [ 560.770833] Buffer I/O error on dev loop5, logical block 129, lost async page write [ 560.780616] loop2: rw=1, want=130, limit=112 [ 560.791875] attempt to access beyond end of device [ 560.797293] loop5: rw=1, want=131, limit=112 [ 560.801858] Buffer I/O error on dev loop5, logical block 130, lost async page write [ 560.810622] attempt to access beyond end of device [ 560.815870] loop5: rw=1, want=132, limit=112 [ 560.820425] attempt to access beyond end of device [ 560.825972] loop5: rw=1, want=133, limit=112 [ 560.826648] attempt to access beyond end of device [ 560.830594] attempt to access beyond end of device 06:08:01 executing program 4: r0 = socket$inet6(0xa, 0x101000000000002, 0x0) ioctl(r0, 0x80000000008912, &(0x7f0000000080)="1d3f6234488dd25d766070") r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x4, 0x5, &(0x7f00000000c0)=ANY=[@ANYBLOB="bf16000000000000b7070000c5110314407000000000e0ff1f000000000000009500000000000000"], &(0x7f0000000100)='GPL\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000140)={r1, 0x0, 0xe, 0x99, &(0x7f0000000280)="d16f00000aedfc735f06e6bf675f", &(0x7f0000000380)=""/153, 0x6fd1}, 0x28) readahead(r0, 0xf9b, 0xe4) [ 560.841578] loop5: rw=1, want=142, limit=112 [ 560.848415] attempt to access beyond end of device [ 560.921337] loop2: rw=1, want=131, limit=112 [ 560.930894] loop5: rw=1, want=143, limit=112 [ 560.976016] attempt to access beyond end of device [ 560.981235] attempt to access beyond end of device [ 560.999325] loop2: rw=1, want=132, limit=112 [ 561.004787] loop5: rw=1, want=144, limit=112 [ 561.016631] attempt to access beyond end of device [ 561.022853] attempt to access beyond end of device [ 561.040484] loop2: rw=1, want=133, limit=112 [ 561.048328] loop5: rw=1, want=145, limit=112 [ 561.058502] attempt to access beyond end of device [ 561.066819] attempt to access beyond end of device [ 561.076604] loop2: rw=1, want=142, limit=112 [ 561.082316] loop5: rw=1, want=601, limit=112 [ 561.096839] attempt to access beyond end of device [ 561.115802] loop2: rw=1, want=143, limit=112 [ 561.127656] attempt to access beyond end of device [ 561.136024] loop2: rw=1, want=144, limit=112 [ 561.142226] attempt to access beyond end of device [ 561.147566] loop2: rw=1, want=145, limit=112 [ 561.152220] attempt to access beyond end of device [ 561.164983] loop2: rw=1, want=297, limit=112 [ 561.221517] audit: type=1804 audit(1539756481.973:125): pid=25670 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor3" name="/root/syzkaller-testdir399687728/syzkaller.SA5dD7/399/file0/file0" dev="loop3" ino=272 res=1 [ 561.245995] audit: type=1804 audit(1539756481.973:126): pid=25673 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor3" name="/root/syzkaller-testdir399687728/syzkaller.SA5dD7/399/file0/file0" dev="loop3" ino=272 res=1 06:08:02 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca580500000000000000b893123f89dedb03442000000000000000000000", @ANYRES32], 0x2}, 0x1, 0x0, 0x0, 0x200000000000000}, 0x0) 06:08:02 executing program 1: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) socket$inet6(0xa, 0x0, 0x0) r0 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp, 0x80) gettid() ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000600)}], 0x1, &(0x7f00000009c0)}, 0x0) openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x0, 0x0) sendto$unix(0xffffffffffffffff, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r0) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:08:02 executing program 3: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16, 0x5}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r1, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x3, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)=[{0x10, 0x107, 0x5}], 0x10, 0x20040000}, 0x8001) sendto$unix(0xffffffffffffffff, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0xfffffffffffffced, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r0, 0xc04064a0, &(0x7f0000000380)={&(0x7f0000000080)=[0x0, 0x0], &(0x7f00000000c0)=[0x0], &(0x7f00000001c0)=[0x0, 0x0], &(0x7f0000000340)=[0x0, 0x0, 0x0], 0x2, 0x1, 0x2, 0x3}) fchdir(r0) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:08:02 executing program 4: r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$midi(&(0x7f00000000c0)='/dev/midi#\x00', 0x1, 0x400) ioctl$KVM_IRQ_LINE(r1, 0x4008ae61, &(0x7f0000000100)={0xc00000000000, 0x7f}) connect$pptp(0xffffffffffffffff, &(0x7f0000000080)={0x18, 0x2, {0x0, @multicast2}}, 0x1e) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x0, 0x0) fallocate(r0, 0x0, 0x0, 0x4) close(r2) openat$null(0xffffffffffffff9c, &(0x7f0000000140)='/dev/null\x00', 0x0, 0x0) 06:08:02 executing program 4: r0 = socket$inet(0x10, 0x0, 0xc) r1 = syz_open_dev$vcsa(&(0x7f00000000c0)='/dev/vcsa#\x00', 0x0, 0x2) ioctl$KVM_IOEVENTFD(0xffffffffffffffff, 0x4040ae79, &(0x7f0000000100)={0x0, &(0x7f0000000080), 0x6, r1, 0x1}) perf_event_open(&(0x7f0000000200)={0x0, 0x70, 0xee6a}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000300)='./file0\x00', 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000400), 0x1}}, 0x0, 0x0, 0xffffffffffffffff, 0x2) chdir(&(0x7f0000000340)='./file0\x00') symlink(&(0x7f0000000800)='./file0/file0\x00', &(0x7f00000007c0)='./file0\x00') clone(0x2102001ffa, 0x0, 0xfffffffffffffffe, &(0x7f00000008c0), 0xffffffffffffffff) bpf$OBJ_GET_MAP(0x7, &(0x7f0000000500)={&(0x7f00000004c0)='./file0/file0\x00'}, 0x10) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000280)={0x0}, &(0x7f00000002c0)=0xc) ioctl$SNDRV_CTL_IOCTL_ELEM_REPLACE(r1, 0xc1105518, &(0x7f0000000540)={{0x6, 0x7, 0x4, 0x5, 'syz1\x00', 0x400}, 0x1, 0x10000103, 0x6ce, r2, 0x7, 0x3, 'syz0\x00', &(0x7f0000000380)=['\x00', '/dev/vcsa#\x00', "70707031e77070703000", 'md5sum-ppp0em0vboxnet1@{selfvboxnet1\x00', 'em1\x00', '/dev/vcsa#\x00', '/dev/vcsa#\x00'], 0x55, [], [0x5, 0xbbb, 0x8, 0xc1]}) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000040)={0xffffffffffffffff, 0x50, &(0x7f0000000180)}, 0x10) 06:08:02 executing program 5: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = socket$inet6(0xa, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp={0x2c, 0x0, 0x0, 0x3d}, 0x80) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r2, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000900)="b6d35518b48becfbd314d1fa96a307da879125869c71d40c5a385ce1d3af47c69a6acba0142b27475f2f890e1446d7e0851a8c84b5", 0x35}], 0x1, &(0x7f00000009c0)=[{0x90, 0x1ff, 0x800, "434c94cf096ca2c6e3a8a6433ea1ccf960ad859f9cabeb13bbcd113f89069f10afdedfc1c2c2a6455dc4d1cc5b8c42e105db6d89e5394ec484d7db74d839a1021c616111655c01f0d6840a2cc4a77a0a2613073b0d1e9ab634a70c9cafd212450fe14e5e32b6ee05d11e22515b1b820c7425d601c3c41b459046978582"}], 0x90, 0x4040000}, 0x4000040) openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(0xffffffffffffffff, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) [ 561.343332] attempt to access beyond end of device [ 561.349055] loop3: rw=1, want=130, limit=112 06:08:02 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca580500000000000000b893123f89dedb03442000000000000000000000", @ANYRES32], 0x2}, 0x1, 0x0, 0x0, 0xfffff000}, 0x0) [ 561.409241] attempt to access beyond end of device [ 561.449287] loop3: rw=1, want=131, limit=112 06:08:02 executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$fou(&(0x7f0000000140)='fou\x00') r2 = syz_open_dev$audion(&(0x7f00000002c0)='/dev/audio#\x00', 0x800, 0x200) ioctl$KVM_GET_SREGS(r2, 0x8138ae83, &(0x7f0000000300)) sendmsg$FOU_CMD_GET(r0, &(0x7f0000000200)={&(0x7f00000000c0), 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x1c, r1, 0xc07, 0x0, 0x0, {}, [@FOU_ATTR_IPPROTO={0x8}]}, 0x1c}}, 0x0) r3 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0xa000, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000100)={r3, &(0x7f0000000040)="7108a919a1a8efbccadac8c51fd7d51afa9e2dff96c0a36cf7a065794586067dd48f695031a55fe2cd69fcb81e6c1f682cba50f80abf976bce9af84b80388802d981e1948599520e4bb389a746064395d0738c3679749b2463e7283cb6cdeb5e99065b58788ccc9f0b8df1bdcce2c2d6725e609c6c", &(0x7f0000000240)=""/108}, 0x18) [ 561.490040] attempt to access beyond end of device [ 561.509549] loop3: rw=1, want=132, limit=112 [ 561.542448] attempt to access beyond end of device [ 561.574177] loop3: rw=1, want=133, limit=112 06:08:02 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca580500000000000000b893123f89dedb03442000000000000000000000", @ANYRES32], 0x2}, 0x1, 0x0, 0x0, 0xf0ffff}, 0x0) [ 561.598868] attempt to access beyond end of device [ 561.610264] netlink: 'syz-executor4': attribute type 3 has an invalid length. [ 561.628948] loop3: rw=1, want=142, limit=112 [ 561.644201] attempt to access beyond end of device [ 561.649162] loop3: rw=1, want=143, limit=112 06:08:02 executing program 2: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = socket$inet6(0xa, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp={0x2c, 0x0, 0x0, 0x3d}, 0x80) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r2, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000900)="b6", 0x1}], 0x1, &(0x7f00000009c0)=[{0xa0, 0x1ff, 0x800, "434c94cf096ca2c6e3a8a6433ea1ccf960ad859f9cabeb13bbcd113f89069f10afdedfc1c2c2a6455dc4d1cc5b8c42e105db6d89e5394ec484d7db74d839a1021c616111655c01f0d6840a2cc4a77a0a2613073b0d1e9ab634a70c9cafd212450fe14e5e32b6ee05d11e22515b1b820c7425d601c3c41b459046978582375e37f0268020620ba8c96a1cf8de5399"}, {0x20, 0x113, 0x3, "64bc63fb1e5bc65e5043"}], 0xc0, 0x4040000}, 0x4000040) r3 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r3, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) [ 561.672506] attempt to access beyond end of device [ 561.690181] loop3: rw=1, want=144, limit=112 [ 561.696388] attempt to access beyond end of device [ 561.701509] netlink: 'syz-executor4': attribute type 3 has an invalid length. [ 561.718625] loop3: rw=1, want=145, limit=112 06:08:02 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca580500000000000000b893123f89dedb03442000000000000000000000", @ANYRES32], 0x2}, 0x1, 0x0, 0x0, 0x82050000}, 0x0) [ 561.734535] attempt to access beyond end of device [ 561.739584] loop3: rw=1, want=793, limit=112 [ 561.745681] attempt to access beyond end of device [ 561.750633] loop2: rw=1, want=130, limit=112 [ 561.764417] attempt to access beyond end of device [ 561.769415] loop2: rw=1, want=131, limit=112 [ 561.773880] attempt to access beyond end of device [ 561.804141] loop2: rw=1, want=132, limit=112 [ 561.813509] attempt to access beyond end of device 06:08:02 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) fstatfs(r0, &(0x7f0000000080)=""/223) ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000180)=ANY=[@ANYBLOB="f80000472f9901010000000000000000000000000000"]) ioctl$KVM_SET_NR_MMU_PAGES(r1, 0xae44, 0x5) socketpair$inet(0x2, 0x1, 0x7f, &(0x7f0000000000)) openat$kvm(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/kvm\x00', 0x0, 0x0) [ 561.864728] loop2: rw=1, want=133, limit=112 [ 561.869405] attempt to access beyond end of device [ 561.955816] loop2: rw=1, want=142, limit=112 06:08:02 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca580500000000000000b893123f89dedb03442000000000000000000000", @ANYRES32], 0x2}, 0x1, 0x0, 0x0, 0xf000}, 0x0) [ 562.024140] attempt to access beyond end of device [ 562.029128] loop2: rw=1, want=143, limit=112 [ 562.033578] attempt to access beyond end of device [ 562.042313] FAT-fs (loop3): bogus number of FAT structure [ 562.087311] attempt to access beyond end of device [ 562.092300] loop5: rw=1, want=130, limit=112 [ 562.127197] attempt to access beyond end of device [ 562.132185] loop5: rw=1, want=131, limit=112 06:08:02 executing program 1: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) socket$inet6(0xa, 0x0, 0x0) r0 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp, 0x80) gettid() ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000600)}], 0x1, &(0x7f00000009c0)}, 0x0) openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x0, 0x0) sendto$unix(0xffffffffffffffff, &(0x7f0000000100), 0x0, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r0) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) [ 562.141899] FAT-fs (loop3): Can't find a valid FAT filesystem [ 562.147323] loop2: rw=1, want=144, limit=112 [ 562.155242] attempt to access beyond end of device [ 562.160372] loop2: rw=1, want=145, limit=112 [ 562.167899] attempt to access beyond end of device [ 562.168769] attempt to access beyond end of device [ 562.179932] attempt to access beyond end of device [ 562.184930] loop1: rw=1, want=130, limit=112 [ 562.189383] attempt to access beyond end of device [ 562.194819] loop2: rw=1, want=2178, limit=112 [ 562.201235] loop1: rw=1, want=131, limit=112 [ 562.202616] loop5: rw=1, want=132, limit=112 [ 562.215315] attempt to access beyond end of device [ 562.226010] attempt to access beyond end of device [ 562.229265] loop1: rw=1, want=132, limit=112 [ 562.254658] attempt to access beyond end of device [ 562.258943] loop5: rw=1, want=133, limit=112 [ 562.284927] loop1: rw=1, want=133, limit=112 [ 562.286765] attempt to access beyond end of device [ 562.289410] attempt to access beyond end of device [ 562.328709] loop5: rw=1, want=142, limit=112 [ 562.335421] loop1: rw=1, want=142, limit=112 [ 562.343672] FAT-fs (loop3): bogus number of FAT structure [ 562.355924] attempt to access beyond end of device [ 562.358755] attempt to access beyond end of device [ 562.360877] loop1: rw=1, want=143, limit=112 [ 562.360915] attempt to access beyond end of device [ 562.360932] loop1: rw=1, want=144, limit=112 [ 562.373209] loop5: rw=1, want=143, limit=112 [ 562.382597] attempt to access beyond end of device [ 562.414462] loop5: rw=1, want=144, limit=112 [ 562.425624] FAT-fs (loop3): Can't find a valid FAT filesystem [ 562.427188] attempt to access beyond end of device [ 562.444812] loop5: rw=1, want=145, limit=112 [ 562.461817] attempt to access beyond end of device [ 562.472253] attempt to access beyond end of device [ 562.477490] loop1: rw=1, want=145, limit=112 [ 562.482089] loop5: rw=1, want=2178, limit=112 [ 562.491162] attempt to access beyond end of device [ 562.499375] loop1: rw=1, want=1665, limit=112 06:08:03 executing program 3: r0 = memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x0, &(0x7f0000000140), 0x0, &(0x7f0000000340)=ANY=[]) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet6_buf(r0, 0x29, 0xca, &(0x7f00000000c0)="a2501617a7056537eef100d0057f0a27590d258173dcfc6be09b5a", 0x1b) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r2, 0x5421, 0x0) ioctl$EVIOCGBITSW(r0, 0x80404525, &(0x7f0000000100)=""/57) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x3, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)=ANY=[@ANYBLOB="00000000040000000012000000"], 0x10, 0x20040000}, 0x8001) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:08:03 executing program 5: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = socket$inet6(0xa, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp={0x2c, 0x0, 0x0, 0x3d}, 0x80) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r2, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000900)="b6d35518b48becfbd314d1fa96a307da879125869c71d40c5a385ce1d3af47c69a6acba0142b27475f2f890e1446d7e0851a8c84b5", 0x35}], 0x1, &(0x7f00000009c0)=[{0x90, 0x1ff, 0x800, "434c94cf096ca2c6e3a8a6433ea1ccf960ad859f9cabeb13bbcd113f89069f10afdedfc1c2c2a6455dc4d1cc5b8c42e105db6d89e5394ec484d7db74d839a1021c616111655c01f0d6840a2cc4a77a0a2613073b0d1e9ab634a70c9cafd212450fe14e5e32b6ee05d11e22515b1b820c7425d601c3c41b459046978582"}], 0x90, 0x4040000}, 0x4000040) openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(0xffffffffffffffff, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:08:03 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca580500000000000000b893123f89dedb03442000000000000000000000", @ANYRES32], 0x2}, 0x1, 0x0, 0x0, 0xf0}, 0x0) 06:08:03 executing program 4: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x13, 0x10, 0x3}, 0x2c) bpf$PROG_LOAD(0x5, &(0x7f0000000940)={0x1d, 0x1fffffffffffffe1, &(0x7f00000003c0)=@framed={{}, [@map={0x18, 0x0, 0x1, 0x0, r0}]}, &(0x7f0000000440)='syzkaller\x00', 0x5, 0x454, &(0x7f0000000200)=""/144}, 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000008280)={0x15, 0x2, &(0x7f0000000080)=@raw=[@map={0x18, 0x0, 0x1, 0x0, r0}], &(0x7f0000000000)='syzkaller\x00', 0x9, 0xa8, &(0x7f0000000100)=""/168}, 0x48) io_setup(0x200, &(0x7f0000000380)=0x0) r3 = syz_open_dev$admmidi(&(0x7f0000000480)='/dev/admmidi#\x00', 0x9, 0x2) r4 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000600)='/dev/ppp\x00', 0x400400, 0x0) socketpair(0x11, 0x80000, 0xffffffffffff0000, &(0x7f0000000700)={0xffffffffffffffff}) r6 = request_key(&(0x7f00000007c0)='cifs.idmap\x00', &(0x7f0000000800)={'syz', 0x1}, &(0x7f0000000840)='/dev/dsp#\x00', 0xffffffffffffffff) keyctl$restrict_keyring(0x1d, r6, &(0x7f0000000880)='dns_resolver\x00', &(0x7f00000008c0)='syzkaller\x00') io_submit(r2, 0x3, &(0x7f0000000780)=[&(0x7f00000004c0)={0x0, 0x0, 0x0, 0x3, 0x3, r1, &(0x7f0000000400)="fdb16562c29dba67b0", 0x9, 0xad, 0x0, 0x2, r3}, &(0x7f0000000640)={0x0, 0x0, 0x0, 0x6, 0xffffffff00000000, r0, &(0x7f0000000500)="235ee6e8a99672b9d818e2fceb4970e1a65b318503e2233bf4fc855c53cd296569afbe469bbb90f9dcb0333236e229de332ceb51c61f5568bd6ca59f9b293b979bfcd31ac3aa794d7190de4196469400faea8b745806e28d14d7550b1151f52b391e61ef954595c7356ad182cc07cacf1c6fa20b4e5e2dee92a87c150e449d03b4d04edd814bb572665de472d9d64d0e16dfca40ec0b296d972708219506ac183090435908b13c945d561b5d10d9d0225d305af3bd4694e3145a642ad84a504412", 0xc1, 0x34ea, 0x0, 0x0, r4}, &(0x7f0000000740)={0x0, 0x0, 0x0, 0x5, 0x5309, r0, &(0x7f0000000680)="240e70126022469c1e8276a97d4f93aaf06ff9979c4d4fe327ab4e8d32917b70dbbab253faadd96e4a235202889935681a00ba237d6db17ef78f2add3c6770e44b8e6620", 0x44, 0x524, 0x0, 0x2, r5}]) open$dir(&(0x7f00000000c0)='./file0\x00', 0x2000, 0x40) r7 = syz_open_dev$dspn(&(0x7f00000001c0)='/dev/dsp#\x00', 0x2, 0x240) getsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(0xffffffffffffff9c, 0x84, 0x22, &(0x7f00000002c0)={0x2, 0x0, 0x4, 0x7, 0x0}, &(0x7f0000000300)=0x10) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000900)) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER_VALUE(r7, 0x84, 0x7c, &(0x7f0000000340)={r8, 0x6, 0xed}, 0x8) 06:08:03 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca580500000000000000b893123f89dedb03442000000000000000000000", @ANYRES32], 0x2}, 0x1, 0x0, 0x0, 0x2}, 0x0) 06:08:03 executing program 2: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = socket$inet6(0xa, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp={0x2c, 0x0, 0x0, 0x3d}, 0x80) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r2, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000900)="b6", 0x1}], 0x1, &(0x7f00000009c0)=[{0xa0, 0x1ff, 0x800, "434c94cf096ca2c6e3a8a6433ea1ccf960ad859f9cabeb13bbcd113f89069f10afdedfc1c2c2a6455dc4d1cc5b8c42e105db6d89e5394ec484d7db74d839a1021c616111655c01f0d6840a2cc4a77a0a2613073b0d1e9ab634a70c9cafd212450fe14e5e32b6ee05d11e22515b1b820c7425d601c3c41b459046978582375e37f0268020620ba8c96a1cf8de5399"}, {0x20, 0x113, 0x3, "64bc63fb1e5bc65e5043"}], 0xc0, 0x4040000}, 0x4000040) r3 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r3, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) [ 562.670162] attempt to access beyond end of device [ 562.697959] loop2: rw=1, want=130, limit=112 [ 562.702504] attempt to access beyond end of device [ 562.732655] loop2: rw=1, want=131, limit=112 [ 562.751340] attempt to access beyond end of device [ 562.791548] FAT-fs (loop3): bogus number of reserved sectors [ 562.799201] loop2: rw=1, want=132, limit=112 [ 562.827638] attempt to access beyond end of device 06:08:03 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca580500000000000000b893123f89dedb03442000000000000000000000", @ANYRES32], 0x2}, 0x1, 0x0, 0x0, 0x8205000000000000}, 0x0) [ 562.852931] loop2: rw=1, want=133, limit=112 [ 562.868385] FAT-fs (loop3): Can't find a valid FAT filesystem [ 562.883328] attempt to access beyond end of device [ 562.953900] loop2: rw=1, want=142, limit=112 06:08:03 executing program 4: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="153f6234488dd25d766070") syz_emit_ethernet(0x4a, &(0x7f0000000080)=ANY=[@ANYBLOB="0180c200000000000000000086dd603f3a5400142f00fe8000000800000000000000000000bbff0200000000000000000000000000010000883e", @ANYRES32=0x41424344, @ANYRES32=0x41424344, @ANYBLOB="0900000080780000"], &(0x7f00000004c0)) 06:08:03 executing program 1: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) socket$inet6(0xa, 0x0, 0x0) r0 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp, 0x80) gettid() ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000600)}], 0x1, &(0x7f00000009c0)}, 0x0) openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x0, 0x0) sendto$unix(0xffffffffffffffff, &(0x7f0000000100), 0x0, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r0) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) [ 562.978963] attempt to access beyond end of device 06:08:03 executing program 5: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = socket$inet6(0xa, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp={0x2c, 0x0, 0x0, 0x3d}, 0x80) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r2, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000900)="b6d35518b48becfbd314d1fa96a307da879125869c71d40c5a385ce1d3af47c69a6acba0142b27475f2f890e1446d7e0851a8c84b5", 0x35}], 0x1, &(0x7f00000009c0)=[{0x90, 0x1ff, 0x800, "434c94cf096ca2c6e3a8a6433ea1ccf960ad859f9cabeb13bbcd113f89069f10afdedfc1c2c2a6455dc4d1cc5b8c42e105db6d89e5394ec484d7db74d839a1021c616111655c01f0d6840a2cc4a77a0a2613073b0d1e9ab634a70c9cafd212450fe14e5e32b6ee05d11e22515b1b820c7425d601c3c41b459046978582"}], 0x90, 0x4040000}, 0x4000040) r3 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r3, &(0x7f0000000100), 0x0, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) [ 563.011041] loop2: rw=1, want=143, limit=112 [ 563.030574] attempt to access beyond end of device 06:08:03 executing program 3: memfd_create(&(0x7f0000000080)='iocharset', 0x0) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r1, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x3, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)=[{0x10, 0x107, 0x5}], 0x10, 0x20040000}, 0x8001) sendto$unix(0xffffffffffffffff, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r0) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:08:03 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca580500000000000000b893123f89dedb03442000000000000000000000", @ANYRES32], 0x2}, 0x1, 0x0, 0x0, 0x9effffff00000000}, 0x0) [ 563.057659] loop2: rw=1, want=144, limit=112 [ 563.062142] attempt to access beyond end of device [ 563.063178] ip6_tunnel: non-ECT from fe80:0000:0800:0000:0000:0000:0000:00bb with DS=0x3 [ 563.075595] loop2: rw=1, want=145, limit=112 [ 563.083328] attempt to access beyond end of device [ 563.087774] ip6_tunnel: non-ECT from fe80:0000:0800:0000:0000:0000:0000:00bb with DS=0x3 [ 563.099973] loop2: rw=1, want=2178, limit=112 06:08:03 executing program 4: r0 = perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket(0x1e, 0x2, 0x0) setsockopt$packet_tx_ring(r1, 0x10f, 0x87, &(0x7f0000000040)=@req3={0x80000000}, 0xfeda) ioctl$PERF_EVENT_IOC_MODIFY_ATTRIBUTES(r0, 0x4008240b, &(0x7f0000000080)={0x6, 0x70, 0x4, 0x80000000, 0x5, 0xfff, 0x0, 0x8000, 0x20, 0xd, 0xffffffffffff8001, 0x5, 0xffffffff, 0x200, 0x7f, 0x6, 0x200, 0xffffffff, 0x5, 0x0, 0x4, 0xb7, 0x100000000, 0xffffffffd49742f5, 0x2, 0x6600, 0x3, 0x4a8fc421, 0x1, 0x0, 0x29c, 0x20, 0x800, 0x7f, 0x4, 0x0, 0x5, 0x3, 0x0, 0xffffffffffffffff, 0x1, @perf_config_ext={0x9, 0x80000000}, 0x2102, 0xffffffffffffffb1, 0x6, 0x7, 0x800, 0x8, 0x2}) r2 = socket(0x1e, 0x805, 0x0) setsockopt$packet_tx_ring(r2, 0x10f, 0x87, &(0x7f0000000040)=@req3={0x80000000}, 0xfeda) dup3(r1, r2, 0x0) 06:08:04 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca580500000000000000b893123f89dedb03442000000000000000000000", @ANYRES32], 0x2}, 0x1, 0x0, 0x0, 0x2000000}, 0x0) 06:08:04 executing program 3: r0 = memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r2, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x3, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)=[{0x10, 0x107, 0x5}], 0x10, 0x20040000}, 0x8001) write$P9_RREADLINK(r0, &(0x7f0000000080)=ANY=[@ANYBLOB="1c0000002e2f66696c65302f66696c65302f66696c65300000000000"], 0x1c) socketpair(0x9, 0xa, 0x3ff, &(0x7f00000000c0)) sendto$unix(0xffffffffffffffff, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:08:04 executing program 5: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = socket$inet6(0xa, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp={0x2c, 0x0, 0x0, 0x3d}, 0x80) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r2, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000900)="b6d35518b48becfbd314d1fa96a307da879125869c71d40c5a385ce1d3af47c69a6acba0142b27475f2f890e1446d7e0851a8c84b5", 0x35}], 0x1, &(0x7f00000009c0)=[{0x90, 0x1ff, 0x800, "434c94cf096ca2c6e3a8a6433ea1ccf960ad859f9cabeb13bbcd113f89069f10afdedfc1c2c2a6455dc4d1cc5b8c42e105db6d89e5394ec484d7db74d839a1021c616111655c01f0d6840a2cc4a77a0a2613073b0d1e9ab634a70c9cafd212450fe14e5e32b6ee05d11e22515b1b820c7425d601c3c41b459046978582"}], 0x90, 0x4040000}, 0x4000040) r3 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r3, &(0x7f0000000100), 0x0, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:08:04 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca580500000000000000b893123f89dedb03442000000000000000000000", @ANYRES32], 0x2}, 0x1, 0x0, 0x0, 0x9effffff}, 0x0) [ 563.556693] attempt to access beyond end of device [ 563.561684] loop3: rw=1, want=130, limit=112 [ 563.570280] attempt to access beyond end of device [ 563.580995] loop3: rw=1, want=131, limit=112 [ 563.593394] attempt to access beyond end of device [ 563.634575] loop3: rw=1, want=132, limit=112 [ 563.670669] attempt to access beyond end of device [ 563.696170] loop3: rw=1, want=133, limit=112 [ 563.719933] attempt to access beyond end of device [ 563.735965] loop3: rw=1, want=142, limit=112 [ 563.740614] attempt to access beyond end of device [ 563.777768] loop3: rw=1, want=143, limit=112 [ 563.798290] attempt to access beyond end of device 06:08:04 executing program 2: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = socket$inet6(0xa, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp={0x2c, 0x0, 0x0, 0x3d}, 0x80) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r2, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000900)="b6", 0x1}], 0x1, &(0x7f00000009c0)=[{0xa0, 0x1ff, 0x800, "434c94cf096ca2c6e3a8a6433ea1ccf960ad859f9cabeb13bbcd113f89069f10afdedfc1c2c2a6455dc4d1cc5b8c42e105db6d89e5394ec484d7db74d839a1021c616111655c01f0d6840a2cc4a77a0a2613073b0d1e9ab634a70c9cafd212450fe14e5e32b6ee05d11e22515b1b820c7425d601c3c41b459046978582375e37f0268020620ba8c96a1cf8de5399"}, {0x20, 0x113, 0x3, "64bc63fb1e5bc65e5043"}], 0xc0, 0x4040000}, 0x4000040) r3 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r3, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:08:04 executing program 4: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000000c0)='./cgroup.net/syz1\x00', 0x200002, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f00000001c0)='cgroup.threads\x00', 0x2, 0x0) readv(r1, &(0x7f0000000040)=[{&(0x7f0000000000)=""/41, 0x29}], 0x1) close(r1) [ 563.829448] loop3: rw=1, want=144, limit=112 [ 563.865764] attempt to access beyond end of device [ 563.870739] loop2: rw=1, want=130, limit=112 [ 563.875728] attempt to access beyond end of device [ 563.898233] attempt to access beyond end of device [ 563.910340] loop3: rw=1, want=145, limit=112 [ 563.931788] attempt to access beyond end of device [ 563.937518] loop2: rw=1, want=131, limit=112 [ 563.950289] attempt to access beyond end of device [ 563.955937] loop3: rw=1, want=201, limit=112 [ 563.963639] loop2: rw=1, want=132, limit=112 [ 563.972388] attempt to access beyond end of device [ 563.978589] loop2: rw=1, want=133, limit=112 [ 563.983173] attempt to access beyond end of device [ 563.988736] loop2: rw=1, want=142, limit=112 [ 563.993332] attempt to access beyond end of device [ 563.998858] loop2: rw=1, want=143, limit=112 [ 564.003436] attempt to access beyond end of device [ 564.008902] loop2: rw=1, want=144, limit=112 [ 564.013485] attempt to access beyond end of device 06:08:04 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca580500000000000000b893123f89dedb03442000000000000000000000", @ANYRES32], 0x2}, 0x1, 0x0, 0x0, 0xf0ffffff}, 0x0) 06:08:04 executing program 4: r0 = perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) close(r0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) getrlimit(0x400000000002, &(0x7f0000000080)) pipe2(&(0x7f0000000000)={0xffffffffffffffff}, 0x4000) ioctl$NBD_SET_SIZE_BLOCKS(r1, 0xab07, 0xa1) 06:08:04 executing program 1: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) socket$inet6(0xa, 0x0, 0x0) r0 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp, 0x80) gettid() ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000600)}], 0x1, &(0x7f00000009c0)}, 0x0) openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x0, 0x0) sendto$unix(0xffffffffffffffff, &(0x7f0000000100), 0x0, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r0) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) [ 564.033449] loop2: rw=1, want=145, limit=112 [ 564.070170] attempt to access beyond end of device [ 564.084987] attempt to access beyond end of device [ 564.089953] loop1: rw=1, want=130, limit=112 [ 564.096854] loop2: rw=1, want=201, limit=112 [ 564.107850] attempt to access beyond end of device [ 564.151751] loop1: rw=1, want=131, limit=112 [ 564.176605] attempt to access beyond end of device 06:08:05 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca580500000000000000b893123f89dedb03442000000000000000000000", @ANYRES32], 0x2}, 0x1, 0x0, 0x0, 0xffffff9e}, 0x0) [ 564.246994] loop1: rw=1, want=132, limit=112 06:08:05 executing program 4: socket$kcm(0x29, 0x2, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)) setrlimit(0x100000000000007, &(0x7f0000000140)={0x1, 0x1f}) r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = memfd_create(&(0x7f0000000000)='user\x00', 0x1) ioctl$KVM_ENABLE_CAP_CPU(r1, 0x4068aea3, &(0x7f00000000c0)={0x7b, 0x0, [0xffffffffffffffc1, 0x7, 0xdc, 0x6]}) ioctl(r0, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") r2 = socket$unix(0x1, 0x1, 0x0) r3 = socket$unix(0x1, 0x1, 0x0) setsockopt$sock_int(r3, 0x1, 0x22, &(0x7f000018effc)=0x1c, 0x4) bind$unix(r3, &(0x7f0000003000)=@file={0x1, "e91f7189591e9233614b00"}, 0xc) listen(r3, 0x0) connect$unix(r2, &(0x7f000066fff4)=@file={0x1, "e91f7189591e9233614b00"}, 0xc) accept4$unix(r3, &(0x7f000046f000)=@abs, &(0x7f0000937000)=0x8, 0x0) syz_init_net_socket$llc(0x1a, 0x1, 0x0) [ 564.317608] attempt to access beyond end of device [ 564.344296] loop1: rw=1, want=133, limit=112 [ 564.348848] attempt to access beyond end of device [ 564.359402] loop1: rw=1, want=142, limit=112 [ 564.363929] attempt to access beyond end of device [ 564.369044] loop1: rw=1, want=143, limit=112 [ 564.374874] attempt to access beyond end of device [ 564.385480] loop1: rw=1, want=144, limit=112 [ 564.399734] attempt to access beyond end of device [ 564.410024] loop1: rw=1, want=145, limit=112 [ 564.420035] attempt to access beyond end of device 06:08:05 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca580500000000000000b893123f89dedb03442000000000000000000000", @ANYRES32], 0x2}, 0x1, 0x0, 0x0, 0xffffff7f00000000}, 0x0) [ 564.455057] loop1: rw=1, want=1001, limit=112 06:08:05 executing program 5: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = socket$inet6(0xa, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp={0x2c, 0x0, 0x0, 0x3d}, 0x80) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r2, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000900)="b6d35518b48becfbd314d1fa96a307da879125869c71d40c5a385ce1d3af47c69a6acba0142b27475f2f890e1446d7e0851a8c84b5", 0x35}], 0x1, &(0x7f00000009c0)=[{0x90, 0x1ff, 0x800, "434c94cf096ca2c6e3a8a6433ea1ccf960ad859f9cabeb13bbcd113f89069f10afdedfc1c2c2a6455dc4d1cc5b8c42e105db6d89e5394ec484d7db74d839a1021c616111655c01f0d6840a2cc4a77a0a2613073b0d1e9ab634a70c9cafd212450fe14e5e32b6ee05d11e22515b1b820c7425d601c3c41b459046978582"}], 0x90, 0x4040000}, 0x4000040) r3 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r3, &(0x7f0000000100), 0x0, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) [ 564.605084] attempt to access beyond end of device [ 564.610409] loop5: rw=1, want=130, limit=112 [ 564.641147] attempt to access beyond end of device [ 564.663938] loop5: rw=1, want=131, limit=112 [ 564.684714] attempt to access beyond end of device [ 564.721673] loop5: rw=1, want=132, limit=112 [ 564.746482] attempt to access beyond end of device [ 564.751455] loop5: rw=1, want=133, limit=112 [ 564.775835] attempt to access beyond end of device [ 564.781063] loop5: rw=1, want=142, limit=112 [ 564.785794] attempt to access beyond end of device [ 564.790911] loop5: rw=1, want=143, limit=112 [ 564.795736] attempt to access beyond end of device [ 564.800844] loop5: rw=1, want=144, limit=112 [ 564.821015] attempt to access beyond end of device [ 564.838106] loop5: rw=1, want=145, limit=112 [ 564.859543] attempt to access beyond end of device [ 564.888321] loop5: rw=1, want=1033, limit=112 06:08:05 executing program 2: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = socket$inet6(0xa, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp={0x2c, 0x0, 0x0, 0x3d}, 0x80) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r2, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000900)="b6", 0x1}], 0x1, &(0x7f00000009c0)=[{0xa0, 0x1ff, 0x800, "434c94cf096ca2c6e3a8a6433ea1ccf960ad859f9cabeb13bbcd113f89069f10afdedfc1c2c2a6455dc4d1cc5b8c42e105db6d89e5394ec484d7db74d839a1021c616111655c01f0d6840a2cc4a77a0a2613073b0d1e9ab634a70c9cafd212450fe14e5e32b6ee05d11e22515b1b820c7425d601c3c41b459046978582375e37f0268020620ba8c96a1cf8de5399"}, {0x20, 0x113, 0x3, "64bc63fb1e5bc65e5043"}], 0xc0, 0x4040000}, 0x4000040) r3 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r3, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:08:05 executing program 4: syz_emit_ethernet(0xd0, &(0x7f0000000080)={@dev={[], 0x16}, @dev={[], 0xf}, [], {@mpls_uc={0x8847, {[{0x5, 0x400, 0x8001, 0x1}], @llc={@llc={0x46, 0xff, "7c8e", "045dc0076bf48f14127df0a58bf4d862cd3a4b845516a0f920d5d01004ac337c9ec3587367e810a510f46815c9ab4f234a474f43e6246fb0bab78a6b81d47189de4a750d09190d37c574191a3afa8f7356d2d94852898b33cd1c9f373cb392bd853fae9dd32213d112753cd70dd6d67546137a7775dbb0b62b8c68e93b1703740ed3707c8aff8f79e375ce2588b2c2dfeaf010aa6ccefc86d8719c075a25b1767811dbbbc5922f1f941ff808736cd7f411de85f0951681c1fddb"}}}}}}, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000346fd4)={0x0, 0x0, 0x0, 0x102d}, 0xfffffffffffffe9f) ioctl$TIOCGPGRP(0xffffffffffffff9c, 0x540f, &(0x7f0000000000)=0x0) ptrace$getsig(0x4202, r0, 0x1f, &(0x7f0000000040)) r1 = socket(0x11, 0x80000, 0x22) getsockopt$inet_sctp_SCTP_HMAC_IDENT(r1, 0x84, 0x16, &(0x7f0000000180)={0x9, [0x7c00000000, 0x6, 0x9, 0x7, 0x5, 0xbbc7, 0x1, 0xbe, 0x8000000]}, &(0x7f00000001c0)=0x16) bpf$PROG_LOAD(0x5, &(0x7f00000ba000)={0x6, 0x5, &(0x7f0000346fc8)=@framed={{}, [@alu={0x8000000201a7f19, 0x0, 0x201a7fa6, 0x0, 0x1, 0x1085}]}, &(0x7f0000f6bffb)='GPL\x00', 0x1, 0x3bc, &(0x7f00001a7f05)=""/251}, 0x2e) 06:08:05 executing program 3: r0 = memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f0000000080)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x44083, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x81, 0x3, 0x0, 0x0, 0x0, 0x0, 0x401, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r2, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x3, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)=[{0x10, 0x107, 0x5}], 0x10, 0x20040000}, 0x8001) sendto$unix(0xffffffffffffffff, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) r3 = ioctl$LOOP_CTL_GET_FREE(r1, 0x4c82) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, r3) fchdir(r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:08:05 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca580500000000000000b893123f89dedb03442000000000000000000000", @ANYRES32], 0x2}, 0x1, 0x0, 0x0, 0xf0ffffffffffff}, 0x0) 06:08:05 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca580500000000000000b893123f89dedb03442000000000000000000000", @ANYRES32], 0x2}, 0x1, 0x0, 0x0, 0x100000000000000}, 0x0) 06:08:05 executing program 4: pipe2$9p(&(0x7f0000000100), 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 06:08:05 executing program 2: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = socket$inet6(0xa, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp={0x2c, 0x0, 0x0, 0x3d}, 0x80) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r2, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000900)="b6", 0x1}], 0x1, &(0x7f00000009c0)=[{0xa0, 0x1ff, 0x800, "434c94cf096ca2c6e3a8a6433ea1ccf960ad859f9cabeb13bbcd113f89069f10afdedfc1c2c2a6455dc4d1cc5b8c42e105db6d89e5394ec484d7db74d839a1021c616111655c01f0d6840a2cc4a77a0a2613073b0d1e9ab634a70c9cafd212450fe14e5e32b6ee05d11e22515b1b820c7425d601c3c41b459046978582375e37f0268020620ba8c96a1cf8de5399"}, {0x20, 0x113, 0x3, "64bc63fb1e5bc65e5043"}], 0xc0, 0x4040000}, 0x4000040) r3 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r3, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:08:06 executing program 1: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) socket$inet6(0xa, 0x0, 0x0) r0 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp, 0x80) gettid() ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000600)}], 0x1, &(0x7f00000009c0)}, 0x0) openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x0, 0x0) sendto$unix(0xffffffffffffffff, &(0x7f0000000100), 0x0, 0x0, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r0) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:08:06 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca580500000000000000b893123f89dedb03442000000000000000000000", @ANYRES32], 0x2}, 0x1, 0x0, 0x0, 0xf0ffffff00000000}, 0x0) 06:08:06 executing program 3: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r1, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x3, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)=[{0x10, 0x107, 0x5}], 0x10, 0x20040000}, 0x8001) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000080)={{0x7, 0x6}, 0x1, 0xfffffffffffffffd, 0x100000000, {0xffffffffffffff7b, 0x7}, 0x1, 0x6}) sendto$unix(0xffffffffffffffff, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r0) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:08:06 executing program 4: syz_emit_ethernet(0x72, &(0x7f0000000180)={@link_local, @link_local, [], {@ipv4={0x800, {{0x8, 0x4, 0x0, 0x0, 0x64, 0x0, 0x0, 0x0, 0x0, 0x0, @rand_addr, @rand_addr, {[@timestamp={0x44, 0xc, 0x6, 0x3, 0x0, [{[@multicast1]}]}]}}, @gre}}}}, &(0x7f0000000040)) r0 = syz_open_dev$admmidi(&(0x7f0000000000)='/dev/admmidi#\x00', 0x2, 0x0) ioctl$KVM_S390_VCPU_FAULT(r0, 0x4008ae52, &(0x7f0000000080)=0x6) 06:08:06 executing program 5: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = socket$inet6(0xa, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp={0x2c, 0x0, 0x0, 0x3d}, 0x80) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r2, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000900)="b6d35518b48becfbd314d1fa96a307da879125869c71d40c5a385ce1d3af47c69a6acba0142b27475f2f890e1446d7e0851a8c84b5", 0x35}], 0x1, &(0x7f00000009c0)=[{0x90, 0x1ff, 0x800, "434c94cf096ca2c6e3a8a6433ea1ccf960ad859f9cabeb13bbcd113f89069f10afdedfc1c2c2a6455dc4d1cc5b8c42e105db6d89e5394ec484d7db74d839a1021c616111655c01f0d6840a2cc4a77a0a2613073b0d1e9ab634a70c9cafd212450fe14e5e32b6ee05d11e22515b1b820c7425d601c3c41b459046978582"}], 0x90, 0x4040000}, 0x4000040) r3 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r3, &(0x7f0000000100)="9b0f3bc6445750cd60df6190", 0xc, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:08:06 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca580500000000000000b893123f89dedb03442000000000000000000000", @ANYRES32], 0x2}, 0x1, 0x0, 0x0, 0xffffff7f}, 0x0) [ 565.496656] attempt to access beyond end of device [ 565.501649] loop1: rw=1, want=130, limit=112 [ 565.513711] buffer_io_error: 86 callbacks suppressed [ 565.513721] Buffer I/O error on dev loop1, logical block 129, lost async page write [ 565.538814] attempt to access beyond end of device 06:08:06 executing program 4: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) madvise(&(0x7f000079c000/0x800000)=nil, 0x800000, 0xc) mlock(&(0x7f00009c0000/0xf000)=nil, 0xf000) r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") madvise(&(0x7f00002f8000/0xc00000)=nil, 0xc00000, 0xd) mbind(&(0x7f000072c000/0x2000)=nil, 0x2000, 0x4001, &(0x7f0000000000)=0x8, 0x3, 0x6) 06:08:06 executing program 2: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = socket$inet6(0xa, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp={0x2c, 0x0, 0x0, 0x3d}, 0x80) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r2, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000900)="b6", 0x1}], 0x1, &(0x7f00000009c0)=[{0xa0, 0x1ff, 0x800, "434c94cf096ca2c6e3a8a6433ea1ccf960ad859f9cabeb13bbcd113f89069f10afdedfc1c2c2a6455dc4d1cc5b8c42e105db6d89e5394ec484d7db74d839a1021c616111655c01f0d6840a2cc4a77a0a2613073b0d1e9ab634a70c9cafd212450fe14e5e32b6ee05d11e22515b1b820c7425d601c3c41b459046978582375e37f0268020620ba8c96a1cf8de5399"}, {0x20, 0x113, 0x3, "64bc63fb1e5bc65e5043"}], 0xc0, 0x4040000}, 0x4000040) r3 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r3, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) [ 565.544039] loop1: rw=1, want=131, limit=112 [ 565.548766] Buffer I/O error on dev loop1, logical block 130, lost async page write [ 565.556849] attempt to access beyond end of device [ 565.561785] loop1: rw=1, want=132, limit=112 [ 565.566567] Buffer I/O error on dev loop1, logical block 131, lost async page write [ 565.574449] attempt to access beyond end of device [ 565.574463] loop1: rw=1, want=133, limit=112 [ 565.574489] Buffer I/O error on dev loop1, logical block 132, lost async page write [ 565.574521] attempt to access beyond end of device [ 565.574533] loop1: rw=1, want=142, limit=112 [ 565.574546] Buffer I/O error on dev loop1, logical block 141, lost async page write [ 565.574574] attempt to access beyond end of device [ 565.574586] loop1: rw=1, want=143, limit=112 [ 565.574599] Buffer I/O error on dev loop1, logical block 142, lost async page write [ 565.574626] attempt to access beyond end of device 06:08:06 executing program 4: bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000000)={0xffffffffffffffff, 0x50, &(0x7f0000000100)={0x0, 0x0}}, 0x10) bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f00000001c0)=r0, 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x13, &(0x7f00000000c0)=0x100000001, 0x1d4) connect$inet6(r1, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f0000000040)='tls\x00', 0x13a) getsockopt$inet6_tcp_buf(r1, 0x11a, 0x1, &(0x7f0000001680)=""/4096, &(0x7f0000000180)=0x1000) 06:08:06 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca580500000000000000b893123f89dedb03442000000000000000000000", @ANYRES32], 0x2}, 0x1, 0x0, 0x0, 0x0}, 0x0) 06:08:06 executing program 3: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$TIOCSSOFTCAR(r0, 0x541a, &(0x7f0000000080)=0x2b3) r1 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r1, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x3, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)=[{0x10, 0x107, 0x5}], 0x10, 0x20040000}, 0x8001) sendto$unix(0xffffffffffffffff, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_GET_FREE(r1, 0x4c82) r2 = ioctl$LOOP_CTL_GET_FREE(r1, 0x4c82) ioctl$LOOP_CTL_REMOVE(r1, 0x4c81, r2) fchdir(r0) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) [ 565.886698] loop1: rw=1, want=144, limit=112 [ 565.902187] Buffer I/O error on dev loop1, logical block 143, lost async page write [ 565.926655] attempt to access beyond end of device 06:08:06 executing program 4: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) bind$netlink(r0, &(0x7f0000000000)={0x10, 0x0, 0x0, 0x200}, 0xc) r1 = syz_open_dev$vcsn(&(0x7f0000000100)='/dev/vcs#\x00', 0x0, 0x185000) setsockopt$XDP_TX_RING(r1, 0x11b, 0x3, &(0x7f0000000300), 0x4) rt_sigpending(&(0x7f00000000c0), 0x8) ioctl$KVM_GET_MSRS(r1, 0xc008ae88, &(0x7f0000000400)=ANY=[@ANYBLOB="0200000000000000000000000000000000ef071f8f000000000000000000000000"]) setsockopt$netlink_NETLINK_LISTEN_ALL_NSID(r0, 0x10e, 0x8, &(0x7f0000000140)=0x4, 0x4) getsockopt$inet_sctp6_SCTP_DELAYED_SACK(r1, 0x84, 0x10, &(0x7f00000001c0)=@sack_info={0x0, 0x5, 0x7}, &(0x7f0000000380)=0xc) getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r1, 0x84, 0x1a, &(0x7f00000004c0)={r2, 0xa1, "cffd80d02ed494bc57fb6d1f6218dbca2d85fc4191129e38ef68bcc946e8334bec91ad1524fae713c677f6e8c62c6bed14457ec6ca98e9e2648d6cc3900087e2eee4ca740ed2d7d74e25f400f293ccd1e53c7f912af52bbbfeab2c1798984f0ae560d4aea3564a233c6d06bad5e7582f9436f1c2448ed6064f4d64820d6496a29996748bb1723bca62bf0496b02d0812c79a4541fa0f21c643805e3407690acdf6"}, &(0x7f00000003c0)=0xa9) ioctl$VT_SETMODE(r1, 0x5602, &(0x7f0000000180)={0x9, 0x0, 0x7fff, 0xffffffffffff8001, 0x80}) write$binfmt_elf32(r0, &(0x7f0000000200)={{0x7f, 0x45, 0x4c, 0x46, 0x1ff, 0x4, 0x80, 0xffffffffffffffff, 0x100, 0x2, 0x6, 0x7, 0xa9, 0x38, 0x3c, 0xdd1, 0x7fffffff, 0x20, 0x1, 0x5, 0xe43, 0x3}, [{0x4, 0x9, 0x3e, 0xffffffffffffff7f, 0x3f, 0x0, 0x9, 0x676bdc40}], "17c411c394aad15fe555556e512c5404a93f2144da9e4063a9c5d0ade37e19f69b0ee17f4c98e94b4518e31d37e2001341e58884e5019700042cd526e8c5da7e7593b5f874f7163b9b6607496bc6845be0cba818cdb358a839e83722c80f33d597cc9c961a7081c2c93ca6159aaa2499a86f5ad7dcc384b8e9b091adc340d2a5b58d766807b069ba5ab628004555d479031494db9f73dc0c2c"}, 0xf1) sendmsg$nl_generic(r0, &(0x7f0000000340)={&(0x7f0000000480)={0x10, 0xbb7f}, 0xc, &(0x7f0000000440)={&(0x7f0000000180)=ANY=[]}, 0x1, 0x0, 0x0, 0x44000}, 0x4008000) [ 565.936817] loop1: rw=1, want=145, limit=112 [ 565.941438] Buffer I/O error on dev loop1, logical block 144, lost async page write [ 565.953575] attempt to access beyond end of device [ 565.962975] loop1: rw=1, want=1465, limit=112 [ 566.336259] attempt to access beyond end of device [ 566.341244] loop5: rw=1, want=130, limit=112 [ 566.341262] Buffer I/O error on dev loop5, logical block 129, lost async page write [ 566.341299] attempt to access beyond end of device [ 566.341311] loop5: rw=1, want=131, limit=112 [ 566.341333] Buffer I/O error on dev loop5, logical block 130, lost async page write [ 566.341364] attempt to access beyond end of device [ 566.355020] loop5: rw=1, want=132, limit=112 [ 566.355068] attempt to access beyond end of device [ 566.355080] loop5: rw=1, want=133, limit=112 [ 566.355112] attempt to access beyond end of device [ 566.355124] loop5: rw=1, want=142, limit=112 [ 566.355157] attempt to access beyond end of device [ 566.355169] loop5: rw=1, want=143, limit=112 [ 566.355200] attempt to access beyond end of device [ 566.355211] loop5: rw=1, want=144, limit=112 [ 566.355243] attempt to access beyond end of device [ 566.355255] loop5: rw=1, want=145, limit=112 [ 566.358955] attempt to access beyond end of device [ 566.366534] attempt to access beyond end of device [ 566.373143] loop5: rw=1, want=2178, limit=112 [ 566.382448] loop2: rw=1, want=130, limit=112 [ 566.448760] attempt to access beyond end of device [ 566.453849] loop2: rw=1, want=131, limit=112 [ 566.458461] attempt to access beyond end of device [ 566.463652] loop2: rw=1, want=132, limit=112 [ 566.468597] attempt to access beyond end of device [ 566.473551] loop2: rw=1, want=133, limit=112 [ 566.478838] attempt to access beyond end of device [ 566.483968] loop2: rw=1, want=142, limit=112 [ 566.488485] attempt to access beyond end of device [ 566.493427] loop2: rw=1, want=143, limit=112 [ 566.497904] attempt to access beyond end of device [ 566.502840] loop2: rw=1, want=144, limit=112 [ 566.507329] attempt to access beyond end of device [ 566.512263] loop2: rw=1, want=145, limit=112 [ 566.518877] attempt to access beyond end of device [ 566.523805] loop2: rw=1, want=2178, limit=112 06:08:07 executing program 1: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) socket$inet6(0xa, 0x0, 0x0) r0 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp, 0x80) gettid() ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000600)}], 0x1, &(0x7f00000009c0)}, 0x0) openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x0, 0x0) sendto$unix(0xffffffffffffffff, &(0x7f0000000100), 0x0, 0x0, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r0) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:08:07 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca580500000000000000b893123f89dedb03442000000000000000000000", @ANYRES32], 0x2}, 0x1, 0x0, 0x0, 0x0}, 0x0) 06:08:07 executing program 5: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = socket$inet6(0xa, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp={0x2c, 0x0, 0x0, 0x3d}, 0x80) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r2, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000900)="b6d35518b48becfbd314d1fa96a307da879125869c71d40c5a385ce1d3af47c69a6acba0142b27475f2f890e1446d7e0851a8c84b5", 0x35}], 0x1, &(0x7f00000009c0)=[{0x90, 0x1ff, 0x800, "434c94cf096ca2c6e3a8a6433ea1ccf960ad859f9cabeb13bbcd113f89069f10afdedfc1c2c2a6455dc4d1cc5b8c42e105db6d89e5394ec484d7db74d839a1021c616111655c01f0d6840a2cc4a77a0a2613073b0d1e9ab634a70c9cafd212450fe14e5e32b6ee05d11e22515b1b820c7425d601c3c41b459046978582"}], 0x90, 0x4040000}, 0x4000040) r3 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r3, &(0x7f0000000100)="9b0f3bc6445750cd60df6190", 0xc, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:08:07 executing program 4: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000100)='net/tcp6\x00') r2 = socket$inet6(0xa, 0x1, 0x8010000000000084) ioctl$sock_inet_SIOCGIFDSTADDR(r2, 0x8917, &(0x7f0000000000)={'bpq0\x00', {0x2, 0x0, @multicast2}}) bind$inet6(r2, &(0x7f0000ef8cfd)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) listen(r2, 0x4) r3 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) socket$inet6(0xa, 0x0, 0x0) mmap(&(0x7f0000003000/0x2000)=nil, 0x2000, 0x0, 0x1012, r3, 0x0) write$tun(r3, &(0x7f00000000c0)=ANY=[], 0x0) r4 = perf_event_open(&(0x7f0000000180)={0x6, 0x70}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mlockall(0x3) close(r4) sendto$inet6(0xffffffffffffffff, &(0x7f0000e33fe0)='X', 0x1, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) setsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f00000005c0)=0x5, 0x4) setgid(0x0) r5 = accept4(r2, 0x0, &(0x7f0000000040), 0x0) r6 = request_key(&(0x7f0000000680)='id_legacy\x00', &(0x7f00000006c0)={'syz', 0x3}, &(0x7f0000000700)='rxrpc\x00', 0xffffffffffffffff) add_key(&(0x7f00000000c0)='pkcs7_test\x00', &(0x7f0000000140)={'syz', 0x2}, &(0x7f0000000600)="1061950bcd57b6c2ef7758dd69fd8b5b4367f10e2bcdd9a1ea2433fd7a45eebb92a8f087804f5e8348152e4e75180e7273a2560e19f5164fe6444b34af38a1a3cc11f8167530bf3eb077290d11a6df1e", 0x50, r6) inotify_add_watch(r0, &(0x7f0000000080)='./file0\x00', 0x10000000) syz_open_dev$mouse(&(0x7f0000000200)='/dev/input/mouse#\x00', 0x0, 0x200000) ioctl$DRM_IOCTL_MARK_BUFS(r3, 0x40206417, &(0x7f0000000740)={0x1, 0x5, 0x1, 0x7, 0x16, 0xd9}) add_key$user(&(0x7f0000000280)='user\x00', &(0x7f00000002c0)={'syz', 0x2}, &(0x7f0000000300)="fb4e86afeb1182dc09620a8f9acfc488f5de179e99202af92c2685e437eb63ec82eb7f6d039292ebd7bf4eed865917c56564af59a96bb55d3ff4dc058565963aba31a1c1a9bf9f8470f53dae0bc2e791587e5145593ced6bee57b07584d02007e41656f825fbe032029955463265ff0b85b6e29632aa3f87f56df348809a908e0385a5dcdbe8b8032563383309682c907f673ee442f7ead02ae5bbea78c93f9cc5c6e10ae4843af9727e19a659854d59d606ca8f988e19f7782b3028ea33d713f29c2cfe241a36446ae5a8f7be950e86f01041a88b878fa906f15a55e6", 0xdd, 0xfffffffffffffffd) r7 = add_key(&(0x7f0000000480)='rxrpc\x00', &(0x7f00000004c0)={'syz', 0x2}, &(0x7f0000000500)="339411e828910459776ab24f9081d077868035adae3b02ea115886d23373604c11b601f8207e8ffc7a3cd8e0321073fa79b7fc40a38775d222766b931780b95091a0b7fbaa57ec361616a2051254de51764915ac976f0a5c3a7dc567b756b6dcfc362dad2d12a87dc4065000416111bba5c8bfe9e8f2ac5539eeac26fa36fe429fc84d858cf06d13d297dd7522f6baff0c6e4ef3895d726fc7f453e337098a438e7d4bcb35426d8927073177cfc2", 0xae, 0xfffffffffffffffb) keyctl$unlink(0x9, 0x0, r7) ioctl$TIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f0000000240)) dup3(r0, r5, 0x0) getsockopt$inet_sctp6_SCTP_ASSOCINFO(r5, 0x84, 0x1, &(0x7f0000000400)={0x0, 0x0, 0x40}, &(0x7f0000000440)=0x14) 06:08:07 executing program 2: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = socket$inet6(0xa, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp={0x2c, 0x0, 0x0, 0x3d}, 0x80) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r2, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000900)="b6", 0x1}], 0x1, &(0x7f00000009c0)=[{0xa0, 0x1ff, 0x800, "434c94cf096ca2c6e3a8a6433ea1ccf960ad859f9cabeb13bbcd113f89069f10afdedfc1c2c2a6455dc4d1cc5b8c42e105db6d89e5394ec484d7db74d839a1021c616111655c01f0d6840a2cc4a77a0a2613073b0d1e9ab634a70c9cafd212450fe14e5e32b6ee05d11e22515b1b820c7425d601c3c41b459046978582375e37f0268020620ba8c96a1cf8de5399"}, {0x20, 0x113, 0x3, "64bc63fb1e5bc65e5043"}], 0xc0, 0x4040000}, 0x4000040) r3 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r3, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:08:07 executing program 3: r0 = memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) ioctl$KVM_SET_FPU(r0, 0x41a0ae8d, &(0x7f0000000340)={[], 0x7fff, 0x4, 0x40, 0x0, 0x80, 0x6000, 0x4004, [], 0x80}) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fchmod(r1, 0x10) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_GET_FREE(r2, 0x4c82) ioctl$LOOP_CTL_GET_FREE(r0, 0x4c82) r3 = ioctl$LOOP_CTL_GET_FREE(r2, 0x4c82) ioctl$LOOP_CTL_REMOVE(r1, 0x5421, r3) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x3, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)=[{0x10, 0x107, 0x5}], 0x10, 0x20040000}, 0x8001) sendto$unix(0xffffffffffffffff, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(0xffffffffffffffff) r4 = socket$l2tp(0x18, 0x1, 0x1) ioctl(r4, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") bpf$MAP_CREATE(0x0, &(0x7f0000346fd4)={0x0, 0x0, 0x0, 0x8d4, 0x10}, 0xfffffeb1) bpf$PROG_LOAD(0x5, &(0x7f00000ba000)={0xd, 0x5, &(0x7f0000346fc8)=@framed={{}, [@alu={0x8000000201a7f19, 0x0, 0x201a7fa6, 0x48, 0x1, 0x70}]}, &(0x7f0000000000)='GPL\x00', 0x0, 0xfb, &(0x7f00001a7f05)=""/251}, 0x14) open$dir(&(0x7f00000000c0)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) ioctl$sock_inet_tcp_SIOCATMARK(r0, 0x8905, &(0x7f0000000080)) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:08:07 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca580500000000000000b893123f89dedb03442000000000000000000000", @ANYRES32], 0x2}, 0x1, 0x0, 0x0, 0x0}, 0x0) 06:08:07 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca580500000000000000b893123f89dedb03442000000000000000000000", @ANYRES32], 0x2}, 0x1, 0x0, 0x0, 0x0}, 0x0) 06:08:07 executing program 2: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = socket$inet6(0xa, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp, 0x80) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r2, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000900)="b6", 0x1}], 0x1, &(0x7f00000009c0)=[{0xa0, 0x1ff, 0x800, "434c94cf096ca2c6e3a8a6433ea1ccf960ad859f9cabeb13bbcd113f89069f10afdedfc1c2c2a6455dc4d1cc5b8c42e105db6d89e5394ec484d7db74d839a1021c616111655c01f0d6840a2cc4a77a0a2613073b0d1e9ab634a70c9cafd212450fe14e5e32b6ee05d11e22515b1b820c7425d601c3c41b459046978582375e37f0268020620ba8c96a1cf8de5399"}, {0x20, 0x113, 0x3, "64bc63fb1e5bc65e5043"}], 0xc0, 0x4040000}, 0x4000040) r3 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r3, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) [ 567.013602] audit: type=1804 audit(1539756487.763:127): pid=26052 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor5" name="/root/syzkaller-testdir239058742/syzkaller.b5Qjqx/321/file0/file0" dev="loop5" ino=285 res=1 06:08:08 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca580500000000000000b893123f89dedb03442000000000000000000000", @ANYRES32], 0x2}, 0x1, 0x0, 0x0, 0x0}, 0x0) 06:08:08 executing program 5: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = socket$inet6(0xa, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp={0x2c, 0x0, 0x0, 0x3d}, 0x80) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r2, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000900)="b6d35518b48becfbd314d1fa96a307da879125869c71d40c5a385ce1d3af47c69a6acba0142b27475f2f890e1446d7e0851a8c84b5", 0x35}], 0x1, &(0x7f00000009c0)=[{0x90, 0x1ff, 0x800, "434c94cf096ca2c6e3a8a6433ea1ccf960ad859f9cabeb13bbcd113f89069f10afdedfc1c2c2a6455dc4d1cc5b8c42e105db6d89e5394ec484d7db74d839a1021c616111655c01f0d6840a2cc4a77a0a2613073b0d1e9ab634a70c9cafd212450fe14e5e32b6ee05d11e22515b1b820c7425d601c3c41b459046978582"}], 0x90, 0x4040000}, 0x4000040) r3 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r3, &(0x7f0000000100)="9b0f3bc6445750cd60df6190", 0xc, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:08:08 executing program 1: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) socket$inet6(0xa, 0x0, 0x0) r0 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp, 0x80) gettid() ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000600)}], 0x1, &(0x7f00000009c0)}, 0x0) openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x0, 0x0) sendto$unix(0xffffffffffffffff, &(0x7f0000000100), 0x0, 0x0, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r0) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) [ 567.375301] attempt to access beyond end of device [ 567.380315] loop5: rw=1, want=130, limit=112 [ 567.393189] attempt to access beyond end of device [ 567.401826] loop5: rw=1, want=131, limit=112 [ 567.418555] attempt to access beyond end of device 06:08:08 executing program 3: memfd_create(&(0x7f0000000400)="696f63637480f6768671ac5169a06cd06ded5bcaba96ce2e8467eaf3561873aaaed6809fd6b758a580b4fd1e5c1f3cfb9c3cbf85bcbd2b9a42a2aff2c2e41cebb187e1ac240a637bcc0d5639d4c0d94b3d15df47d0982cc3a406be27214ecf7ec05846c43693b4c9019e9b2e8301b9065b0493d80bf6ce17c94ded2d37f3aaeddce3dc210e5ef38c15ca8f14f89d3bf2417e11", 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x2800, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r1, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x3, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="100000000000000007010000050000001f6f5e6757d43524618c1270612252654b46b08b28e8d5564523326d59047eee86ddca5bfea8f2028107352c65195845482e7a42e8f6a119318cb39b484c3e345218c9e89460ef457bc1ef46de60f0d1c852b7351abe922745b662fe7d48f91982170f7a1cec657efabd18787a08d995c22cbdf44391c9"], 0x10, 0x20040000}, 0x8001) sendto$unix(0xffffffffffffffff, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r0) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) [ 567.423537] loop5: rw=1, want=132, limit=112 [ 567.434333] attempt to access beyond end of device [ 567.439462] loop5: rw=1, want=133, limit=112 [ 567.443922] attempt to access beyond end of device [ 567.452394] loop5: rw=1, want=142, limit=112 [ 567.464328] attempt to access beyond end of device [ 567.469784] loop5: rw=1, want=143, limit=112 06:08:08 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca580500000000000000b893123f89dedb03442000000000000000000000", @ANYRES32], 0x2}, 0x1, 0x0, 0x0, 0x0}, 0x0) [ 567.474742] attempt to access beyond end of device [ 567.483500] loop5: rw=1, want=144, limit=112 [ 567.501309] attempt to access beyond end of device [ 567.509820] loop5: rw=1, want=145, limit=112 [ 567.519081] attempt to access beyond end of device [ 567.524941] loop5: rw=1, want=2178, limit=112 06:08:08 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca580500000000000000b893123f89dedb03442000000000000000000000", @ANYRES32], 0x2}, 0x1, 0x0, 0x0, 0x0}, 0x0) [ 568.159390] attempt to access beyond end of device [ 568.164644] loop2: rw=1, want=130, limit=112 [ 568.176878] attempt to access beyond end of device [ 568.188682] loop2: rw=1, want=131, limit=112 [ 568.194522] attempt to access beyond end of device [ 568.204851] loop2: rw=1, want=132, limit=112 06:08:08 executing program 4: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = socket$inet6(0xa, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp={0x2c, 0x0, 0x0, 0x3d}, 0x80) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r2, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000900)="b6d35518b48becfbd314d1fa96a307da879125869c71d40c5a385ce1d3af47c69a6acba0142b27475f2f890e1446d7e0851a8c84b5", 0x35}], 0x1, &(0x7f00000009c0)=[{0x90, 0x1ff, 0x800, "434c94cf096ca2c6e3a8a6433ea1ccf960ad859f9cabeb13bbcd113f89069f10afdedfc1c2c2a6455dc4d1cc5b8c42e105db6d89e5394ec484d7db74d839a1021c616111655c01f0d6840a2cc4a77a0a2613073b0d1e9ab634a70c9cafd212450fe14e5e32b6ee05d11e22515b1b820c7425d601c3c41b459046978582"}], 0x90, 0x4040000}, 0x4000040) r3 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r3, &(0x7f0000000100)="9b0f3bc6445750cd60df6190", 0xc, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:08:08 executing program 1: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) socket$inet6(0xa, 0x0, 0x0) r0 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp, 0x80) gettid() ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000600)}], 0x1, &(0x7f00000009c0)}, 0x0) openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x0, 0x0) sendto$unix(0xffffffffffffffff, &(0x7f0000000100), 0x0, 0x4844, &(0x7f0000000700)=@file={0x0, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r0) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:08:08 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca580500000000000000b893123f89dedb03442000000000000000000000", @ANYRES32], 0x2}, 0x1, 0x0, 0x0, 0x0}, 0x0) 06:08:08 executing program 2: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = socket$inet6(0xa, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp, 0x80) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r2, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000900)="b6", 0x1}], 0x1, &(0x7f00000009c0)=[{0xa0, 0x1ff, 0x800, "434c94cf096ca2c6e3a8a6433ea1ccf960ad859f9cabeb13bbcd113f89069f10afdedfc1c2c2a6455dc4d1cc5b8c42e105db6d89e5394ec484d7db74d839a1021c616111655c01f0d6840a2cc4a77a0a2613073b0d1e9ab634a70c9cafd212450fe14e5e32b6ee05d11e22515b1b820c7425d601c3c41b459046978582375e37f0268020620ba8c96a1cf8de5399"}, {0x20, 0x113, 0x3, "64bc63fb1e5bc65e5043"}], 0xc0, 0x4040000}, 0x4000040) r3 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r3, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:08:08 executing program 3: r0 = memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) socketpair$inet_udplite(0x2, 0x2, 0x88, &(0x7f0000000080)) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() creat(&(0x7f0000000100)='./file0/file0/file0\x00', 0x10a) ioctl$LOOP_CTL_REMOVE(r2, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@un=@file={0x1, './file0\x00'}, 0xfffffffffffffed3, &(0x7f0000000880), 0x0, &(0x7f0000003b40)=[{0x10, 0x107, 0x7}], 0xfffffe13, 0x20040000}, 0x7fff) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) bpf$BPF_PROG_DETACH(0x9, &(0x7f00000001c0)={0x0, r0, 0x2, 0x1}, 0x14) fchdir(r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) [ 568.209305] attempt to access beyond end of device [ 568.226183] attempt to access beyond end of device [ 568.248095] loop3: rw=1, want=130, limit=112 [ 568.252565] attempt to access beyond end of device 06:08:09 executing program 5: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = socket$inet6(0xa, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp={0x2c, 0x0, 0x0, 0x3d}, 0x80) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r2, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000900)="b6d35518b48becfbd314d1fa96a307da879125869c71d40c5a385ce1d3af47c69a6acba0142b27475f2f890e1446d7e0851a8c84b5", 0x35}], 0x1, &(0x7f00000009c0)=[{0x90, 0x1ff, 0x800, "434c94cf096ca2c6e3a8a6433ea1ccf960ad859f9cabeb13bbcd113f89069f10afdedfc1c2c2a6455dc4d1cc5b8c42e105db6d89e5394ec484d7db74d839a1021c616111655c01f0d6840a2cc4a77a0a2613073b0d1e9ab634a70c9cafd212450fe14e5e32b6ee05d11e22515b1b820c7425d601c3c41b459046978582"}], 0x90, 0x4040000}, 0x4000040) r3 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r3, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab5687", 0x12, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) [ 568.273344] loop2: rw=1, want=133, limit=112 [ 568.284765] attempt to access beyond end of device [ 568.295106] loop3: rw=1, want=131, limit=112 [ 568.301010] attempt to access beyond end of device [ 568.313766] loop2: rw=1, want=142, limit=112 [ 568.329117] loop3: rw=1, want=132, limit=112 [ 568.333754] attempt to access beyond end of device [ 568.339442] attempt to access beyond end of device [ 568.355006] attempt to access beyond end of device [ 568.357998] loop3: rw=1, want=133, limit=112 [ 568.359966] loop5: rw=1, want=130, limit=112 [ 568.364804] loop2: rw=1, want=143, limit=112 06:08:09 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca580500000000000000b893123f89dedb03442000000000000000000000", @ANYRES32], 0x2}, 0x1, 0x0, 0x0, 0x0}, 0x0) [ 568.380834] attempt to access beyond end of device [ 568.386578] attempt to access beyond end of device [ 568.403658] loop2: rw=1, want=144, limit=112 [ 568.413764] loop3: rw=1, want=142, limit=112 [ 568.415193] attempt to access beyond end of device [ 568.418663] attempt to access beyond end of device [ 568.430788] attempt to access beyond end of device [ 568.436508] loop5: rw=1, want=131, limit=112 [ 568.443078] loop3: rw=1, want=143, limit=112 [ 568.448231] loop2: rw=1, want=145, limit=112 [ 568.462016] attempt to access beyond end of device [ 568.468769] attempt to access beyond end of device [ 568.474905] attempt to access beyond end of device [ 568.479865] loop2: rw=1, want=633, limit=112 [ 568.482165] loop5: rw=1, want=132, limit=112 [ 568.488930] attempt to access beyond end of device [ 568.494423] loop5: rw=1, want=133, limit=112 [ 568.499056] attempt to access beyond end of device [ 568.504247] loop5: rw=1, want=142, limit=112 [ 568.508863] attempt to access beyond end of device [ 568.510661] loop3: rw=1, want=144, limit=112 [ 568.513959] loop5: rw=1, want=143, limit=112 [ 568.522914] attempt to access beyond end of device 06:08:09 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca580500000000000000b893123f89dedb03442000000000000000000000", @ANYRES32], 0x2}, 0x1, 0x0, 0x0, 0x0}, 0x0) [ 568.529302] loop5: rw=1, want=144, limit=112 [ 568.533920] attempt to access beyond end of device [ 568.539228] loop5: rw=1, want=145, limit=112 [ 568.547924] attempt to access beyond end of device [ 568.553132] loop5: rw=1, want=2178, limit=112 [ 568.558296] attempt to access beyond end of device [ 568.595808] loop3: rw=1, want=145, limit=112 [ 568.614966] attempt to access beyond end of device 06:08:09 executing program 4: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) pipe2(&(0x7f00000002c0)={0xffffffffffffffff}, 0x4000) ioctl$RTC_ALM_READ(r1, 0x80247008, &(0x7f0000000300)) ioctl(r0, 0x8912, &(0x7f0000000080)="153f6234488dd25d766070") r2 = socket$unix(0x1, 0x1, 0x0) r3 = socket$unix(0x1, 0x1, 0x0) bind$unix(r2, &(0x7f0000000000)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg(r2, &(0x7f00000021c0)=[{{&(0x7f0000000340)=@rc={0x1f, {0x0, 0x3840, 0x18000000000, 0x100, 0x0, 0xd24}, 0x1000}, 0x80, &(0x7f0000001500)=[{&(0x7f00000003c0)="dab122038ff65e1260ad10b7aca0dd71f0c93d5e5302b190fa8129eca20277cba2d11abfb7dd757cc8b1afaaf2288cca0d659dfc1cce9ae3f2e802e90eb19b56b096235217c4478dfbaededa62c0eabafc933ac1fdf09c72f8", 0x59}, {&(0x7f0000000440)="e56dfa4db0dbacc946fc36f1b5e28d053e902c81a9437e68c05350ad5debf2a355afa0204ec07be63c26d89c332367106ca1511604b7d59368b80b28dbacce21d3e0cc4e0b3f7f694979766b0ea9801fde68956b0e95878cb08cb052ed0fbe2cc8477aae36d6c5a16bd41000fbaf589c875c04957cb85daafda833ba1ec8b653ae580ae8255a386818698a8f9c1aac1fe719fece83e50638e05cd22c21de07519ce9ac61668bf3adac36d9449b8ed32b5b221e215755f610bf219e4f99e1fd6e3bf4b60bbf65e14cd0c7a5089f13763f3c8947c3ff5109bb6384ee6d923ee26fe9a29fb6d71f0b7d1a5ed7775a9a5792e999eecbd86fae02fe38b2a0c08c904f4731e1b67789b868dfd193212ec6c3720ee5e2466b2e0076a089d57fe4968ecd5ebcb00071903a531b907fc0b95f3377d3be4bf1c5d90da743e7bcf80e49f5277445af008652a6f358036269bb4ea0a84e50ab6a7b435b86747f2fadccfc4e78fc552c7816c8b384923aad2e3ed68f8674b90004395ace5da301b8e603890e9457fbc726f6856ea2795b212084a8ec6917eb9caf224ea9a1bdbd33b2b186f1acaa8531fa11f4bc04180ba333c7bb440babc9acf34a60180be7f0f9fed981b659e9300afc465e6db5baeb8bfe58e15fe363e3452ff90a9081f43e1c8537752119d3dece0e445fe2562cf99aff1d2d18dba4f22bc1acf970feef6dec3a7dab558f8cd7f2c97cfa733df85c4a134ed1443cf024a2d27fb5e80c6b91628da257b3657585b0851785eeb85316059e30944181f5ea86be650e8d5722b57472a9bb4942286f15fc88e92c256c8b74b7a6ed2457e85effab94c114a4e3f5755bed42c08516489d5b46270da183aa71e49059028c0829d6d5bb943074d7e2e70a1a3179e53515da4fc5b4400b847b9dec0a6b997b36a811ccdecc19d65b8484fdcd53cabf49e33aa7eea1b8f31a3328425c31a5cf153ff13f9098816d90c95e914385e80d522678e3c9100184dff7f1f4ad311e3eb5eec687b4a4086b5deda6a9c70e350e3c6dcb6a893173a8ea7eceb9a0e4940933d1ac52f44b98c2b3fe25bcde257fb5c55154914d9fa71c34c9b288c951d6b1b2aaf9491e730b325e97abe3f54b407f31a62f62376002b8d3109901a01997efeebc49b0d62140513c428497dc12032a2495a05edd708ba8b6f92cce0c014e32dc163aed6c36eb2a5d1f2b3444373d6b89ca1477354d2af3767716a421b0b5ce6bf98f0989479eae2b5929567b1f266049b9294766f5e84b0556a3a0694da84da48107a028d25c84f24074ac3600930dc0e6a9981e85c072d9bdee3f4b6dfc1810f44eb5eb49282c724ae1f53faaa9a22441b80707431c13a73ef89c67d20c5dc6532bb13d986da48597def47dbbc676397d14bd0d224681c77f0e2a52b3774cf9d81dedb832d230661e317f3f91903e8f64ccbe46b14fb0ce5632ed7822302a7e71449ef166ab8e0c2dc78c0a7faac0e1bda740a88c29c51ee99504c4542fa46376d5286cc8e2f6f7f096d177c2336bcdbccb8e0fb9776d4ad641a2c5f5eea81c4f564d584e6e7b15a234aa7a6291da0acfdfb7e8df73e486a733790688732d8f2c9c932d1d599585d804b9fcd4162a541c7ea78e78fff2c531f759eabca01c4ad0778f56f34d0a0079c84d5cb390d0bdb97d908a54f8c80f66f81b9a5a587b6cc0913d5a3229a3674f19db820bf31261ad5094ddf9ebacd6e42f714e4136b1cbfb17739c38b8f4f68e4812cde1b84172a1a2f0657ea3f1202384e9601637fd1e4b49f38926f9a1064b7cdc7e1c73c13033800c8f7025ed638f618db0e561a57e80a45c56c71fe07a2ce77573602f8350f6540eaff3eb8a86fe2175be28bd60aea7445be4b0f786b3c4935d12f9626b122fe05f59e071cd75c6a937b50bcb663c7a0fbfd9a77b2b6b709320c744aab3f971e1a4ecff6ba345c82afdfb501343840419fe2bf412d27b318a28c54708a4d4bf8ed4f42fd62ca61fdaa5d293c404e69dcc55c8cfc93b3449c9d46cede6c4b1eb2e5400e29b03042d47d54eaae56ce7f7a7e9c6767e55e83b9b3c52d7c5e1458038c68a84269f1a7ef33a8c37da5e0bf0b7d9db7ba71605ff3aaa9075a27f6af5437e698484bd4a992fb260762e5cc27a42cbc3c202953294cfbae9f324f7e3c8e468784999d25ff48bc74a7a3583b67fe96c55b79d98384484a1385a8785e73687ac9f73dbc61e72c94e487fbef6d67ca792a71c97712265f29e30859ef7ddc364527e2b32bf05c1efe6108a465b442f1d99922c10d7eca645e8c945495bca09385571295849819d5e0b42f76e28253e10d30a988d78d00d55347da611f5012b44c18b54b931bc11364f7cf4eb6b1baae8fa9dd726cd1c3df0526706fe92c1b22bdc0e403c141276eb8ec95b960313083886a26f5eb1a538d7c238df84f03bc7af90c93a5a05fd1bb4a1c5c604550de21465e4e41aac781f38ef0fa2622e7b89984552da6e6d47fd5925673192ed4fe2859971b68e853613e78b65f046eb15400acc20bb8b12fc2ab06914416e90b875063e9ba1ed002178cf0dd33d8c96310614c6654163737d67b6d3e36e0c5380fea923e45767d1556785973000c03197796c0d104a0eb894a64e53b56883bd4227b6ee7977cd380a829e6d02844c778fc53bac0ab71a74664d34f6ce2aebc7db6f658f1c9009d3766913d16c717bbf1f794cbfc6f6221476f282135d3b07c09d4587297183da6cf5506e4849df5ffd9bfb0942db0ea49b93c674a65d336c3b0dd0720584896ca885a596b2d2730f8f75f5ad25860d12a47ad036d3134b2308f454c5da84db0dd53787447ae8ce6ad8149bb60995ba10c1cb53c40b83d4a749cc48de61151b16a2b611d2c6124ef543d87e36857c0db992b27ee935354b5d2ee3bc29d1429f10734d97670241d923b411f13c90c3c241087f15b35c45ae9c9887e8e0f0420d576973b712474885ee7749c37c12a76915b26b841ae50d5e5d83abda4430cf13e0414d64603846da606786268f2f3812492c2d9549e8e7370702f678319163a75052b9eaef6c5055b0d2fe631b0503f75728463fb75c512a67513bc60bf3dc5e67457a6890b399fc33e58301970554a442e02ee5367fd3903aa42db8959b6eebe69042d9af3deca78e37444626e32eddd3ed46e3b1d8aa419c34cd85c8b7be1486e3b1cf05b47a244024343915512e3d0ccae76dd7c16ed43a8682fd9654e0bb882dfebca52b11826669fbf724eca152302819a19f9b21a851094c1105d9f5dabf5fcb8a402115b93c99f5934cf20b9da40d8f02392cc9452f319626572075de6eba28b704c2ffa8dc17211f2e32cbb07a9f67cddc7a78da723e59ce5deec936ee4cc6520f80d6544a73c3b5a764eb5a25dc6bfdce757ab56b18dc8c652bd026136ba5fda31d2574ce39090b3e97d2c71bcdba6fbdd2db5da831d1a786005d6ac9ac90cbd6e85d125bffcaa8d41c3eeb16fbecc8bb461b1cba750c3af0107c21dc4c62cc5239031f07c96968649f5389604cde76cf7d68d76f69a6aad5427438b04a5659b51e4a2501bbae1a458eade028fcd534e363f081e4dd6abb6287d409aa021a56b621a0ced2d5828c3f726285561cf37362025e7dbd73396dfda9760efbb5ceb054720f3038c6fef9378be7077e3a30025e536d38c130edbb6ed1ce1973dc95d37c21fa341e43cd4d2fecdb859f3a0decc38896a6f1a95f0080444ee15331b13993efc86e1e4bbc9054d9fc82c9a1cbaf8844cc33822e30ed86ea03fcce7273d3000f4f9e697c09181d28ed122f92805859e8cbc10c5622e9fb81a52a308e85cdb60658c9d4f2f54eba2e69721c3430aab0e346ba9507d90fd8a32f1f2c635f4d0102207b83409c9c692923c64e09e2acb53a710b22fe419bfac847a3dc1937cde320d218aa6dccc1afd83acb61f6890eb60648b1773d82b90d21ec1526a26465e77d5f236668df02c0b62b16ead9e851d58ab2da72ff8d1727ae5d481598f6a2b04ea9ecb502ba5f512b874afb41997f88ffb3ab65054cc6b1f59f6deb300935b7d978ad5df66a030c9c0edbe35a496d94eaf634baa14164a10fa863b39df6b218d40afd0feca184ed22967e096dd250d4b5981a776b5dc26949b4bbe2952c0bd19dfe08cc77c17ddf9287a80a5d74adffc9557ecf00a2603992075bcc574a851b5891a8d92e76501bc63220ca975c62472fe1cb072dc0523c836558bee287402b8737912d59bc8174c4fe54fb98612dc27bb78b9460cc02c73a4f3631f40685cadaaf40452b098032cd8f62719788f5a0be7e7b497c1553c20c430477f1c25ff61318a4b142e556d64c0c0210126b20ac03991a9973a2d0133dd808634da63b8ad9aab9a4db68f1b77b37bd95f40fc61f192619565bac8fa2c5643795529b4e9dd325b566131f91555fd6c869c064ed98a75a5d8bc7b1cc8be0a6b9defeb0008f34b8c80a3c2e80d60494fe80a61059b57652c871495a9e2e64309134d81d27c3e3e6d0e07665954d515132f612978b5f3ed6c039ba322f4eaeabfa84a030f1cffafd73c29d4ed24d1517a696d9430d0db2ff8251392ef79469a786517bd1ef51109d0016c4be152c39062ef989920f85f7bababf5d46436b78c1ccc66f6b613d111a21089e79ea2bb44c7ec9b14d606e959cbb9667140402d8f7c0f1f6643ffcf888526d3ecad0822b7f6038a89c72433dcdaeac8b51befa056b386670606d23cc7f1d5a350f0cf93603271245f95b75fbe5ccb8e67662b9fe1e14d7cdc1f2e6f231d186231d5c68dd90c52e1e615155e6859cf2e8cd2db24174fd6bce264c6af8cac1c56bc97283b7f79192c64f868a410f2bc79754552e344daa977649c1a85f6307cb2ba9abcab5af2cd3cd57a626778f4bd62d3d168bedbf3c62ff484e64d8ec33b6a3be3ecc5c8a8f55ce0ec5dbc52fb7150301f0e1f578cb448c8c5be117b00f6ff2bd1c1a2be8b1f324cca6a5ea2a146b7486285fe0f5e8c3269563ac83ff873180da26d5f320cb2a3b1c6b2b928fe922aafeb37c321019d5133668b9ff3d75e90db730ca34f9c1584d58ac6eddc390802e910753e7843e42c0e8c7f97bcefa07680cc583f85a67d1c79e22e8da57137e2737d747496d351b19cbc336253b2af8c267a93048618fab5fc262b1646e7b4d9b77df69abe107b6f07e58646d8b36dfd83ea37abf44850fd6efd24f04126334683cddaf5cc05bde3801da5f34fbb3062f880bd166f2e29ea73c69dace78ba6378bb4c702eed447f6e1cf5794b2cf55ef6be927661b529fdc7ede1f6bf3578fa68704a1f7315688e06cf9df9948d39f44383d8f476f4f97155e642d233e02159ca91ec804bbd1d89104c8f8a8bbb0a8bd109d479b112ebfb5bb1f5a18243384264af28d481eda56b5a2ceb6628065287707c4bc894d8a6f31920441bb8828faf18044c9a72ba4b3d293daabc0bdeda543e43bd405a167ec8d5cf6dbeb4358d584dac783e44c521d73c29db3403fb60b1f711628c93c836e669793a59d2e0d2910dc7698227095286109ebe5a39b7dbb9186bf90be80b1aaf5263c195321b37c2319739a9e6f8abf57044129ece226d9944743513b383d2a1d89377d64401b39a7d92420aef7bc9af609a235b0ca0fedd80d4232900f31c62e0c071dcfee81ede2b2371d4eb5e20f7231358d9c080fae3c4daf3011704a72fdd8c59de09bf55d14899b20c41218b70bb178ea1363bab4d02755ba1307890ebe1b6720619d79138c8e795c139ed75eb43aa16ce8eb5fadb00", 0x1000}, {&(0x7f0000001440)="5f1043747a1f08b195e01b5589605e41415f1d337f75025ccbc8f1826c351f788323ad7009cfe294e6204a4edb66a39d3642daa45e387bf1bd3c670e3273816b5e0fef5cf4a7546dc4ed1e0ab0ab8d959cad9d491dd2333a9748cadf493d919d7be9619fdebc0d9c1dc9370a4a1fbfe18f264eda981a5d3d642c23a0cef61a32034dc97293", 0x85}], 0x3, &(0x7f0000001540)=[{0x80, 0x104, 0x7e8e, "9cc99c116ef9760126c28b6b7f262872c34b88c987ed9a54603dcf0b08aa0ce13924df6735c7f71dcf9d3018706ef7e7f5625cec24b46320a18a4fc272e2e031b8ec8edabcc68559546a19fe24c033ac24f25d19f09e24084fe6898f74f7ff07d630be320f3587f65a5ef676"}, {0x78, 0x101, 0x1b, "4b4bc2ee9bc79f494317199d3fcfd55fd96155d5353ad17219c247363ced21bb1359b56a35a0adbebc98596d4ff1ab1b58afe054b0213d365654dafe35f67ecbbd5b480359047b4a89e00e7d7316748e87fc73226e43a0b76a61edebbc26f7e3e496"}, {0x30, 0x115, 0x7fff, "764e086019f80eef24aa06d81172f285704c47345ef72425059c6ec730e9"}, {0xc8, 0x11, 0x0, "cf0866a7f59c7de400063d6aa8ea94be0537c7311d8540a54105064e6c26db25b8fd70a3ce56fb9ff7f88e56788328c365df3bf994317f5abdf9d856b53dd39513ba73a88e308f8d5743189c5e5a94c8d421cdd07ffefd18cd1ff82c78e77dabd7d8bf79b32ea751ed61ab682e4955975a0e4f30fe6155fdea753c3f4cd9f343f77cd69df6225c94a01df88c6e97f6c1aa8c89a7637d71e83a23316efae6e2c68b8e752f9e7345e1297303ed711942250c81e16c2269"}, {0x28, 0x88, 0x9, "9c79f66a9192a45e8f6bfdefe63db4818b77202c"}], 0x218, 0x44}, 0x7fff}, {{&(0x7f0000001780)=@pppol2tpv3={0x18, 0x1, {0x0, r1, {0x2, 0x4e22, @loopback}, 0x4, 0x2}}, 0x80, &(0x7f0000001900)=[{&(0x7f0000001800)="fde500ecdb99e18de547c44944ce0823d3f55ee4f3d4ce3a4f78af8c25c630fc4d2a005017cde033831e3fc6efa8887bd1f136f97168e78b141fef8e1494d53525738180", 0x44}, {&(0x7f0000001880)="a09f88035869da27cad9bbf146e419584986ebb3227f36fc84ef28b7b911e4581a646e480a30489947b9c48f4104b28dea850a610a17c68f0f4cd5232835c22cd0df2219fa", 0x45}], 0x2, &(0x7f0000001940)=[{0x90, 0x117, 0x4, "6e100c437217f8895adac69365a5eed1827a6820ce61e4e87b2d62e5a58142256f65911dca30287b6fb3e6bc0d832ed17333ee445e45bb72ee52fe90e274a3faa7d469bcbdce6d44fcd5c4f2c8b42d6d51e4e09eaabd4555b79a0909a137242d8ccca5bd132cd20b98ea310afbbb6e4fa19195e941b65737889e9c6a4e"}], 0x90, 0x4000000}, 0x200}, {{&(0x7f0000001a00)=@pptp={0x18, 0x2, {0x3, @remote}}, 0x80, &(0x7f0000001c80)=[{&(0x7f0000001a80)="85e0280a3c4eaa56efdf5325098e8c0d2407809ff7f7d3673899d0e2a8b896c2bce41cecf47ce8274cd9c2849f8f40c312c5bb88dff2b878019f99eec8f1ba71eb5dd7a9a825285ce03b53b95b67d661a8ccc10b1fa3cb3b98e30c4442033960cc0362a4609096d1c3f2bb5e36653196d0bd3a3590d7c228307a02963c2f056febff753432b2850c18d495236fdb1488fcab3a7fd5", 0x95}, {&(0x7f0000001b40)="a3e2972359dace5d170a1bbe6630bc5a04a68b6514", 0x15}, {&(0x7f0000001b80)="ccdcb13499df883846f115e3e2f89b2ab8b4500a886339226727724e7a58e38c1bd6887bc41bea76c3a0d85c5e4c13f7f4d4e6a811e09c9c8d5fccde0d8e85cf7e6bd8c2ffbec9d70c82394c5c4143acee78fa65202adafa8bcd260e7868cbef3a1c3cfbbd89abd04e852d2d25c1725abfb876672011a4c443c4b6d743edfccb8b00e101ede1578109dabe0a49e9d30fcb3599b1e7c4e68d463cee119e551680a1e7aa02aaf83df53d14bf72f921567fe9249eb3421815342224f82c33d118cd350229d525e0e7d416639244628fcf0c", 0xd0}], 0x3, 0x0, 0x0, 0x40000}, 0x4}, {{&(0x7f0000001cc0)=@in={0x2, 0x4e23, @local}, 0x80, &(0x7f0000001d80)=[{&(0x7f0000001d40)}], 0x1, &(0x7f0000001dc0)=[{0xb8, 0x110, 0xa54, "8e68a28463f295ec2657f1e18f657e86d486ae7f0fc2497639986728f18f033dc35f25ef256bb323420f2ad01bc9df1038aaecb79b2645710352b5dea9c06cb8e8103eee7c1643206f439a8fceee1fcb5ed300cc51edca8af15a2bc190a13d7b06290eb619ff111a3275cf2913f38e27f81e0aee1712893590d3d604c62be3f47b11fad2e3d49f2dcb5061992b0c60329365476d2d2eb322c3897f9e572f1f07a78e9b"}, {0x48, 0x100, 0x1ff, "537b8f6e5cff9bea9c60c9f2e650554f2dd59039c800852e7b876ac496aa15804ecdf206a0e5ca93d4b152ef1e510e0834ae"}, {0x90, 0x0, 0x3, "2377e9de4fbc7a1a68cadf03d09a99431997c41547a5a5b9ed936b42dbb529e34f84a2da53d948afd3aaa5bdc4bf994ecab781786029714233bc14b0a59206b16e293feb19bf7e40599b55f59557b2997741dd5628e1b3a55b19c8cb2423f0ab8328f290be644e4f0b6919bdd92e4e3c2eaaca4b28f2c656c3"}, {0x60, 0x11f, 0x4, "c9e72f91e90b065143b7c56a3dfd3363355ab69a479962d2a42d60bd0b98f2ef3cee84cdd87046e5dbc8731374614235c79abfff7273d6f2fcac1efb86893e672f3ba240f4eadd789e"}, {0xb8, 0x101, 0x3, "9de7c5cb8b25b89dc5af70fc259db203be5f8973e0ed33fed2e5a74fd9c31283ca4a8de1951fd59254dcffa88f110e6de4311ba7b31d176a2a0a3bcf6c95f8692b061ff58471824345c48f010a84b9642be7b5c1c2c5d9c896919cb80f75fd40dc067cbd8afac1c224f097694d778c0386954be3bd632d9da79500fac79a39802ea3fa043101c7a137642ca2c08e15eca9c794d528456755aa924032f462f2b7f1"}, {0x20, 0x105, 0x3, "3a30caafc74c0443f714fc99f440a44e"}, {0x98, 0x1ff, 0x2eaf2c5c, "fe3489171531b273ea41b25bf4d6940bc6ec5d29fb38b7ad0330305592f893ff3fc4c4bd879e78264719dfa4ab42cb4eaa03dc89b8e9deadba54b19a44b63fac8bffd754c0b58c74c9759bdf1a18c4fe90425e130db9845f6c10b4af0b5778cb3877bc95b8e25e12f2342fc896b99c081923e497964837fe5c2c6e23e72467c52aa20991e43b74"}, {0x80, 0x13a, 0x8, "e33c49309d5e41a61c06dc6804e1c1d10f923c4db1e176fe9f9efb51753659389ec58fdd501490744fb742b4a14a0da6cb9eca45e039fb7974486647027f1409708a5229b6d94d6d930c3d12c562974d92caeb141f5caf899a593bf1fa0919f49da7034a6369e339fe59cb46"}], 0x3e0, 0x1}}], 0x4, 0x4000000) setsockopt$sock_int(r3, 0x1, 0x22, &(0x7f000018effc)=0x1c, 0x4) bind$unix(r2, &(0x7f00000000c0)=@file={0x1, './file0\x00'}, 0x12) listen(r3, 0x0) r4 = open$dir(&(0x7f0000000140)="e91f7189591e9233614b00", 0x0, 0x91) execveat(r4, &(0x7f0000000180)='./file0\x00', &(0x7f0000000200)=[&(0x7f00000001c0)='*:bdev\x00'], &(0x7f0000000280)=[&(0x7f0000000240)='[eth1\x00'], 0x1900) connect$unix(r2, &(0x7f000066fff4)=@file={0x1, "e91f7189591e9233614b00"}, 0xc) accept4$unix(r3, &(0x7f000046f000)=@abs, &(0x7f0000937000)=0x8, 0x0) 06:08:09 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca580500000000000000b893123f89dedb03442000000000000000000000", @ANYRES32], 0x2}, 0x1, 0x0, 0x0, 0x0}, 0x0) [ 568.643025] loop3: rw=1, want=2178, limit=112 06:08:09 executing program 2: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = socket$inet6(0xa, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp, 0x80) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r2, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000900)="b6", 0x1}], 0x1, &(0x7f00000009c0)=[{0xa0, 0x1ff, 0x800, "434c94cf096ca2c6e3a8a6433ea1ccf960ad859f9cabeb13bbcd113f89069f10afdedfc1c2c2a6455dc4d1cc5b8c42e105db6d89e5394ec484d7db74d839a1021c616111655c01f0d6840a2cc4a77a0a2613073b0d1e9ab634a70c9cafd212450fe14e5e32b6ee05d11e22515b1b820c7425d601c3c41b459046978582375e37f0268020620ba8c96a1cf8de5399"}, {0x20, 0x113, 0x3, "64bc63fb1e5bc65e5043"}], 0xc0, 0x4040000}, 0x4000040) r3 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r3, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:08:09 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca580500000000000000b893123f89dedb03442000000000000000000000", @ANYRES32], 0x2}, 0x1, 0x0, 0x0, 0x0}, 0x0) 06:08:09 executing program 5: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = socket$inet6(0xa, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp={0x2c, 0x0, 0x0, 0x3d}, 0x80) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r2, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000900)="b6d35518b48becfbd314d1fa96a307da879125869c71d40c5a385ce1d3af47c69a6acba0142b27475f2f890e1446d7e0851a8c84b5", 0x35}], 0x1, &(0x7f00000009c0)=[{0x90, 0x1ff, 0x800, "434c94cf096ca2c6e3a8a6433ea1ccf960ad859f9cabeb13bbcd113f89069f10afdedfc1c2c2a6455dc4d1cc5b8c42e105db6d89e5394ec484d7db74d839a1021c616111655c01f0d6840a2cc4a77a0a2613073b0d1e9ab634a70c9cafd212450fe14e5e32b6ee05d11e22515b1b820c7425d601c3c41b459046978582"}], 0x90, 0x4040000}, 0x4000040) r3 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r3, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab5687", 0x12, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:08:09 executing program 1: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) socket$inet6(0xa, 0x0, 0x0) r0 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp, 0x80) gettid() ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000600)}], 0x1, &(0x7f00000009c0)}, 0x0) openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x0, 0x0) sendto$unix(0xffffffffffffffff, &(0x7f0000000100), 0x0, 0x4844, &(0x7f0000000700)=@file={0x0, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r0) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:08:09 executing program 4: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="153f6234488dd25d766070") r1 = socket$inet6_udp(0xa, 0x2, 0x0) r2 = openat$full(0xffffffffffffff9c, &(0x7f0000000100)='/dev/full\x00', 0x0, 0x0) ioctl$sock_FIOGETOWN(r0, 0x8903, &(0x7f0000000140)=0x0) rt_sigqueueinfo(r3, 0x24, &(0x7f0000000180)={0x39, 0x3, 0x7, 0x80000000}) ioctl$SNDRV_TIMER_IOCTL_STOP(r2, 0x54a1) r4 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r4, &(0x7f0000000200)=@pppol2tpv3={0x18, 0x1, {0x0, r1, {0x2, 0x0, @multicast2}, 0x4}}, 0x2e) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_INFO(r2, 0xc10c5541, &(0x7f00000002c0)={0x3, 0x80000001, 0x5, 0x0, 0x0, [], [], [], 0x0, 0x100000001}) r5 = dup2(r0, r1) setsockopt$RDS_GET_MR(r5, 0x114, 0x2, &(0x7f00000000c0)={{&(0x7f0000000000)=""/119, 0x77}, &(0x7f0000000080), 0x1}, 0x20) 06:08:09 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca580500000000000000b893123f89dedb03442000000000000000000000", @ANYRES32], 0x2}, 0x1, 0x0, 0x0, 0x0}, 0x0) [ 569.125196] attempt to access beyond end of device [ 569.130190] loop1: rw=1, want=130, limit=112 [ 569.145130] attempt to access beyond end of device [ 569.150353] loop1: rw=1, want=131, limit=112 [ 569.163646] attempt to access beyond end of device [ 569.169229] loop1: rw=1, want=132, limit=112 [ 569.173815] attempt to access beyond end of device [ 569.238676] loop1: rw=1, want=133, limit=112 [ 569.243172] attempt to access beyond end of device [ 569.279571] loop1: rw=1, want=142, limit=112 06:08:10 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca580500000000000000b893123f89dedb03442000000000000000000000", @ANYRES32], 0x2}, 0x1, 0x0, 0x0, 0x0}, 0x0) 06:08:10 executing program 3: syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$KVM_GET_EMULATED_CPUID(0xffffffffffffffff, 0xc008ae09, &(0x7f0000000580)=""/205) ioctl$LOOP_CTL_REMOVE(r1, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x3, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)=[{0x10, 0x107, 0x5}], 0x10, 0x20040000}, 0x8001) sendto$unix(0xffffffffffffffff, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r0) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:08:10 executing program 4: r0 = syz_open_dev$sndpcmc(&(0x7f0000000240)='/dev/snd/pcmC#D#c\x00', 0x800, 0x4000) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_bt_hidp_HIDPCONNADD(r0, 0x400448c8, &(0x7f0000000400)=ANY=[@ANYRES32=r1, @ANYRES32=r2, @ANYBLOB="0000000300000000cbdde5", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB="4913711034b6403bef9b77e07c4303f0bfea1959f228dee9d61fcd693641e016415681e58f54dfb1e113271902d1dc6bdd1fab9e665d51617797f120d0363efbc97acd9b774cebf01c07d652b39f0a2e347e359c17ac2baf62ed35298921725c1afe04577817725a24ce5fcc4d8718b55e4b6487b6894451092657b9b22a47dec1f300747705d6173ad4f8abb8e51021fa8b242f14c50f8c81b6c3b1adabe9cbfe6b36b3b3334c09c56816a95d603725731989a66610bad6035938c0554c2b37ae92a11a"], @ANYBLOB="0300fdff01000100000000007ab10000be9036ec8b266da5c19fa394a51725359e4821a69afa05b88afecd23119fe60c93413c0be2f0762444d51111aeca4271f1f1"]) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0x22, &(0x7f0000000140)=0x1, 0x4) pwrite64(r3, &(0x7f0000000180)="06917fe01960334e6fa3662f67cfa18de11f8eb1ac6835a65100ebbbdcf9085b5060e0e5b0abdfa769022a3c210e8ba5c8fc84f902ca73ea34d6cb35641ac04776057c08097eeeccde55d88c8cae3910f418d612e53f779055fcb100d4a1f2f86add0199934c74a72510ffc7915937d6431525d0f3e294b60e25f29e135d6b471b98", 0x82, 0x2e) setsockopt$inet_tcp_int(r3, 0x6, 0x1e, &(0x7f0000000080)=0x1, 0x4) connect$inet(r3, &(0x7f0000000100)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x10}}, 0x10) r4 = openat(0xffffffffffffff9c, &(0x7f0000007000)='./file0\x00', 0x0, 0x20) getsockname(r4, &(0x7f0000000000)=@xdp, &(0x7f00000000c0)=0x80) getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(0xffffffffffffffff, 0x84, 0x1f, &(0x7f0000007040)={0x0, @in6={{0xa, 0x4e20, 0x9, @mcast1, 0xf46}}, 0x8df, 0x600c}, &(0x7f0000007100)=0x90) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r4, 0x84, 0x1a, &(0x7f0000007140)={r5, 0xab, "bb03b2577a526cdf5d44aaf167ff6ba5fb5d834abfd64286db26dab43b3a7cb9da49106b0ab095017dcd963994ebd27bae32ee257b52fc19d157e28bd299f5de8db5ccd1eac951cb66fc0077a2df9279b9d3b4fe240c48e348ad3fa4e9835d68847f936d7326b9a45cce53051d4ee37bca71cf9e45643a9a01c7d2b4af9f3ae78106e34d9f45ee2ddbff85792dd0d898175b2ed3b15f558be0967f8cb4145f8811acbe31b7ad2a629da123"}, &(0x7f0000007200)=0xb3) sendmmsg(r3, &(0x7f0000004c80)=[{{0x0, 0x18020000, &(0x7f0000004b40), 0x6c, &(0x7f0000004bc0)}}], 0x31e9cd3487dc94, 0x0) [ 569.301688] attempt to access beyond end of device [ 569.316541] loop1: rw=1, want=143, limit=112 [ 569.333458] attempt to access beyond end of device 06:08:10 executing program 2: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = socket$inet6(0xa, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp={0x2c, 0x0, 0x0, 0x3d}, 0x80) openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000900)="b6", 0x1}], 0x1, &(0x7f00000009c0)=[{0xa0, 0x1ff, 0x800, "434c94cf096ca2c6e3a8a6433ea1ccf960ad859f9cabeb13bbcd113f89069f10afdedfc1c2c2a6455dc4d1cc5b8c42e105db6d89e5394ec484d7db74d839a1021c616111655c01f0d6840a2cc4a77a0a2613073b0d1e9ab634a70c9cafd212450fe14e5e32b6ee05d11e22515b1b820c7425d601c3c41b459046978582375e37f0268020620ba8c96a1cf8de5399"}, {0x20, 0x113, 0x3, "64bc63fb1e5bc65e5043"}], 0xc0, 0x4040000}, 0x4000040) r2 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r2, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:08:10 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca580500000000000000b893123f89dedb03442000000000000000000000", @ANYRES32], 0x2}, 0x1, 0x0, 0x0, 0x0}, 0x0) [ 569.434675] loop1: rw=1, want=144, limit=112 [ 569.439183] attempt to access beyond end of device [ 569.460684] loop1: rw=1, want=145, limit=112 [ 569.478705] attempt to access beyond end of device 06:08:10 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000000)=[@textreal={0x8, &(0x7f00000005c0)="82780000260f017731f3d87e0b0f20e06635000020000f22e066b9800000c00f326635002000000f30640f02d766b8008000000f23d80f21f86635400000f00f23f8db13b85f078ee82e0f01cf"}], 0xaaaaaaaaaaaac60, 0x0, &(0x7f0000000100), 0x330) ioctl$KVM_NMI(r2, 0xae9a) ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f0000000040)={0x2, 0x0, [0x4b564d02, 0x1]}) ioctl$KVM_RUN(r2, 0xae80, 0x0) [ 569.485607] loop1: rw=1, want=1729, limit=112 06:08:10 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca580500000000000000b893123f89dedb03442000000000000000000000", @ANYRES32], 0x2}, 0x1, 0x0, 0x0, 0x0}, 0x0) [ 569.581593] audit: type=1804 audit(1539756490.333:128): pid=26212 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor5" name="/root/syzkaller-testdir239058742/syzkaller.b5Qjqx/324/file0/file0" dev="loop5" ino=290 res=1 06:08:10 executing program 2: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = socket$inet6(0xa, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp={0x2c, 0x0, 0x0, 0x3d}, 0x80) openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000900)="b6", 0x1}], 0x1, &(0x7f00000009c0)=[{0xa0, 0x1ff, 0x800, "434c94cf096ca2c6e3a8a6433ea1ccf960ad859f9cabeb13bbcd113f89069f10afdedfc1c2c2a6455dc4d1cc5b8c42e105db6d89e5394ec484d7db74d839a1021c616111655c01f0d6840a2cc4a77a0a2613073b0d1e9ab634a70c9cafd212450fe14e5e32b6ee05d11e22515b1b820c7425d601c3c41b459046978582375e37f0268020620ba8c96a1cf8de5399"}, {0x20, 0x113, 0x3, "64bc63fb1e5bc65e5043"}], 0xc0, 0x4040000}, 0x4000040) r2 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r2, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:08:10 executing program 5: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = socket$inet6(0xa, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp={0x2c, 0x0, 0x0, 0x3d}, 0x80) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r2, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000900)="b6d35518b48becfbd314d1fa96a307da879125869c71d40c5a385ce1d3af47c69a6acba0142b27475f2f890e1446d7e0851a8c84b5", 0x35}], 0x1, &(0x7f00000009c0)=[{0x90, 0x1ff, 0x800, "434c94cf096ca2c6e3a8a6433ea1ccf960ad859f9cabeb13bbcd113f89069f10afdedfc1c2c2a6455dc4d1cc5b8c42e105db6d89e5394ec484d7db74d839a1021c616111655c01f0d6840a2cc4a77a0a2613073b0d1e9ab634a70c9cafd212450fe14e5e32b6ee05d11e22515b1b820c7425d601c3c41b459046978582"}], 0x90, 0x4040000}, 0x4000040) r3 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r3, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab5687", 0x12, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) [ 570.015351] attempt to access beyond end of device [ 570.024903] loop5: rw=1, want=130, limit=112 [ 570.029377] attempt to access beyond end of device [ 570.048764] loop5: rw=1, want=131, limit=112 [ 570.053245] attempt to access beyond end of device [ 570.058450] loop5: rw=1, want=132, limit=112 [ 570.063006] attempt to access beyond end of device [ 570.068592] loop5: rw=1, want=133, limit=112 [ 570.073145] attempt to access beyond end of device [ 570.078277] loop5: rw=1, want=142, limit=112 [ 570.082820] attempt to access beyond end of device [ 570.088910] loop5: rw=1, want=143, limit=112 [ 570.093404] attempt to access beyond end of device [ 570.098491] loop5: rw=1, want=144, limit=112 [ 570.102965] attempt to access beyond end of device [ 570.108028] loop5: rw=1, want=145, limit=112 06:08:10 executing program 1: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) socket$inet6(0xa, 0x0, 0x0) r0 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp, 0x80) gettid() ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000600)}], 0x1, &(0x7f00000009c0)}, 0x0) openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x0, 0x0) sendto$unix(0xffffffffffffffff, &(0x7f0000000100), 0x0, 0x4844, &(0x7f0000000700)=@file={0x0, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r0) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:08:10 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca580500000000000000b893123f89dedb03442000000000000000000000", @ANYRES32], 0x2}, 0x1, 0x0, 0x0, 0x0}, 0x0) 06:08:10 executing program 3: r0 = memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) r2 = accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r4, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x3, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)=ANY=[@ANYBLOB="100000080000004000000010ffeb0780"], 0x10, 0x20040000}, 0x8001) sendto$unix(0xffffffffffffffff, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r1) r5 = open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) mount$9p_unix(&(0x7f0000000340)='./file0\x00', &(0x7f0000000380)='./file0/file0/file0\x00', &(0x7f00000003c0)='9p\x00', 0x2001401, &(0x7f0000000400)=ANY=[@ANYBLOB='trans=unix,access=user,uname=vboxnet1,smute=,fsmagic=0x0000000000000\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00']) r6 = geteuid() r7 = getegid() getsockopt$inet_IP_XFRM_POLICY(r2, 0x0, 0x11, &(0x7f0000000580)={{{@in=@remote, @in=@broadcast, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@ipv4={[], [], @local}}, 0x0, @in=@dev}}, &(0x7f00000004c0)=0xe8) stat(&(0x7f0000000680)='./file0\x00', &(0x7f0000000780)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) getsockopt$inet_IP_IPSEC_POLICY(r1, 0x0, 0x10, &(0x7f0000000900)={{{@in, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@loopback}, 0x0, @in6=@dev}}, &(0x7f00000006c0)=0xe8) lstat(&(0x7f0000000800)='./file0/file0/file0\x00', &(0x7f0000000840)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r12 = geteuid() fstat(r5, &(0x7f0000000a00)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) lstat(&(0x7f0000000a80)='./file0/file0/file0\x00', &(0x7f0000000ac0)={0x0, 0x0, 0x0, 0x0, 0x0}) lstat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000c00)={{{@in=@multicast2, @in=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast1}, 0x0, @in=@multicast2}}, &(0x7f0000000d00)=0xe8) getresgid(&(0x7f0000000d40), &(0x7f0000000d80)=0x0, &(0x7f0000000dc0)) fstat(r3, &(0x7f0000000e00)={0x0, 0x0, 0x0, 0x0, 0x0}) r19 = getgid() write$FUSE_DIRENTPLUS(r0, &(0x7f0000000e80)={0x498, 0x0, 0x4, [{{0x0, 0x0, 0x3b4, 0x9, 0x4, 0x2, {0x6, 0x2, 0x8000, 0xf4, 0x2, 0x5, 0x6, 0x7fffffff, 0x5, 0xffffffffffffff1d, 0xff, r6, r7, 0xc9ae, 0x1}}, {0x3, 0x9, 0xb, 0x5, "fd76626f786e6574312d2f"}}, {{0x2, 0x3, 0x9a, 0x40, 0xb51f, 0x6, {0x6, 0x5, 0x100000001, 0xfffffffffffffffb, 0x2, 0x3, 0x5, 0x4, 0x5, 0x0, 0x9, r8, r9, 0x3, 0x2}}, {0x4, 0x7, 0x12, 0x7, 'vmnet1self8md5sum\\'}}, {{0x1, 0x0, 0x15e, 0x7, 0xfffffffffffffffa, 0x8, {0x4, 0x21a1, 0x35, 0x3b9586d6, 0x84, 0x2, 0xc79, 0x80000000, 0x7, 0x5, 0xa0e, r10, r11, 0x9, 0xc579}}, {0x0, 0x3f, 0x9, 0xfffffffffffffe01, 'iocharset'}}, {{0x5, 0x2, 0xffffffffffffff80, 0x2, 0x0, 0x80000001, {0x1, 0x3, 0xe20f, 0x10000, 0x7fff, 0x4, 0x9, 0x9, 0x1, 0x9, 0x3ff, r12, r13, 0x9, 0x3}}, {0x2, 0x8, 0x4, 0xfffffffffffffff7, 'ppp0'}}, {{0x9, 0x2, 0x3, 0x2, 0x800, 0x5f, {0x3, 0x251a, 0x6, 0x31, 0x9, 0x8, 0x6, 0x2, 0x7, 0x101, 0x400, r14, r15, 0x7, 0x1}}, {0x5, 0xac17, 0x0, 0x100}}, {{0x0, 0x1, 0x9a, 0x6, 0x7fff, 0x200, {0x1, 0xd0e5, 0x9, 0x2, 0x100, 0x4, 0x1, 0x5, 0x6, 0x8, 0xffffffff00000000, r16, r17, 0xd4e, 0x4}}, {0x2, 0x31b6, 0x6, 0x6, 'system'}}, {{0x2, 0x1, 0xf19c, 0x68e, 0x7, 0x3, {0x4, 0x80, 0x369, 0x7, 0x100, 0x0, 0x100000001, 0x4ff, 0x9, 0x4, 0x7, r18, r19, 0x1b0, 0x6}}, {0x2, 0x7, 0x12, 0x800, '/dev/loop-control\x00'}}]}, 0x498) ioctl$KDSETMODE(r1, 0x4b3a, 0x29e) setxattr$trusted_overlay_nlink(&(0x7f0000000080)='./file0/file0/file0\x00', &(0x7f00000000c0)='trusted.overlay.nlink\x00', &(0x7f00000001c0)={'U-', 0x4b}, 0x28, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) ioctl$UI_GET_VERSION(r5, 0x8004552d, &(0x7f0000000480)) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:08:10 executing program 4: r0 = socket$kcm(0x29, 0x2, 0x0) fsetxattr$trusted_overlay_opaque(r0, &(0x7f0000000040)='trusted.overlay.opaque\x00', &(0x7f0000000080)='y\x00', 0x2, 0x1) setsockopt$kcm_KCM_RECV_DISABLE(r0, 0x119, 0x1, &(0x7f0000000000), 0x3) socket$kcm(0x29, 0x7, 0x0) 06:08:10 executing program 2: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = socket$inet6(0xa, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp={0x2c, 0x0, 0x0, 0x3d}, 0x80) openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000900)="b6", 0x1}], 0x1, &(0x7f00000009c0)=[{0xa0, 0x1ff, 0x800, "434c94cf096ca2c6e3a8a6433ea1ccf960ad859f9cabeb13bbcd113f89069f10afdedfc1c2c2a6455dc4d1cc5b8c42e105db6d89e5394ec484d7db74d839a1021c616111655c01f0d6840a2cc4a77a0a2613073b0d1e9ab634a70c9cafd212450fe14e5e32b6ee05d11e22515b1b820c7425d601c3c41b459046978582375e37f0268020620ba8c96a1cf8de5399"}, {0x20, 0x113, 0x3, "64bc63fb1e5bc65e5043"}], 0xc0, 0x4040000}, 0x4000040) r2 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r2, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) [ 570.115997] attempt to access beyond end of device [ 570.120966] loop5: rw=1, want=2178, limit=112 [ 570.155149] attempt to access beyond end of device [ 570.160134] loop1: rw=1, want=130, limit=112 06:08:10 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca580500000000000000b893123f89dedb03442000000000000000000000", @ANYRES32], 0x2}, 0x1, 0x0, 0x0, 0x0}, 0x0) [ 570.180376] attempt to access beyond end of device [ 570.186413] loop1: rw=1, want=131, limit=112 [ 570.194003] attempt to access beyond end of device 06:08:11 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca580500000000000000b893123f89dedb03442000000000000000000000", @ANYRES32], 0x2}, 0x1, 0x0, 0x0, 0x0}, 0x0) [ 570.266671] loop1: rw=1, want=132, limit=112 [ 570.276235] attempt to access beyond end of device [ 570.288266] loop1: rw=1, want=133, limit=112 06:08:11 executing program 4: r0 = openat$cgroup_int(0xffffffffffffffff, &(0x7f0000000240)='io.bfq.weight\x00', 0x2, 0x0) ftruncate(r0, 0x3f9c) getpeername(0xffffffffffffffff, &(0x7f0000000000)=@pppol2tpv3in6, &(0x7f0000000080)=0x80) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffff9c, 0x29, 0x22, &(0x7f00000000c0)={{{@in, @in=@multicast2}}, {{@in=@multicast2}, 0x0, @in6=@remote}}, &(0x7f00000001c0)=0xe8) syz_init_net_socket$nfc_llcp(0x27, 0x1, 0x1) r1 = open(&(0x7f0000000380)='./file0//ile0\x00', 0x8000000000, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) shmget$private(0x0, 0x2000, 0x80, &(0x7f0000ffd000/0x2000)=nil) shmget$private(0x0, 0x3000, 0x800, &(0x7f0000ffc000/0x3000)=nil) shmget(0x1, 0x2000, 0x78000620, &(0x7f0000ffb000/0x2000)=nil) r2 = shmget$private(0x0, 0x3000, 0x1000, &(0x7f0000ff9000/0x3000)=nil) shmctl$SHM_UNLOCK(r2, 0xc) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000000)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r4 = syz_open_dev$vcsn(&(0x7f0000000240)='/dev/vcs#\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40042406, &(0x7f0000000280)="2d245b8800") r5 = socket$nl_route(0x10, 0x3, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x4, &(0x7f0000000300)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(r4, &(0x7f00000003c0)={0x16, 0x98, 0xfa00, {&(0x7f00000002c0), 0x2, r6, 0x1c, 0x1, @ib={0x1b, 0x8, 0x5, {"b2fd09c0ca7f03cb56d0042b9140e818"}, 0x4, 0xfff}}}, 0xa0) r7 = dup2(r5, r3) ioctl$TIOCGPGRP(r1, 0x540f, &(0x7f0000000200)=0x0) perf_event_open(&(0x7f0000000100)={0x0, 0x70, 0x3f, 0x0, 0x3, 0x5, 0x0, 0x7, 0x0, 0xa, 0x3, 0xf5e, 0x40, 0x7, 0x0, 0x65, 0x6, 0x2, 0x6, 0xeef, 0x100000000, 0x6, 0x5, 0x0, 0xa6, 0x71, 0x9, 0x1, 0x81, 0x100000001, 0xf1d, 0x183a27a7, 0x0, 0x3, 0x8000, 0x8001, 0xffffffff, 0x0, 0x0, 0x20, 0x4, @perf_bp={&(0x7f00000000c0)}, 0x0, 0x3, 0x5, 0x7, 0x6, 0x0, 0x4}, r8, 0x3, r1, 0xb) write$FUSE_NOTIFY_STORE(0xffffffffffffffff, &(0x7f0000000900)=ANY=[@ANYBLOB="28000000040000000000000000000000001000fbffffffffffffff0008000084330f10cb47ea231bf7e90000000000000000d6725aece72693e13cdb1def8c79bb84019dafa46471ed952ce018aceb7cbb5edc0c8d0459b093f1665ea92ade3952f064db6e56511cf40f84f8f691320fd180291d19532291178da17b61df9bedffc56f79f888f68204a032a753ebd8bfdf0c3387b437e035fd29a3edfcf5b1e3131ebcd6904873451ddbc5681b93257b70168200b2bce53fab5a0958a04ac96c1f15291f89c82de17c5f7e12f43d2ff31eec5ba49d88aba214374dcaef57ef90b1de63641a749fe5c474fa46b986ba512385cdc5a5be9072d389545fa4bd059992aff5da06b66c4e9621f86b142f7ffbbc5c85a17d0a84ed6b29bc2b02f186943f5a4306b3ad69292a7d030b8e33fc2ab25e2a4cac0705292bbc4f2082cfd2ca628b2c0eb693c61fa6fe0e0fb88b5939df534033d876f50cdfdd8494e1675a85314e4fcef11844c37594fd65a28555ae5a3c3b6bc7bf09f0253cd48a15bf8b99176c65562c07b44bf1e5439b7721320a4e90fda2b0"], 0x28) getsockopt$inet_sctp_SCTP_SOCKOPT_PEELOFF(r7, 0x84, 0x66, &(0x7f0000000480)={0x0, 0x100}, &(0x7f0000000540)=0x8) getsockopt$inet_sctp_SCTP_CONTEXT(r4, 0x84, 0x11, &(0x7f0000000580)={r9, 0x1}, &(0x7f00000005c0)=0x8) getsockopt$inet_mtu(r4, 0x0, 0xa, &(0x7f0000000500), &(0x7f0000000640)=0x4) socket$netlink(0x10, 0x3, 0x0) bind$netlink(0xffffffffffffffff, &(0x7f0000461000)={0x10, 0x0, 0x2, 0x1}, 0xc) [ 570.319809] attempt to access beyond end of device [ 570.365194] loop1: rw=1, want=142, limit=112 [ 570.369740] attempt to access beyond end of device [ 570.417758] loop1: rw=1, want=143, limit=112 [ 570.443495] attempt to access beyond end of device [ 570.504455] loop1: rw=1, want=144, limit=112 [ 570.505484] FAT-fs (loop3): Unrecognized mount option "./file0" or missing value [ 570.508968] attempt to access beyond end of device [ 570.508989] loop1: rw=1, want=145, limit=112 [ 570.539159] buffer_io_error: 69 callbacks suppressed [ 570.539170] Buffer I/O error on dev loop1, logical block 144, lost async page write 06:08:11 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca580500000000000000b893123f89dedb03442000000000000000000000", @ANYRES32], 0x2}, 0x1, 0x0, 0x0, 0x0}, 0x0) [ 570.571356] attempt to access beyond end of device [ 570.589253] loop1: rw=1, want=2178, limit=112 06:08:11 executing program 3: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r1, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x3, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)=[{0x10, 0x107, 0x5}], 0x10, 0x20040000}, 0x8001) sendto$unix(0xffffffffffffffff, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r0) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x100) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffff4294, 0x0, 0x0, 0x0, 0x0, 0x400000000000, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x8000000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0xcceb, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:08:11 executing program 5: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = socket$inet6(0xa, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp={0x2c, 0x0, 0x0, 0x3d}, 0x80) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r2, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000900)="b6d35518b48becfbd314d1fa96a307da879125869c71d40c5a385ce1d3af47c69a6acba0142b27475f2f890e1446d7e0851a8c84b5", 0x35}], 0x1, &(0x7f00000009c0)=[{0x90, 0x1ff, 0x800, "434c94cf096ca2c6e3a8a6433ea1ccf960ad859f9cabeb13bbcd113f89069f10afdedfc1c2c2a6455dc4d1cc5b8c42e105db6d89e5394ec484d7db74d839a1021c616111655c01f0d6840a2cc4a77a0a2613073b0d1e9ab634a70c9cafd212450fe14e5e32b6ee05d11e22515b1b820c7425d601c3c41b459046978582"}], 0x90, 0x4040000}, 0x4000040) r3 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r3, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc", 0x15, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:08:11 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca580500000000000000b893123f89dedb03442000000000000000000000", @ANYRES32], 0x2}, 0x1, 0x0, 0x0, 0x0}, 0x0) 06:08:11 executing program 1: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) socket$inet6(0xa, 0x0, 0x0) open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp, 0x80) gettid() ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000600)}], 0x1, &(0x7f00000009c0)}, 0x0) openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x0, 0x0) sendto$unix(0xffffffffffffffff, &(0x7f0000000100), 0x0, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(0xffffffffffffffff) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:08:11 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca580500000000000000b893123f89dedb03442000000000000000000000", @ANYRES32], 0x2}, 0x1, 0x0, 0x0, 0x0}, 0x0) 06:08:11 executing program 2: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) socket$inet6(0xa, 0x0, 0x0) r0 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp={0x2c, 0x0, 0x0, 0x3d}, 0x80) r1 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r1, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000900)="b6", 0x1}], 0x1, &(0x7f00000009c0)=[{0xa0, 0x1ff, 0x800, "434c94cf096ca2c6e3a8a6433ea1ccf960ad859f9cabeb13bbcd113f89069f10afdedfc1c2c2a6455dc4d1cc5b8c42e105db6d89e5394ec484d7db74d839a1021c616111655c01f0d6840a2cc4a77a0a2613073b0d1e9ab634a70c9cafd212450fe14e5e32b6ee05d11e22515b1b820c7425d601c3c41b459046978582375e37f0268020620ba8c96a1cf8de5399"}, {0x20, 0x113, 0x3, "64bc63fb1e5bc65e5043"}], 0xc0, 0x4040000}, 0x4000040) r2 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r2, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r0) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:08:11 executing program 5: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = socket$inet6(0xa, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp={0x2c, 0x0, 0x0, 0x3d}, 0x80) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r2, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000900)="b6d35518b48becfbd314d1fa96a307da879125869c71d40c5a385ce1d3af47c69a6acba0142b27475f2f890e1446d7e0851a8c84b5", 0x35}], 0x1, &(0x7f00000009c0)=[{0x90, 0x1ff, 0x800, "434c94cf096ca2c6e3a8a6433ea1ccf960ad859f9cabeb13bbcd113f89069f10afdedfc1c2c2a6455dc4d1cc5b8c42e105db6d89e5394ec484d7db74d839a1021c616111655c01f0d6840a2cc4a77a0a2613073b0d1e9ab634a70c9cafd212450fe14e5e32b6ee05d11e22515b1b820c7425d601c3c41b459046978582"}], 0x90, 0x4040000}, 0x4000040) r3 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r3, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc", 0x15, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:08:11 executing program 3: r0 = memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) r2 = accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) setsockopt$inet_sctp_SCTP_RECVRCVINFO(r2, 0x84, 0x20, &(0x7f0000000080)=0x7fffffff, 0x4) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r3, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x3, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)=[{0x10, 0x107, 0x5}], 0x10, 0x20040000}, 0x8001) sendto$unix(0xffffffffffffffff, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_GET_FREE(r1, 0x4c82) ioctl$LOOP_CTL_GET_FREE(r0, 0x4c82) r4 = ioctl$LOOP_CTL_GET_FREE(r0, 0x4c82) ioctl$LOOP_CTL_REMOVE(r3, 0x4c81, r4) fchdir(r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) setsockopt$bt_BT_SECURITY(r0, 0x112, 0x4, &(0x7f00000000c0)={0x9, 0x100}, 0x2) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:08:11 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca580500000000000000b893123f89dedb03442000000000000000000000", @ANYRES32], 0x2}, 0x1, 0x0, 0x0, 0x0}, 0x0) 06:08:11 executing program 4: r0 = openat$cgroup_int(0xffffffffffffffff, &(0x7f0000000240)='io.bfq.weight\x00', 0x2, 0x0) ftruncate(r0, 0x3f9c) getpeername(0xffffffffffffffff, &(0x7f0000000000)=@pppol2tpv3in6, &(0x7f0000000080)=0x80) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffff9c, 0x29, 0x22, &(0x7f00000000c0)={{{@in, @in=@multicast2}}, {{@in=@multicast2}, 0x0, @in6=@remote}}, &(0x7f00000001c0)=0xe8) syz_init_net_socket$nfc_llcp(0x27, 0x1, 0x1) r1 = open(&(0x7f0000000380)='./file0//ile0\x00', 0x8000000000, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) shmget$private(0x0, 0x2000, 0x80, &(0x7f0000ffd000/0x2000)=nil) shmget$private(0x0, 0x3000, 0x800, &(0x7f0000ffc000/0x3000)=nil) shmget(0x1, 0x2000, 0x78000620, &(0x7f0000ffb000/0x2000)=nil) r2 = shmget$private(0x0, 0x3000, 0x1000, &(0x7f0000ff9000/0x3000)=nil) shmctl$SHM_UNLOCK(r2, 0xc) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000000)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r4 = syz_open_dev$vcsn(&(0x7f0000000240)='/dev/vcs#\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40042406, &(0x7f0000000280)="2d245b8800") r5 = socket$nl_route(0x10, 0x3, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x4, &(0x7f0000000300)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(r4, &(0x7f00000003c0)={0x16, 0x98, 0xfa00, {&(0x7f00000002c0), 0x2, r6, 0x1c, 0x1, @ib={0x1b, 0x8, 0x5, {"b2fd09c0ca7f03cb56d0042b9140e818"}, 0x4, 0xfff}}}, 0xa0) r7 = dup2(r5, r3) ioctl$TIOCGPGRP(r1, 0x540f, &(0x7f0000000200)=0x0) perf_event_open(&(0x7f0000000100)={0x0, 0x70, 0x3f, 0x0, 0x3, 0x5, 0x0, 0x7, 0x0, 0xa, 0x3, 0xf5e, 0x40, 0x7, 0x0, 0x65, 0x6, 0x2, 0x6, 0xeef, 0x100000000, 0x6, 0x5, 0x0, 0xa6, 0x71, 0x9, 0x1, 0x81, 0x100000001, 0xf1d, 0x183a27a7, 0x0, 0x3, 0x8000, 0x8001, 0xffffffff, 0x0, 0x0, 0x20, 0x4, @perf_bp={&(0x7f00000000c0)}, 0x0, 0x3, 0x5, 0x7, 0x6, 0x0, 0x4}, r8, 0x3, r1, 0xb) write$FUSE_NOTIFY_STORE(0xffffffffffffffff, &(0x7f0000000900)=ANY=[@ANYBLOB="28000000040000000000000000000000001000fbffffffffffffff0008000084330f10cb47ea231bf7e90000000000000000d6725aece72693e13cdb1def8c79bb84019dafa46471ed952ce018aceb7cbb5edc0c8d0459b093f1665ea92ade3952f064db6e56511cf40f84f8f691320fd180291d19532291178da17b61df9bedffc56f79f888f68204a032a753ebd8bfdf0c3387b437e035fd29a3edfcf5b1e3131ebcd6904873451ddbc5681b93257b70168200b2bce53fab5a0958a04ac96c1f15291f89c82de17c5f7e12f43d2ff31eec5ba49d88aba214374dcaef57ef90b1de63641a749fe5c474fa46b986ba512385cdc5a5be9072d389545fa4bd059992aff5da06b66c4e9621f86b142f7ffbbc5c85a17d0a84ed6b29bc2b02f186943f5a4306b3ad69292a7d030b8e33fc2ab25e2a4cac0705292bbc4f2082cfd2ca628b2c0eb693c61fa6fe0e0fb88b5939df534033d876f50cdfdd8494e1675a85314e4fcef11844c37594fd65a28555ae5a3c3b6bc7bf09f0253cd48a15bf8b99176c65562c07b44bf1e5439b7721320a4e90fda2b0"], 0x28) getsockopt$inet_sctp_SCTP_SOCKOPT_PEELOFF(r7, 0x84, 0x66, &(0x7f0000000480)={0x0, 0x100}, &(0x7f0000000540)=0x8) getsockopt$inet_sctp_SCTP_CONTEXT(r4, 0x84, 0x11, &(0x7f0000000580)={r9, 0x1}, &(0x7f00000005c0)=0x8) getsockopt$inet_mtu(r4, 0x0, 0xa, &(0x7f0000000500), &(0x7f0000000640)=0x4) socket$netlink(0x10, 0x3, 0x0) bind$netlink(0xffffffffffffffff, &(0x7f0000461000)={0x10, 0x0, 0x2, 0x1}, 0xc) [ 571.146230] attempt to access beyond end of device [ 571.151233] loop3: rw=1, want=130, limit=112 [ 571.173953] Buffer I/O error on dev loop3, logical block 129, lost async page write [ 571.249248] attempt to access beyond end of device 06:08:12 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca580500000000000000b893123f89dedb03442000000000000000000000", @ANYRES32], 0x2}}, 0x2) [ 571.277256] loop3: rw=1, want=131, limit=112 06:08:12 executing program 2: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) socket$inet6(0xa, 0x0, 0x0) r0 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp={0x2c, 0x0, 0x0, 0x3d}, 0x80) r1 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r1, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000900)="b6", 0x1}], 0x1, &(0x7f00000009c0)=[{0xa0, 0x1ff, 0x800, "434c94cf096ca2c6e3a8a6433ea1ccf960ad859f9cabeb13bbcd113f89069f10afdedfc1c2c2a6455dc4d1cc5b8c42e105db6d89e5394ec484d7db74d839a1021c616111655c01f0d6840a2cc4a77a0a2613073b0d1e9ab634a70c9cafd212450fe14e5e32b6ee05d11e22515b1b820c7425d601c3c41b459046978582375e37f0268020620ba8c96a1cf8de5399"}, {0x20, 0x113, 0x3, "64bc63fb1e5bc65e5043"}], 0xc0, 0x4040000}, 0x4000040) r2 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r2, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r0) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) [ 571.321875] Buffer I/O error on dev loop3, logical block 130, lost async page write 06:08:12 executing program 1: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) socket$inet6(0xa, 0x0, 0x0) open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp, 0x80) gettid() ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000600)}], 0x1, &(0x7f00000009c0)}, 0x0) openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x0, 0x0) sendto$unix(0xffffffffffffffff, &(0x7f0000000100), 0x0, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(0xffffffffffffffff) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) [ 571.368727] attempt to access beyond end of device [ 571.387977] loop3: rw=1, want=132, limit=112 [ 571.405431] Buffer I/O error on dev loop3, logical block 131, lost async page write 06:08:12 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca580500000000000000b893123f89dedb03442000000000000000000000", @ANYRES32], 0x2}}, 0xfffffff0) [ 571.438566] attempt to access beyond end of device [ 571.452031] loop3: rw=1, want=133, limit=112 [ 571.466180] Buffer I/O error on dev loop3, logical block 132, lost async page write 06:08:12 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca580500000000000000b893123f89dedb03442000000000000000000000", @ANYRES32], 0x2}}, 0xf0ffffff00000000) [ 571.515077] attempt to access beyond end of device [ 571.564722] loop3: rw=1, want=142, limit=112 [ 571.593736] Buffer I/O error on dev loop3, logical block 141, lost async page write [ 571.681784] attempt to access beyond end of device 06:08:12 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca580500000000000000b893123f89dedb03442000000000000000000000", @ANYRES32], 0x2}}, 0x100000000000000) [ 571.707633] loop3: rw=1, want=143, limit=112 06:08:12 executing program 1: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) socket$inet6(0xa, 0x0, 0x0) open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp, 0x80) gettid() ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000600)}], 0x1, &(0x7f00000009c0)}, 0x0) openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x0, 0x0) sendto$unix(0xffffffffffffffff, &(0x7f0000000100), 0x0, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(0xffffffffffffffff) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) [ 571.736691] Buffer I/O error on dev loop3, logical block 142, lost async page write [ 571.776069] attempt to access beyond end of device 06:08:12 executing program 4: r0 = openat$cgroup_int(0xffffffffffffffff, &(0x7f0000000240)='io.bfq.weight\x00', 0x2, 0x0) ftruncate(r0, 0x3f9c) getpeername(0xffffffffffffffff, &(0x7f0000000000)=@pppol2tpv3in6, &(0x7f0000000080)=0x80) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffff9c, 0x29, 0x22, &(0x7f00000000c0)={{{@in, @in=@multicast2}}, {{@in=@multicast2}, 0x0, @in6=@remote}}, &(0x7f00000001c0)=0xe8) syz_init_net_socket$nfc_llcp(0x27, 0x1, 0x1) r1 = open(&(0x7f0000000380)='./file0//ile0\x00', 0x8000000000, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) shmget$private(0x0, 0x2000, 0x80, &(0x7f0000ffd000/0x2000)=nil) shmget$private(0x0, 0x3000, 0x800, &(0x7f0000ffc000/0x3000)=nil) shmget(0x1, 0x2000, 0x78000620, &(0x7f0000ffb000/0x2000)=nil) r2 = shmget$private(0x0, 0x3000, 0x1000, &(0x7f0000ff9000/0x3000)=nil) shmctl$SHM_UNLOCK(r2, 0xc) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000000)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r4 = syz_open_dev$vcsn(&(0x7f0000000240)='/dev/vcs#\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40042406, &(0x7f0000000280)="2d245b8800") r5 = socket$nl_route(0x10, 0x3, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x4, &(0x7f0000000300)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(r4, &(0x7f00000003c0)={0x16, 0x98, 0xfa00, {&(0x7f00000002c0), 0x2, r6, 0x1c, 0x1, @ib={0x1b, 0x8, 0x5, {"b2fd09c0ca7f03cb56d0042b9140e818"}, 0x4, 0xfff}}}, 0xa0) r7 = dup2(r5, r3) ioctl$TIOCGPGRP(r1, 0x540f, &(0x7f0000000200)=0x0) perf_event_open(&(0x7f0000000100)={0x0, 0x70, 0x3f, 0x0, 0x3, 0x5, 0x0, 0x7, 0x0, 0xa, 0x3, 0xf5e, 0x40, 0x7, 0x0, 0x65, 0x6, 0x2, 0x6, 0xeef, 0x100000000, 0x6, 0x5, 0x0, 0xa6, 0x71, 0x9, 0x1, 0x81, 0x100000001, 0xf1d, 0x183a27a7, 0x0, 0x3, 0x8000, 0x8001, 0xffffffff, 0x0, 0x0, 0x20, 0x4, @perf_bp={&(0x7f00000000c0)}, 0x0, 0x3, 0x5, 0x7, 0x6, 0x0, 0x4}, r8, 0x3, r1, 0xb) write$FUSE_NOTIFY_STORE(0xffffffffffffffff, &(0x7f0000000900)=ANY=[@ANYBLOB="28000000040000000000000000000000001000fbffffffffffffff0008000084330f10cb47ea231bf7e90000000000000000d6725aece72693e13cdb1def8c79bb84019dafa46471ed952ce018aceb7cbb5edc0c8d0459b093f1665ea92ade3952f064db6e56511cf40f84f8f691320fd180291d19532291178da17b61df9bedffc56f79f888f68204a032a753ebd8bfdf0c3387b437e035fd29a3edfcf5b1e3131ebcd6904873451ddbc5681b93257b70168200b2bce53fab5a0958a04ac96c1f15291f89c82de17c5f7e12f43d2ff31eec5ba49d88aba214374dcaef57ef90b1de63641a749fe5c474fa46b986ba512385cdc5a5be9072d389545fa4bd059992aff5da06b66c4e9621f86b142f7ffbbc5c85a17d0a84ed6b29bc2b02f186943f5a4306b3ad69292a7d030b8e33fc2ab25e2a4cac0705292bbc4f2082cfd2ca628b2c0eb693c61fa6fe0e0fb88b5939df534033d876f50cdfdd8494e1675a85314e4fcef11844c37594fd65a28555ae5a3c3b6bc7bf09f0253cd48a15bf8b99176c65562c07b44bf1e5439b7721320a4e90fda2b0"], 0x28) getsockopt$inet_sctp_SCTP_SOCKOPT_PEELOFF(r7, 0x84, 0x66, &(0x7f0000000480)={0x0, 0x100}, &(0x7f0000000540)=0x8) getsockopt$inet_sctp_SCTP_CONTEXT(r4, 0x84, 0x11, &(0x7f0000000580)={r9, 0x1}, &(0x7f00000005c0)=0x8) getsockopt$inet_mtu(r4, 0x0, 0xa, &(0x7f0000000500), &(0x7f0000000640)=0x4) socket$netlink(0x10, 0x3, 0x0) bind$netlink(0xffffffffffffffff, &(0x7f0000461000)={0x10, 0x0, 0x2, 0x1}, 0xc) [ 571.808452] loop3: rw=1, want=144, limit=112 [ 571.826287] Buffer I/O error on dev loop3, logical block 143, lost async page write 06:08:12 executing program 5: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = socket$inet6(0xa, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp={0x2c, 0x0, 0x0, 0x3d}, 0x80) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r2, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000900)="b6d35518b48becfbd314d1fa96a307da879125869c71d40c5a385ce1d3af47c69a6acba0142b27475f2f890e1446d7e0851a8c84b5", 0x35}], 0x1, &(0x7f00000009c0)=[{0x90, 0x1ff, 0x800, "434c94cf096ca2c6e3a8a6433ea1ccf960ad859f9cabeb13bbcd113f89069f10afdedfc1c2c2a6455dc4d1cc5b8c42e105db6d89e5394ec484d7db74d839a1021c616111655c01f0d6840a2cc4a77a0a2613073b0d1e9ab634a70c9cafd212450fe14e5e32b6ee05d11e22515b1b820c7425d601c3c41b459046978582"}], 0x90, 0x4040000}, 0x4000040) r3 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r3, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc", 0x15, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) [ 571.854286] attempt to access beyond end of device [ 571.863938] loop3: rw=1, want=145, limit=112 [ 571.868559] Buffer I/O error on dev loop3, logical block 144, lost async page write [ 571.905444] attempt to access beyond end of device [ 571.910604] loop5: rw=1, want=130, limit=112 [ 571.921368] Buffer I/O error on dev loop5, logical block 129, lost async page write [ 571.932618] attempt to access beyond end of device [ 571.938081] loop5: rw=1, want=131, limit=112 [ 571.942676] attempt to access beyond end of device [ 571.983199] loop5: rw=1, want=132, limit=112 [ 572.014011] attempt to access beyond end of device [ 572.059980] loop5: rw=1, want=133, limit=112 [ 572.091547] attempt to access beyond end of device [ 572.096614] loop5: rw=1, want=142, limit=112 [ 572.101066] attempt to access beyond end of device [ 572.111571] loop5: rw=1, want=143, limit=112 [ 572.140729] attempt to access beyond end of device [ 572.140754] loop5: rw=1, want=144, limit=112 [ 572.150208] attempt to access beyond end of device [ 572.192521] loop5: rw=1, want=145, limit=112 [ 572.226887] attempt to access beyond end of device [ 572.264958] loop5: rw=1, want=2178, limit=112 [ 572.993926] audit: type=1804 audit(1539756493.743:129): pid=26444 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor3" name="/root/syzkaller-testdir399687728/syzkaller.SA5dD7/413/file0/file0" dev="loop3" ino=299 res=1 06:08:13 executing program 3: memfd_create(&(0x7f0000000340)="696f314d7dbca4ec2f9907006d12f29fa8ac824174f7d5ce4d140e393511c92f1feca64d7d134c072a0675236f9dce6952fa6d52eca829c067b50fee18d35e69b1d3ceda33cb21a5ef062dd353ab3dfd31951b3eeb4c3bfee0c34ef4e359652ccb862203bd96f969104e64cbbdb808daa13a000000000000000000000000000000", 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) r1 = accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) r3 = gettid() ioctl$LOOP_CTL_REMOVE(r2, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x3, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)=[{0x10, 0x107, 0x5}], 0x10, 0x20040000}, 0x8001) sendto$unix(0xffffffffffffffff, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r0) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) recvmmsg(r1, &(0x7f0000003f00)=[{{0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000080)=""/82, 0x52}, {&(0x7f0000000400)=""/75, 0x4b}], 0x2, &(0x7f0000000900)=""/4096, 0x1000, 0xfffffffffffffffe}, 0x7}, {{&(0x7f0000000480)=@ethernet={0x0, @broadcast}, 0x80, &(0x7f0000001ac0)=[{&(0x7f0000000580)=""/139, 0x8b}, {&(0x7f0000000640)=""/22, 0x16}, {&(0x7f0000000680)=""/23, 0x17}, {&(0x7f0000000780)=""/128, 0x80}, {&(0x7f0000000800)=""/98, 0x62}, {&(0x7f0000001900)=""/205, 0xcd}, {&(0x7f0000001a00)=""/132, 0x84}], 0x7, &(0x7f00000006c0)=""/61, 0x3d, 0x81}, 0x10001}, {{&(0x7f0000001b40)=@nl=@unspec, 0x80, &(0x7f0000003040)=[{&(0x7f0000001bc0)=""/4096, 0x1000}, {&(0x7f0000002bc0)=""/79, 0x4f}, {&(0x7f0000002c40)=""/230, 0xe6}, {&(0x7f0000002d40)=""/171, 0xab}, {&(0x7f0000002e00)=""/188, 0xbc}, {&(0x7f0000002ec0)=""/103, 0x67}, {&(0x7f0000002f40)=""/241, 0xf1}], 0x7, &(0x7f00000030c0)=""/235, 0xeb, 0xffffffff}, 0x7fff}, {{0x0, 0x0, &(0x7f0000000880)=[{&(0x7f00000031c0)=""/91, 0x5b}, {&(0x7f0000003240)=""/177, 0xb1}, {&(0x7f0000003300)=""/222, 0xde}, {&(0x7f0000003400)=""/151, 0x97}], 0x4, &(0x7f00000034c0)=""/170, 0xaa, 0x3}, 0x5}, {{&(0x7f0000003580)=@nfc_llcp, 0x80, &(0x7f0000003800)=[{&(0x7f0000003600)=""/150, 0x96}, {&(0x7f00000036c0)=""/25, 0x19}, {&(0x7f0000003700)=""/38, 0x26}, {&(0x7f0000003740)=""/142, 0x8e}], 0x4, &(0x7f0000003840)=""/188, 0xbc, 0xff}, 0x734}, {{&(0x7f0000003900)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @link_local}, 0x80, &(0x7f0000003a40)=[{&(0x7f0000003980)=""/165, 0xa5}], 0x1, &(0x7f0000003a80)=""/93, 0x5d}, 0xdeb}, {{&(0x7f0000003b80)=@generic, 0x80, &(0x7f0000003b00)=[{&(0x7f0000003c00)=""/164, 0xa4}], 0x1, 0x0, 0x0, 0x7}, 0x10000}, {{&(0x7f0000003cc0)=@rc, 0x80, &(0x7f0000003e80)=[{&(0x7f0000003d40)=""/239, 0xef}, {&(0x7f0000003e40)=""/19, 0x13}], 0x2, &(0x7f0000003ec0)=""/44, 0x2c, 0xfff}, 0x45}], 0x8, 0x2, &(0x7f0000004100)) r4 = ioctl$LOOP_CTL_GET_FREE(r0, 0x4c82) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, r4) tkill(r3, 0x3) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:08:13 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca580500000000000000b893123f89dedb03442000000000000000000000", @ANYRES32], 0x2}}, 0xfffff000) 06:08:13 executing program 2: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) socket$inet6(0xa, 0x0, 0x0) r0 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp={0x2c, 0x0, 0x0, 0x3d}, 0x80) r1 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r1, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000900)="b6", 0x1}], 0x1, &(0x7f00000009c0)=[{0xa0, 0x1ff, 0x800, "434c94cf096ca2c6e3a8a6433ea1ccf960ad859f9cabeb13bbcd113f89069f10afdedfc1c2c2a6455dc4d1cc5b8c42e105db6d89e5394ec484d7db74d839a1021c616111655c01f0d6840a2cc4a77a0a2613073b0d1e9ab634a70c9cafd212450fe14e5e32b6ee05d11e22515b1b820c7425d601c3c41b459046978582375e37f0268020620ba8c96a1cf8de5399"}, {0x20, 0x113, 0x3, "64bc63fb1e5bc65e5043"}], 0xc0, 0x4040000}, 0x4000040) r2 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r2, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r0) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:08:13 executing program 1: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) socket$inet6(0xa, 0x0, 0x0) r0 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp, 0x80) gettid() ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000600)}], 0x1, &(0x7f00000009c0)}, 0x0) openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x0, 0x0) sendto$unix(0xffffffffffffffff, &(0x7f0000000100), 0x0, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r0) open$dir(&(0x7f0000000240)='./file0\x00', 0x0, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:08:13 executing program 4: r0 = openat$cgroup_int(0xffffffffffffffff, &(0x7f0000000240)='io.bfq.weight\x00', 0x2, 0x0) ftruncate(r0, 0x3f9c) getpeername(0xffffffffffffffff, &(0x7f0000000000)=@pppol2tpv3in6, &(0x7f0000000080)=0x80) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffff9c, 0x29, 0x22, &(0x7f00000000c0)={{{@in, @in=@multicast2}}, {{@in=@multicast2}, 0x0, @in6=@remote}}, &(0x7f00000001c0)=0xe8) syz_init_net_socket$nfc_llcp(0x27, 0x1, 0x1) r1 = open(&(0x7f0000000380)='./file0//ile0\x00', 0x8000000000, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) shmget$private(0x0, 0x2000, 0x80, &(0x7f0000ffd000/0x2000)=nil) shmget$private(0x0, 0x3000, 0x800, &(0x7f0000ffc000/0x3000)=nil) shmget(0x1, 0x2000, 0x78000620, &(0x7f0000ffb000/0x2000)=nil) r2 = shmget$private(0x0, 0x3000, 0x1000, &(0x7f0000ff9000/0x3000)=nil) shmctl$SHM_UNLOCK(r2, 0xc) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000000)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r4 = syz_open_dev$vcsn(&(0x7f0000000240)='/dev/vcs#\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40042406, &(0x7f0000000280)="2d245b8800") r5 = socket$nl_route(0x10, 0x3, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x4, &(0x7f0000000300)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_MCAST(r4, &(0x7f00000003c0)={0x16, 0x98, 0xfa00, {&(0x7f00000002c0), 0x2, r6, 0x1c, 0x1, @ib={0x1b, 0x8, 0x5, {"b2fd09c0ca7f03cb56d0042b9140e818"}, 0x4, 0xfff}}}, 0xa0) r7 = dup2(r5, r3) ioctl$TIOCGPGRP(r1, 0x540f, &(0x7f0000000200)=0x0) perf_event_open(&(0x7f0000000100)={0x0, 0x70, 0x3f, 0x0, 0x3, 0x5, 0x0, 0x7, 0x0, 0xa, 0x3, 0xf5e, 0x40, 0x7, 0x0, 0x65, 0x6, 0x2, 0x6, 0xeef, 0x100000000, 0x6, 0x5, 0x0, 0xa6, 0x71, 0x9, 0x1, 0x81, 0x100000001, 0xf1d, 0x183a27a7, 0x0, 0x3, 0x8000, 0x8001, 0xffffffff, 0x0, 0x0, 0x20, 0x4, @perf_bp={&(0x7f00000000c0)}, 0x0, 0x3, 0x5, 0x7, 0x6, 0x0, 0x4}, r8, 0x3, r1, 0xb) write$FUSE_NOTIFY_STORE(0xffffffffffffffff, &(0x7f0000000900)=ANY=[@ANYBLOB="28000000040000000000000000000000001000fbffffffffffffff0008000084330f10cb47ea231bf7e90000000000000000d6725aece72693e13cdb1def8c79bb84019dafa46471ed952ce018aceb7cbb5edc0c8d0459b093f1665ea92ade3952f064db6e56511cf40f84f8f691320fd180291d19532291178da17b61df9bedffc56f79f888f68204a032a753ebd8bfdf0c3387b437e035fd29a3edfcf5b1e3131ebcd6904873451ddbc5681b93257b70168200b2bce53fab5a0958a04ac96c1f15291f89c82de17c5f7e12f43d2ff31eec5ba49d88aba214374dcaef57ef90b1de63641a749fe5c474fa46b986ba512385cdc5a5be9072d389545fa4bd059992aff5da06b66c4e9621f86b142f7ffbbc5c85a17d0a84ed6b29bc2b02f186943f5a4306b3ad69292a7d030b8e33fc2ab25e2a4cac0705292bbc4f2082cfd2ca628b2c0eb693c61fa6fe0e0fb88b5939df534033d876f50cdfdd8494e1675a85314e4fcef11844c37594fd65a28555ae5a3c3b6bc7bf09f0253cd48a15bf8b99176c65562c07b44bf1e5439b7721320a4e90fda2b0"], 0x28) getsockopt$inet_sctp_SCTP_SOCKOPT_PEELOFF(r7, 0x84, 0x66, &(0x7f0000000480)={0x0, 0x100}, &(0x7f0000000540)=0x8) getsockopt$inet_sctp_SCTP_CONTEXT(r4, 0x84, 0x11, &(0x7f0000000580)={r9, 0x1}, &(0x7f00000005c0)=0x8) getsockopt$inet_mtu(r4, 0x0, 0xa, &(0x7f0000000500), &(0x7f0000000640)=0x4) socket$netlink(0x10, 0x3, 0x0) bind$netlink(0xffffffffffffffff, &(0x7f0000461000)={0x10, 0x0, 0x2, 0x1}, 0xc) [ 573.036033] audit: type=1804 audit(1539756493.783:130): pid=26432 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor3" name="/root/syzkaller-testdir399687728/syzkaller.SA5dD7/413/file0/file0" dev="loop3" ino=299 res=1 [ 573.106918] attempt to access beyond end of device [ 573.111909] loop3: rw=1, want=130, limit=112 [ 573.152269] attempt to access beyond end of device [ 573.219954] loop3: rw=1, want=131, limit=112 06:08:14 executing program 5: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = socket$inet6(0xa, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp={0x2c, 0x0, 0x0, 0x3d}, 0x80) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r2, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000900)="b6d35518b48becfbd314d1fa96a307da879125869c71d40c5a385ce1d3af47c69a6acba0142b27475f2f890e1446d7e0851a8c84b5", 0x35}], 0x1, &(0x7f00000009c0)=[{0x90, 0x1ff, 0x800, "434c94cf096ca2c6e3a8a6433ea1ccf960ad859f9cabeb13bbcd113f89069f10afdedfc1c2c2a6455dc4d1cc5b8c42e105db6d89e5394ec484d7db74d839a1021c616111655c01f0d6840a2cc4a77a0a2613073b0d1e9ab634a70c9cafd212450fe14e5e32b6ee05d11e22515b1b820c7425d601c3c41b459046978582"}], 0x90, 0x4040000}, 0x4000040) r3 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r3, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc4908", 0x17, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:08:14 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca580500000000000000b893123f89dedb03442000000000000000000000", @ANYRES32], 0x2}}, 0x9effffff) [ 573.243869] attempt to access beyond end of device [ 573.260683] loop3: rw=1, want=132, limit=112 [ 573.266821] attempt to access beyond end of device [ 573.286606] loop3: rw=1, want=133, limit=112 [ 573.295767] attempt to access beyond end of device [ 573.295947] attempt to access beyond end of device [ 573.302496] loop3: rw=1, want=142, limit=112 [ 573.322470] loop5: rw=1, want=130, limit=112 [ 573.336144] attempt to access beyond end of device 06:08:14 executing program 2: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = socket$inet6(0xa, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp={0x2c, 0x0, 0x0, 0x3d}, 0x80) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r2, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0), 0x0, &(0x7f00000009c0)=[{0xa0, 0x1ff, 0x800, "434c94cf096ca2c6e3a8a6433ea1ccf960ad859f9cabeb13bbcd113f89069f10afdedfc1c2c2a6455dc4d1cc5b8c42e105db6d89e5394ec484d7db74d839a1021c616111655c01f0d6840a2cc4a77a0a2613073b0d1e9ab634a70c9cafd212450fe14e5e32b6ee05d11e22515b1b820c7425d601c3c41b459046978582375e37f0268020620ba8c96a1cf8de5399"}, {0x20, 0x113, 0x3, "64bc63fb1e5bc65e5043"}], 0xc0, 0x4040000}, 0x4000040) r3 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r3, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:08:14 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca580500000000000000b893123f89dedb03442000000000000000000000", @ANYRES32], 0x2}}, 0xffffff7f) 06:08:14 executing program 1: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) socket$inet6(0xa, 0x0, 0x0) r0 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp, 0x80) gettid() ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000600)}], 0x1, &(0x7f00000009c0)}, 0x0) openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x0, 0x0) sendto$unix(0xffffffffffffffff, &(0x7f0000000100), 0x0, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r0) open$dir(&(0x7f0000000240)='./file0\x00', 0x0, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) [ 573.347870] attempt to access beyond end of device [ 573.361005] loop3: rw=1, want=143, limit=112 [ 573.373902] loop5: rw=1, want=131, limit=112 [ 573.382111] attempt to access beyond end of device [ 573.400780] loop3: rw=1, want=144, limit=112 [ 573.401761] attempt to access beyond end of device [ 573.416727] attempt to access beyond end of device [ 573.417077] loop5: rw=1, want=132, limit=112 [ 573.422944] loop3: rw=1, want=145, limit=112 [ 573.433286] attempt to access beyond end of device [ 573.440628] loop3: rw=1, want=1433, limit=112 06:08:14 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca580500000000000000b893123f89dedb03442000000000000000000000", @ANYRES32], 0x2}}, 0x582) [ 573.458519] attempt to access beyond end of device [ 573.471011] loop5: rw=1, want=133, limit=112 [ 573.483618] attempt to access beyond end of device [ 573.495589] loop5: rw=1, want=142, limit=112 [ 573.500186] attempt to access beyond end of device 06:08:14 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca580500000000000000b893123f89dedb03442000000000000000000000", @ANYRES32], 0x2}}, 0xffffff9e) [ 573.511106] loop5: rw=1, want=143, limit=112 [ 573.533691] attempt to access beyond end of device [ 573.540602] loop5: rw=1, want=144, limit=112 [ 573.587665] attempt to access beyond end of device [ 573.608000] loop5: rw=1, want=145, limit=112 [ 573.631735] FAT-fs (loop3): Unrecognized mount option "io1M}/" or missing value [ 573.640700] attempt to access beyond end of device [ 573.664169] loop5: rw=1, want=1145, limit=112 06:08:14 executing program 3: r0 = memfd_create(&(0x7f00000000c0)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x8, &(0x7f0000000b00)=[{&(0x7f00000003c0)="d25dab43fbca58da7321fc07f871235b7766fae80112f69471834c0dc16c40a6cce1f9682fc4dee9364c110f45dfde95503bcdbcc99f12a49a8d610f9b79ffced30a15a3f9787dfddbe8f50a526b5bbdd408852b0431758b6ce7bff8d5964bdd56170a2cee7ddadc97be73114d36ec47030634bb1ed6e4ce14761d43dae861aaa0cc46f244975ea8618774bac100b68358b5d6085caf555b1cf28bcec33bd1782d76c14e3667771158ad4a5d55392d147d74f33e31924a55ecc2d8db50c9d8af7f52cc4c1a1964d33ecf8081b2e01b4ab736ce11db7fcead51366f1a3a", 0xdd, 0x2}, {&(0x7f0000000580)="39f76e17504dda554406d2c4f2cb34801797c6de5e2376fc7daef7ce9f69600fc21abf47cac80388710844d3124bfe50b2e71eab64a5a910ddc419dc513074e9e2211262331a1ed33c7e150291e7ba55a34736f12a2d94d9581f4767f8789b6c86b9d8c0649474cbf91c5df01699b9a4fef228a2f79d5250b362abc71bc411e9614fe7c08a3c47a95f12a6cf08a1a54ad32e4b1239", 0x95, 0x6}, {&(0x7f0000000640)="b090222e8077b9b750cc109293bd334b29e1873332da5ce0dd5488b09481815c1345ec97cf6255b7ebd78791023db6beadcdb39b0391a755c98a90407588ef09a5ea79c93d159015aa95dfb48092162e04b63017", 0x54, 0x9}, {&(0x7f0000000780)="9c420d07ed6de253dfc1c140e5606e7c610dfce9af5f9e4d617c01312b0cda1ce0e83a0f17b0802dd8394cee349f2067c7ae3566bb367a19bdce83f6b021ed67ea41f53152d29a71dcf453698c3dd92626090cf6ee60ce0b8595723a7ddf2028831824d19766b733ae818f866a0d2ddf7b9e6a1dfaa1cbf70128ce94ccfeda70592fa0fa304ec1dcb56e57cc9cc4f4a54ac1d6bd232d16ac12fb58e45944d6490916a0b872b0020a", 0xa8, 0x4}, {&(0x7f0000000840)="63213f8343a8907d4debce931c5445b2dbac0b938c06563e8580abafd737c9d35fda1cf03f55649870f0c945eec29faad05d274d1a0dd5b8f9a219de6d3e143c9cde7761d0f30fd9a698", 0x88, 0x7}, {&(0x7f0000000900)="ba9de23db7fb4aa875ae1e7571072abc699cf9915fa344ebaf8e161d5cd7ec3d409cde75172620ec83c8f41389d957387219154e8d8ba4be5f6a84a2dbf678fcb79186e5e50d02c634d732573480a26e1aca5c3fe989a1ac4d5cc200bac3acf461c4da98ccc70564457d03898bcaba766c8aebe9c4639a374a45486de58e842a5d2a9638bc6301dbb91be8155f950263e16274730d7c4d128f9d8c0330426d05820edbb30f53a2ff8f330eba187362aa86872ba24a5a6b57ad1c45a342b0f324bc4086ea3b202ce9d4a4a65481e8b97ed4c96984a2a010e2", 0xd8, 0x5}, {&(0x7f00000004c0)="23133dc7b75a197582d240b00678fee654306fcd1d23af7a02cdd1", 0x1b, 0x100000001}, {&(0x7f0000000a00)="b681843208261058da34719c5a6c77d02e6698827ddb500bfe53c690db51eb1e55a4a490dbbb12e4ce08345f7d3f7d539c23e4d9bcf0157049dc136998adfb091ef477046dfc74fb994c70d62c7c4aa7b5ea9b3e198500e6b30d35283eb127d24aacccdc806e0e9da76029400e015dad89f76b1566e046ae2f9666e69a5ea79a029a4491727197347c0d05f54bd89291516f377dbfa93d1299374cfdeca4d794c746a7ed2a06e20619400968940e8e05c914de5f2794016e8b9a399be6c2ab59c208018d19d93da2afb070906fc226", 0xcf, 0x7}], 0x18000, &(0x7f00000006c0)=ANY=[]) open(&(0x7f0000000000)='./file0\x00', 0x0, 0x101) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000340)="ec8d61a3b835566dc1c14350b1b8b7c368dbb05dbec1dcf1da229fe6b984290eff8725dea3a0816e9175807cf82f31d4847ddb10ac90196a7dec0d6544e8538263254bf3", 0x44) ioctl$LOOP_CTL_REMOVE(r1, 0x5421, 0x0) modify_ldt$write(0x1, &(0x7f0000000080)={0x3, 0xffffffffffffffff, 0x1000, 0x7, 0x7, 0xd2e, 0x3, 0xd5, 0x6, 0x380000000}, 0x10) openat$ipvs(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/sys/net/ipv4/vs/amemthresh\x00', 0x2, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x3, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)=[{0x10, 0x107, 0x5}], 0x10, 0x20040000}, 0x8001) sendto$unix(0xffffffffffffffff, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r0) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7fff, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x40, 0x0, 0x800000000, 0x0, 0x0, 0xfffffffffffffffe}, 0x0, 0x9, 0xffffffffffffffff, 0x0) 06:08:14 executing program 5: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = socket$inet6(0xa, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp={0x2c, 0x0, 0x0, 0x3d}, 0x80) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r2, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000900)="b6d35518b48becfbd314d1fa96a307da879125869c71d40c5a385ce1d3af47c69a6acba0142b27475f2f890e1446d7e0851a8c84b5", 0x35}], 0x1, &(0x7f00000009c0)=[{0x90, 0x1ff, 0x800, "434c94cf096ca2c6e3a8a6433ea1ccf960ad859f9cabeb13bbcd113f89069f10afdedfc1c2c2a6455dc4d1cc5b8c42e105db6d89e5394ec484d7db74d839a1021c616111655c01f0d6840a2cc4a77a0a2613073b0d1e9ab634a70c9cafd212450fe14e5e32b6ee05d11e22515b1b820c7425d601c3c41b459046978582"}], 0x90, 0x4040000}, 0x4000040) r3 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r3, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc4908", 0x17, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:08:14 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca580500000000000000b893123f89dedb03442000000000000000000000", @ANYRES32], 0x2}}, 0xf0ffff) 06:08:14 executing program 4: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r1, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x3, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)=[{0x10, 0x107, 0x5}], 0x10, 0x20040000}, 0x8001) sendto$unix(0xffffffffffffffff, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r0) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x100) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffff4294, 0x0, 0x0, 0x0, 0x0, 0x400000000000, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x8000000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0xcceb, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:08:14 executing program 1: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) socket$inet6(0xa, 0x0, 0x0) r0 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp, 0x80) gettid() ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000600)}], 0x1, &(0x7f00000009c0)}, 0x0) openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x0, 0x0) sendto$unix(0xffffffffffffffff, &(0x7f0000000100), 0x0, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r0) open$dir(&(0x7f0000000240)='./file0\x00', 0x0, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:08:14 executing program 2: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = socket$inet6(0xa, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp={0x2c, 0x0, 0x0, 0x3d}, 0x80) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r2, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0), 0x0, &(0x7f00000009c0)=[{0xa0, 0x1ff, 0x800, "434c94cf096ca2c6e3a8a6433ea1ccf960ad859f9cabeb13bbcd113f89069f10afdedfc1c2c2a6455dc4d1cc5b8c42e105db6d89e5394ec484d7db74d839a1021c616111655c01f0d6840a2cc4a77a0a2613073b0d1e9ab634a70c9cafd212450fe14e5e32b6ee05d11e22515b1b820c7425d601c3c41b459046978582375e37f0268020620ba8c96a1cf8de5399"}, {0x20, 0x113, 0x3, "64bc63fb1e5bc65e5043"}], 0xc0, 0x4040000}, 0x4000040) r3 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r3, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:08:15 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca580500000000000000b893123f89dedb03442000000000000000000000", @ANYRES32], 0x2}}, 0x8205) 06:08:15 executing program 4: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = socket$inet6(0xa, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp={0x2c, 0x0, 0x0, 0x3d}, 0x80) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r2, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000900)="b6d35518b48becfbd314d1fa96a307da879125869c71d40c5a385ce1d3af47c69a6acba0142b27475f2f890e1446d7e0851a8c84b5", 0x35}], 0x1, &(0x7f00000009c0)=[{0x90, 0x1ff, 0x800, "434c94cf096ca2c6e3a8a6433ea1ccf960ad859f9cabeb13bbcd113f89069f10afdedfc1c2c2a6455dc4d1cc5b8c42e105db6d89e5394ec484d7db74d839a1021c616111655c01f0d6840a2cc4a77a0a2613073b0d1e9ab634a70c9cafd212450fe14e5e32b6ee05d11e22515b1b820c7425d601c3c41b459046978582"}], 0x90, 0x4040000}, 0x4000040) r3 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r3, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab5687", 0x12, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:08:15 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca580500000000000000b893123f89dedb03442000000000000000000000", @ANYRES32], 0x2}}, 0xfffffffffffff000) 06:08:15 executing program 1: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) socket$inet6(0xa, 0x0, 0x0) r0 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp, 0x80) gettid() ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000600)}], 0x1, &(0x7f00000009c0)}, 0x0) openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x0, 0x0) sendto$unix(0xffffffffffffffff, &(0x7f0000000100), 0x0, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r0) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x0) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:08:15 executing program 3: r0 = memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) getsockopt$inet_sctp6_SCTP_ASSOCINFO(r0, 0x84, 0x1, &(0x7f00000001c0)={0x0, 0xacc, 0x1f, 0x5000000000, 0x6, 0x7}, &(0x7f0000000340)=0x14) setsockopt$inet_sctp_SCTP_CONTEXT(r0, 0x84, 0x11, &(0x7f0000000380)={r1, 0xffffffffffffc5e9}, 0x8) r2 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r3, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x3, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)=[{0x10, 0x107, 0x5}], 0x10, 0x20040000}, 0x8001) sendto$unix(0xffffffffffffffff, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000080)=@file={0x1, './file0/file0/file0\x00'}, 0x11c) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r2) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:08:15 executing program 5: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = socket$inet6(0xa, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp={0x2c, 0x0, 0x0, 0x3d}, 0x80) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r2, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000900)="b6d35518b48becfbd314d1fa96a307da879125869c71d40c5a385ce1d3af47c69a6acba0142b27475f2f890e1446d7e0851a8c84b5", 0x35}], 0x1, &(0x7f00000009c0)=[{0x90, 0x1ff, 0x800, "434c94cf096ca2c6e3a8a6433ea1ccf960ad859f9cabeb13bbcd113f89069f10afdedfc1c2c2a6455dc4d1cc5b8c42e105db6d89e5394ec484d7db74d839a1021c616111655c01f0d6840a2cc4a77a0a2613073b0d1e9ab634a70c9cafd212450fe14e5e32b6ee05d11e22515b1b820c7425d601c3c41b459046978582"}], 0x90, 0x4040000}, 0x4000040) r3 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r3, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc4908", 0x17, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:08:15 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca580500000000000000b893123f89dedb03442000000000000000000000", @ANYRES32], 0x2}}, 0x9effffff00000000) 06:08:15 executing program 2: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = socket$inet6(0xa, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp={0x2c, 0x0, 0x0, 0x3d}, 0x80) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r2, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0), 0x0, &(0x7f00000009c0)=[{0xa0, 0x1ff, 0x800, "434c94cf096ca2c6e3a8a6433ea1ccf960ad859f9cabeb13bbcd113f89069f10afdedfc1c2c2a6455dc4d1cc5b8c42e105db6d89e5394ec484d7db74d839a1021c616111655c01f0d6840a2cc4a77a0a2613073b0d1e9ab634a70c9cafd212450fe14e5e32b6ee05d11e22515b1b820c7425d601c3c41b459046978582375e37f0268020620ba8c96a1cf8de5399"}, {0x20, 0x113, 0x3, "64bc63fb1e5bc65e5043"}], 0xc0, 0x4040000}, 0x4000040) r3 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r3, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:08:15 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca580500000000000000b893123f89dedb03442000000000000000000000", @ANYRES32], 0x2}}, 0xffffff7f00000000) 06:08:15 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca580500000000000000b893123f89dedb03442000000000000000000000", @ANYRES32], 0x2}}, 0xf000) [ 574.825297] FAT-fs (loop3): Unrecognized mount option "" or missing value 06:08:15 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca580500000000000000b893123f89dedb03442000000000000000000000", @ANYRES32], 0x2}}, 0xf0) [ 574.916221] FAT-fs (loop3): Unrecognized mount option "" or missing value 06:08:15 executing program 1: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) socket$inet6(0xa, 0x0, 0x0) r0 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp, 0x80) gettid() ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000600)}], 0x1, &(0x7f00000009c0)}, 0x0) openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x0, 0x0) sendto$unix(0xffffffffffffffff, &(0x7f0000000100), 0x0, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r0) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x0) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:08:15 executing program 5: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = socket$inet6(0xa, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp={0x2c, 0x0, 0x0, 0x3d}, 0x80) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r2, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000900)="b6d35518b48becfbd314d1fa96a307da879125869c71d40c5a385ce1d3af47c69a6acba0142b27475f2f890e1446d7e0851a8c84b5", 0x35}], 0x1, &(0x7f00000009c0)=[{0x90, 0x1ff, 0x800, "434c94cf096ca2c6e3a8a6433ea1ccf960ad859f9cabeb13bbcd113f89069f10afdedfc1c2c2a6455dc4d1cc5b8c42e105db6d89e5394ec484d7db74d839a1021c616111655c01f0d6840a2cc4a77a0a2613073b0d1e9ab634a70c9cafd212450fe14e5e32b6ee05d11e22515b1b820c7425d601c3c41b459046978582"}], 0x90, 0x4040000}, 0x4000040) r3 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r3, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x0, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:08:15 executing program 4: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'aead\x00', 0x0, 0x0, 'rfc4309(morus640)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x5, &(0x7f00000001c0), 0x10) 06:08:15 executing program 3: r0 = memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r2, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x3, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)=[{0x10, 0x107, 0x5}], 0x10, 0x20040000}, 0x8001) sendto$unix(0xffffffffffffffff, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet_MCAST_LEAVE_GROUP(r0, 0x0, 0x2d, &(0x7f0000000340)={0xc861, {{0x2, 0x4e22, @remote}}}, 0x88) ioctl$DRM_IOCTL_GET_STATS(r1, 0x80f86406, &(0x7f0000000080)=""/30) 06:08:15 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca580500000000000000b893123f89dedb03442000000000000000000000", @ANYRES32], 0x2}}, 0xf0ffffffffffff) 06:08:15 executing program 2: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = socket$inet6(0xa, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp={0x2c, 0x0, 0x0, 0x3d}, 0x80) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r2, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000900)}], 0x1, &(0x7f00000009c0)=[{0xa0, 0x1ff, 0x800, "434c94cf096ca2c6e3a8a6433ea1ccf960ad859f9cabeb13bbcd113f89069f10afdedfc1c2c2a6455dc4d1cc5b8c42e105db6d89e5394ec484d7db74d839a1021c616111655c01f0d6840a2cc4a77a0a2613073b0d1e9ab634a70c9cafd212450fe14e5e32b6ee05d11e22515b1b820c7425d601c3c41b459046978582375e37f0268020620ba8c96a1cf8de5399"}, {0x20, 0x113, 0x3, "64bc63fb1e5bc65e5043"}], 0xc0, 0x4040000}, 0x4000040) r3 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r3, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:08:16 executing program 1: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) socket$inet6(0xa, 0x0, 0x0) r0 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp, 0x80) gettid() ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000600)}], 0x1, &(0x7f00000009c0)}, 0x0) openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x0, 0x0) sendto$unix(0xffffffffffffffff, &(0x7f0000000100), 0x0, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r0) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x0) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:08:16 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca580500000000000000b893123f89dedb03442000000000000000000000", @ANYRES32], 0x2}}, 0x8205000000000000) 06:08:16 executing program 4: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) sendmmsg(r0, &(0x7f0000004e40)=[{{0x0, 0x0, &(0x7f0000001680), 0x0, &(0x7f00000016c0)=[{0xc}], 0xc, 0x4008000}, 0x9}], 0x1, 0x0) 06:08:16 executing program 5: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = socket$inet6(0xa, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp={0x2c, 0x0, 0x0, 0x3d}, 0x80) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r2, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000900)="b6d35518b48becfbd314d1fa96a307da879125869c71d40c5a385ce1d3af47c69a6acba0142b27475f2f890e1446d7e0851a8c84b5", 0x35}], 0x1, &(0x7f00000009c0)=[{0x90, 0x1ff, 0x800, "434c94cf096ca2c6e3a8a6433ea1ccf960ad859f9cabeb13bbcd113f89069f10afdedfc1c2c2a6455dc4d1cc5b8c42e105db6d89e5394ec484d7db74d839a1021c616111655c01f0d6840a2cc4a77a0a2613073b0d1e9ab634a70c9cafd212450fe14e5e32b6ee05d11e22515b1b820c7425d601c3c41b459046978582"}], 0x90, 0x4040000}, 0x4000040) r3 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r3, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x0, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:08:16 executing program 3: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r1, 0x5421, 0x0) bpf$OBJ_GET_MAP(0x7, &(0x7f00000000c0)={&(0x7f0000000080)='./file0/file0/file0\x00', 0x0, 0x10}, 0x10) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x3, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)=[{0x10, 0x107, 0x5}], 0x10, 0x20040000}, 0x8001) sendto$unix(0xffffffffffffffff, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r0) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:08:16 executing program 2: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = socket$inet6(0xa, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp={0x2c, 0x0, 0x0, 0x3d}, 0x80) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r2, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000900)}], 0x1, &(0x7f00000009c0)=[{0xa0, 0x1ff, 0x800, "434c94cf096ca2c6e3a8a6433ea1ccf960ad859f9cabeb13bbcd113f89069f10afdedfc1c2c2a6455dc4d1cc5b8c42e105db6d89e5394ec484d7db74d839a1021c616111655c01f0d6840a2cc4a77a0a2613073b0d1e9ab634a70c9cafd212450fe14e5e32b6ee05d11e22515b1b820c7425d601c3c41b459046978582375e37f0268020620ba8c96a1cf8de5399"}, {0x20, 0x113, 0x3, "64bc63fb1e5bc65e5043"}], 0xc0, 0x4040000}, 0x4000040) r3 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r3, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:08:16 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca580500000000000000b893123f89dedb03442000000000000000000000", @ANYRES32], 0x2}}, 0x200000000000000) 06:08:16 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setattr(0x0, &(0x7f0000000000)={0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0xffff}, 0x0) r0 = socket$inet6(0xa, 0x2000000000000001, 0x8010000000000084) bind$inet6(r0, &(0x7f00002aafe4)={0xa, 0x4e23, 0x0, @ipv4}, 0x1c) listen(r0, 0x9) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) sendto$inet6(r1, &(0x7f0000000100)='F', 0x1, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback, 0xf000000}, 0x1c) 06:08:16 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca580500000000000000b893123f89dedb03442000000000000000000000", @ANYRES32], 0x2}}, 0x2000000) 06:08:16 executing program 1: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) socket$inet6(0xa, 0x0, 0x0) r0 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp, 0x80) gettid() ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000600)}], 0x1, &(0x7f00000009c0)}, 0x0) openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x0, 0x0) sendto$unix(0xffffffffffffffff, &(0x7f0000000100), 0x0, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r0) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x0, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:08:16 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca580500000000000000b893123f89dedb03442000000000000000000000", @ANYRES32], 0x2}}, 0xf0ffffff) [ 576.193709] audit: type=1804 audit(1539756496.943:131): pid=26667 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor5" name="/root/syzkaller-testdir239058742/syzkaller.b5Qjqx/333/file0/file0" dev="loop5" ino=305 res=1 06:08:17 executing program 3: r0 = memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) ioctl$KDSKBMETA(r1, 0x4b63, &(0x7f0000000340)=0xffff) gettid() openat$cgroup_int(r0, &(0x7f0000000280)='io.max\x00', 0x2, 0x0) getsockopt$EBT_SO_GET_INFO(r1, 0x0, 0x80, &(0x7f0000000080)={'filter\x00'}, &(0x7f00000001c0)=0x78) ioctl$LOOP_CTL_REMOVE(r2, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x3, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)=[{0x10, 0x107, 0x5}], 0x10, 0x20040000}, 0x8001) sendto$unix(0xffffffffffffffff, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000380)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:08:17 executing program 2: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = socket$inet6(0xa, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp={0x2c, 0x0, 0x0, 0x3d}, 0x80) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r2, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000900)}], 0x1, &(0x7f00000009c0)=[{0xa0, 0x1ff, 0x800, "434c94cf096ca2c6e3a8a6433ea1ccf960ad859f9cabeb13bbcd113f89069f10afdedfc1c2c2a6455dc4d1cc5b8c42e105db6d89e5394ec484d7db74d839a1021c616111655c01f0d6840a2cc4a77a0a2613073b0d1e9ab634a70c9cafd212450fe14e5e32b6ee05d11e22515b1b820c7425d601c3c41b459046978582375e37f0268020620ba8c96a1cf8de5399"}, {0x20, 0x113, 0x3, "64bc63fb1e5bc65e5043"}], 0xc0, 0x4040000}, 0x4000040) r3 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r3, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:08:17 executing program 4: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vhost-vsock\x00', 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r0, 0x4008af60, &(0x7f0000000040)={@my=0x0}) r1 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_dgram(r1, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x0}, 0x10) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) shutdown(r1, 0x0) [ 576.379958] audit: type=1800 audit(1539756497.133:132): pid=26667 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed comm="syz-executor5" name="file0" dev="loop5" ino=305 res=0 06:08:17 executing program 1: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) socket$inet6(0xa, 0x0, 0x0) r0 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp, 0x80) gettid() ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000600)}], 0x1, &(0x7f00000009c0)}, 0x0) openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x0, 0x0) sendto$unix(0xffffffffffffffff, &(0x7f0000000100), 0x0, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r0) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x0, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:08:17 executing program 5: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = socket$inet6(0xa, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp={0x2c, 0x0, 0x0, 0x3d}, 0x80) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r2, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000900)="b6d35518b48becfbd314d1fa96a307da879125869c71d40c5a385ce1d3af47c69a6acba0142b27475f2f890e1446d7e0851a8c84b5", 0x35}], 0x1, &(0x7f00000009c0)=[{0x90, 0x1ff, 0x800, "434c94cf096ca2c6e3a8a6433ea1ccf960ad859f9cabeb13bbcd113f89069f10afdedfc1c2c2a6455dc4d1cc5b8c42e105db6d89e5394ec484d7db74d839a1021c616111655c01f0d6840a2cc4a77a0a2613073b0d1e9ab634a70c9cafd212450fe14e5e32b6ee05d11e22515b1b820c7425d601c3c41b459046978582"}], 0x90, 0x4040000}, 0x4000040) r3 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r3, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x0, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:08:17 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca580500000000000000b893123f89dedb03442000000000000000000000", @ANYRES32], 0x2}}, 0x1000000) 06:08:17 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca580500000000000000b893123f89dedb03442000000000000000000000", @ANYRES32], 0x2}}, 0x82050000) [ 576.495624] attempt to access beyond end of device [ 576.500623] loop5: rw=1, want=130, limit=112 [ 576.522145] buffer_io_error: 23 callbacks suppressed [ 576.522156] Buffer I/O error on dev loop5, logical block 129, lost async page write [ 576.539241] attempt to access beyond end of device [ 576.546192] loop5: rw=1, want=131, limit=112 [ 576.579658] Buffer I/O error on dev loop5, logical block 130, lost async page write [ 576.612214] attempt to access beyond end of device [ 576.640161] loop5: rw=1, want=132, limit=112 06:08:17 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca580500000000000000b893123f89dedb03442000000000000000000000", @ANYRES32], 0x2}}, 0x0) r1 = dup(r0) ioctl$DRM_IOCTL_DROP_MASTER(r1, 0x641f) 06:08:17 executing program 2: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = socket$inet6(0xa, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp={0x2c, 0x0, 0x0, 0x3d}, 0x80) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r2, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000900)="b6", 0x1}], 0x1, &(0x7f00000009c0)=[{0xa0, 0x1ff, 0x800, "434c94cf096ca2c6e3a8a6433ea1ccf960ad859f9cabeb13bbcd113f89069f10afdedfc1c2c2a6455dc4d1cc5b8c42e105db6d89e5394ec484d7db74d839a1021c616111655c01f0d6840a2cc4a77a0a2613073b0d1e9ab634a70c9cafd212450fe14e5e32b6ee05d11e22515b1b820c7425d601c3c41b459046978582375e37f0268020620ba8c96a1cf8de5399"}], 0xa0, 0x4040000}, 0x4000040) r3 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r3, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:08:17 executing program 3: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r1, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x3, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)=ANY=[@ANYBLOB="100000000096aa00e826d1901942a4a5"], 0x10, 0x20040000}, 0x8001) sendto$unix(0xffffffffffffffff, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r0) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) [ 576.664980] Buffer I/O error on dev loop5, logical block 131, lost async page write [ 576.699569] attempt to access beyond end of device [ 576.717610] loop5: rw=1, want=133, limit=112 [ 576.722169] Buffer I/O error on dev loop5, logical block 132, lost async page write [ 576.730166] attempt to access beyond end of device [ 576.735551] loop5: rw=1, want=142, limit=112 [ 576.740093] Buffer I/O error on dev loop5, logical block 141, lost async page write [ 576.749896] attempt to access beyond end of device [ 576.755426] loop5: rw=1, want=143, limit=112 [ 576.763509] Buffer I/O error on dev loop5, logical block 142, lost async page write [ 576.772644] attempt to access beyond end of device [ 576.777982] loop5: rw=1, want=144, limit=112 [ 576.782577] Buffer I/O error on dev loop5, logical block 143, lost async page write [ 576.791121] attempt to access beyond end of device [ 576.796860] loop5: rw=1, want=145, limit=112 [ 576.801380] Buffer I/O error on dev loop5, logical block 144, lost async page write [ 576.840235] attempt to access beyond end of device 06:08:17 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100002008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca58050000000000ef00b893923f89dedb034420000000000000000000007d10339ec975e4fc32f2e921adfa3b78616f3cecc59faeb908d790e042260d303f83e4ad6668898073b3e993a0f89050d0b02d4e2fb6f76c85e8d2fe0d3c3f8359ee249efec88c78e93357d3cc154271953d9a015c1fbdddbb02122afb1648ecb11eebd3a11b979ea5aaf80add4fbff9f7900f0f91a7736c3fd59cc59b2d804b49e20a1a9cd11de208492d1952753a8c247b6f5a9ec950bdc03f04abbbf8226668d59d71a75477210c2d", @ANYRES32], 0x2}, 0x1, 0x0, 0x0, 0x400000000000}, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x40100, 0x10) epoll_pwait(r1, &(0x7f0000000140)=[{}, {}, {}, {}], 0x4, 0x4, &(0x7f00000001c0)={0x9}, 0x8) connect$pppoe(r1, &(0x7f0000000040)={0x18, 0x0, {0x0, @local, 'sit0\x00'}}, 0x1e) close(r0) [ 576.868802] loop5: rw=1, want=2178, limit=112 06:08:17 executing program 0: r0 = syz_open_dev$midi(&(0x7f00000000c0)='/dev/midi#\x00', 0x3, 0x20000) setsockopt$netlink_NETLINK_PKTINFO(r0, 0x10e, 0x3, &(0x7f0000000140)=0xc2, 0x4) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca580500000000000000b893123f89dedb03442000000000000000000000", @ANYRES32], 0x2}}, 0x0) 06:08:18 executing program 3: r0 = memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) r3 = gettid() ioctl$LOOP_CTL_REMOVE(r2, 0x5421, 0x0) timer_create(0x5, &(0x7f0000000080)={0x0, 0xd, 0x6, @tid=r3}, &(0x7f00000000c0)) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x3, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)=[{0x10, 0x107, 0x5}], 0x10, 0x20040000}, 0x8001) sendto$unix(0xffffffffffffffff, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) getsockopt$inet_sctp6_SCTP_DELAYED_SACK(r0, 0x84, 0x10, &(0x7f00000001c0)=@sack_info={0x0, 0x0, 0x7}, &(0x7f0000000340)=0xc) setsockopt$inet_sctp_SCTP_AUTH_DEACTIVATE_KEY(r0, 0x84, 0x23, &(0x7f0000000380)={r4, 0x8}, 0x8) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) 06:08:18 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_open_dev$mouse(&(0x7f00000000c0)='/dev/input/mouse#\x00', 0x3, 0x90200) getsockopt$inet_sctp_SCTP_MAXSEG(0xffffffffffffffff, 0x84, 0xd, &(0x7f0000000140)=@assoc_id=0x0, &(0x7f00000001c0)=0x4) getsockopt$inet_sctp_SCTP_GET_ASSOC_STATS(r1, 0x84, 0x70, &(0x7f0000000200)={r2, @in6={{0xa, 0x4e21, 0x9, @mcast1, 0x6}}, [0x5, 0x100000000, 0x100, 0x2, 0x81, 0xffffffffffff9b9a, 0x0, 0x9, 0x92be, 0x1000, 0x800, 0x4, 0x0, 0x5, 0xffffffffffffffc0]}, &(0x7f0000000300)=0x100) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000, 0x0, 0x80}, 0xc, &(0x7f00000003c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca580500000000000000b893123f89dedb03442000000000000000000000", @ANYRES32], 0x2}, 0x1, 0x0, 0x0, 0x80}, 0x0) 06:08:18 executing program 4: ioctl$TCSETS(0xffffffffffffffff, 0x40045431, &(0x7f0000000000)) getpeername(0xffffffffffffffff, &(0x7f0000000040)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast2}}}, &(0x7f00000000c0)=0x80) syz_open_pts(0xffffffffffffffff, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) r1 = socket$packet(0x11, 0x3, 0x300) r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000000)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) r3 = socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) pread64(r2, &(0x7f0000000340)=""/39, 0x27, 0x0) sendmsg$nl_route(r3, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000180)=@newlink={0x28, 0x10, 0xc362e63b3f31ba5f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x3}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) dup2(r1, r2) 06:08:18 executing program 1: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) socket$inet6(0xa, 0x0, 0x0) r0 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp, 0x80) gettid() ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000600)}], 0x1, &(0x7f00000009c0)}, 0x0) openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x0, 0x0) sendto$unix(0xffffffffffffffff, &(0x7f0000000100), 0x0, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r0) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x0, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) [ 577.555510] attempt to access beyond end of device [ 577.560526] loop1: rw=1, want=130, limit=112 [ 577.589471] Buffer I/O error on dev loop1, logical block 129, lost async page write [ 577.611712] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 577.626078] attempt to access beyond end of device [ 577.630977] audit: type=1804 audit(1539756498.383:133): pid=26784 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=open_writers comm="syz-executor5" name="/root/syzkaller-testdir239058742/syzkaller.b5Qjqx/334/file0/file0" dev="loop5" ino=309 res=1 [ 577.673143] loop1: rw=1, want=131, limit=112 [ 577.679723] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 577.690354] Buffer I/O error on dev loop1, logical block 130, lost async page write [ 577.715556] attempt to access beyond end of device [ 577.720561] loop1: rw=1, want=132, limit=112 [ 577.744583] 8021q: adding VLAN 0 to HW filter on device  [ 577.762337] attempt to access beyond end of device [ 577.790601] loop1: rw=1, want=133, limit=112 [ 577.800716] attempt to access beyond end of device [ 577.812829] loop1: rw=1, want=142, limit=112 [ 577.826724] attempt to access beyond end of device [ 577.837552] loop1: rw=1, want=143, limit=112 [ 577.859185] attempt to access beyond end of device [ 577.871319] loop1: rw=1, want=144, limit=112 [ 577.876371] attempt to access beyond end of device [ 577.881423] loop1: rw=1, want=145, limit=112 06:08:18 executing program 2: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = socket$inet6(0xa, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp={0x2c, 0x0, 0x0, 0x3d}, 0x80) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r2, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000900)="b6", 0x1}], 0x1, &(0x7f00000009c0)=[{0xa0, 0x1ff, 0x800, "434c94cf096ca2c6e3a8a6433ea1ccf960ad859f9cabeb13bbcd113f89069f10afdedfc1c2c2a6455dc4d1cc5b8c42e105db6d89e5394ec484d7db74d839a1021c616111655c01f0d6840a2cc4a77a0a2613073b0d1e9ab634a70c9cafd212450fe14e5e32b6ee05d11e22515b1b820c7425d601c3c41b459046978582375e37f0268020620ba8c96a1cf8de5399"}], 0xa0, 0x4040000}, 0x4000040) r3 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r3, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:08:18 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_open_dev$loop(&(0x7f0000000040)='/dev/loop#\x00', 0x81, 0x30000) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f00000001c0)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100fc2a08fa84d3be9509000000579132d0f8000200d36f2953ed5ffdbaf9080641c5fe5c2005862eabafbbb6c8918c00ce232de53f9ba96e3a67dd9a1bd3036a5e12c59499064dd45f90edbd8088b6045c09e058c62026c0bcc9ca58050000000000de27d1c8b40b29a7703b18e79998dafea145559f4fa3e4dc5ebf3955cc263a230dc0a2b67a8c1f0120061ba0bcaf7b1ca374b2a728d163003e144e89e11f94bae9ff307aa6c15b195d5734950910079b102a3802fd669f6e7a95ba43c1745397dc20cbd04f5e254e31e34b4093de8347649acde3fd31e336a00c09c3591e72650269b871d9d33b681fc8a7ffa5a7343d8828df088efed70fe5a5e7273dd41b04c8bb12dc5d97bed336f50d566bb5f1adb6ae0098da11ccbf70b36e5ffc17ee2fd87bf140be60087b1f14f21a636f2878687d0c00b3141ee423e0ab5ff2706d86ed258bd98cca07b27955ba214e30abc98f39399dafbca200022cc19ba274df9bd145bc53fbf741479d4e91b5abfc22a1112af2cb6c43a63246f1154525e240b5484936f6f56db13b770926103d5c2c049dae23917c8a016264175c7316733e00000000000000b7dd14fd7fc0e56a4906e79173d018ff0cbd48ae00be8ad4730a32cf7df06db614fab3bfd06ac95845a9a7e9810075902c4b7d7e03af4169ef2685cfccc3137e2f761ef04f96289f8a9980903d4ff2cc91cd3e73c3c40c2c5245228946b9693db68fa6ed7e32f12b68", @ANYRES32], 0x2}}, 0x0) r1 = syz_genetlink_get_family_id$ipvs(&(0x7f00000000c0)='IPVS\x00') sendmsg$IPVS_CMD_GET_INFO(r0, &(0x7f0000000580)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000140)={&(0x7f0000000400)={0x154, r1, 0x510, 0x70bd29, 0x25dfdbfd, {}, [@IPVS_CMD_ATTR_SERVICE={0x34, 0x1, [@IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@broadcast}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv6=@dev={0xfe, 0x80, [], 0x10}}, @IPVS_SVC_ATTR_SCHED_NAME={0x8, 0x6, 'wrr\x00'}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8}, @IPVS_CMD_ATTR_DEST={0x4c, 0x2, [@IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0xf5}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv6=@mcast1}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x3}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv6=@mcast2}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x9}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x599b064e}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x13}, @IPVS_CMD_ATTR_SERVICE={0x24, 0x1, [@IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e22}, @IPVS_SVC_ATTR_PROTOCOL={0x8, 0x2, 0x88}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x2}, @IPVS_SVC_ATTR_PE_NAME={0x8, 0xb, 'sip\x00'}]}, @IPVS_CMD_ATTR_SERVICE={0x28, 0x1, [@IPVS_SVC_ATTR_PE_NAME={0x8, 0xb, 'sip\x00'}, @IPVS_SVC_ATTR_PE_NAME={0x8, 0xb, 'sip\x00'}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@multicast1}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x9}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x1}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x6}, @IPVS_CMD_ATTR_SERVICE={0x4c, 0x1, [@IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@broadcast}, @IPVS_SVC_ATTR_SCHED_NAME={0x8, 0x6, 'lc\x00'}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x13}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e21}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x10}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@multicast1}]}]}, 0x154}, 0x1, 0x0, 0x0, 0x20000000}, 0x40800) 06:08:18 executing program 3: r0 = memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(r2, 0x29, 0x22, &(0x7f0000000340)={{{@in=@local, @in6=@ipv4={[], [], @local}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{}, 0x0, @in=@rand_addr}}, &(0x7f0000000440)=0xe8) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0/file0/file0\x00', &(0x7f00000001c0)='9p\x00', 0x8, &(0x7f0000000580)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}, 0x2c, {[{@version_u='version=9p2000.u'}], [{@fsuuid={'fsuuid', 0x3d, {[0x31, 0x75, 0x64, 0x32, 0x66, 0x77, 0x36, 0x62], 0x2d, [0x7b, 0x77, 0x66, 0x65], 0x2d, [0x75, 0x66, 0x63, 0x62], 0x2d, [0x72, 0x0, 0x3f, 0x37], 0x2d, [0x33, 0x33, 0x0, 0x38, 0x67, 0x64, 0x71, 0x77]}}}, {@audit='audit'}, {@uid_eq={'uid', 0x3d, r3}}, {@context={'context', 0x3d, 'sysadm_u'}}, {@appraise_type='appraise_type=imasig'}]}}) socketpair$inet_smc(0x2b, 0x1, 0x0, &(0x7f0000000080)) gettid() ioctl$LOOP_CTL_REMOVE(r2, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x3, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)=ANY=[@ANYBLOB="10000000000000000000000000000000"], 0x10, 0x20040000}, 0x8001) sendto$unix(0xffffffffffffffff, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_GET_FREE(r0, 0x4c82) ioctl$LOOP_CTL_GET_FREE(r0, 0x4c82) ioctl$LOOP_CTL_GET_FREE(r2, 0x4c82) ioctl$LOOP_CTL_GET_FREE(r2, 0x4c82) r4 = ioctl$LOOP_CTL_GET_FREE(r0, 0x4c82) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, r4) fchdir(r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:08:18 executing program 5: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = socket$inet6(0xa, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp={0x2c, 0x0, 0x0, 0x3d}, 0x80) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r2, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000900)="b6d35518b48becfbd314d1fa96a307da879125869c71d40c5a385ce1d3af47c69a6acba0142b27475f2f890e1446d7e0851a8c84b5", 0x35}], 0x1, &(0x7f00000009c0)=[{0x90, 0x1ff, 0x800, "434c94cf096ca2c6e3a8a6433ea1ccf960ad859f9cabeb13bbcd113f89069f10afdedfc1c2c2a6455dc4d1cc5b8c42e105db6d89e5394ec484d7db74d839a1021c616111655c01f0d6840a2cc4a77a0a2613073b0d1e9ab634a70c9cafd212450fe14e5e32b6ee05d11e22515b1b820c7425d601c3c41b459046978582"}], 0x90, 0x4040000}, 0x4000040) r3 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r3, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x0, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) [ 577.889399] attempt to access beyond end of device [ 577.896807] loop1: rw=1, want=1681, limit=112 06:08:18 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000280)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6dbef48c0bcc9ca580500000000000000b893123f89de06db034420000000000000000000008a9f0888c51d93d26388089586701bcde57a97841863f9d21d5f6dda7e3e8d5ea3ef52927c7bd8c0b05ea35f73c004fefbc092d805ec0aa089ed194e80b81002417c23e8991f99576d4948783e", @ANYRES32], 0x2}}, 0x0) r1 = syz_open_dev$amidi(&(0x7f00000000c0)='/dev/amidi#\x00', 0xcb9, 0x8040) ioctl$sock_bt_hidp_HIDPGETCONNINFO(r1, 0x800448d3, &(0x7f00000001c0)={{0x8, 0xc9ce, 0x7fffffff, 0x8, 0x0, 0x3}, 0x74, 0x3, 0xfffffffffffffff9, 0x80, 0x0, "b5fb52aba23737a13b9cf482066d4eb7baa3d0822ceb45f42b7f38e000c9d94461e649ff2b76f8b2b86e903e8a05e529c36c73a8ce46a81bcffcc407b2da6422024d2ef3b45ab0709175dbb5cda746960da90942ca16fdd314acdaf3fb8e27fbce91d445d2a3e2fbdacd712bc8ccdc464ea9b125e422496ec890c22bc33e03d8"}) ioctl$GIO_FONT(r1, 0x4b60, &(0x7f0000000040)=""/37) [ 577.965917] attempt to access beyond end of device [ 577.971074] loop5: rw=1, want=130, limit=112 06:08:18 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca580500000000000000b893123f89dedb03442000000000000000000000", @ANYRES32], 0x2}}, 0x0) r1 = syz_open_dev$sndpcmp(&(0x7f00000000c0)='/dev/snd/pcmC#D#p\x00', 0x3, 0x10001) ioctl$UI_SET_PROPBIT(r1, 0x4004556e, 0x9) [ 578.021898] attempt to access beyond end of device [ 578.045005] loop5: rw=1, want=131, limit=112 [ 578.087595] attempt to access beyond end of device 06:08:18 executing program 2: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = socket$inet6(0xa, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp={0x2c, 0x0, 0x0, 0x3d}, 0x80) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r2, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000900)="b6", 0x1}], 0x1, &(0x7f00000009c0)=[{0xa0, 0x1ff, 0x800, "434c94cf096ca2c6e3a8a6433ea1ccf960ad859f9cabeb13bbcd113f89069f10afdedfc1c2c2a6455dc4d1cc5b8c42e105db6d89e5394ec484d7db74d839a1021c616111655c01f0d6840a2cc4a77a0a2613073b0d1e9ab634a70c9cafd212450fe14e5e32b6ee05d11e22515b1b820c7425d601c3c41b459046978582375e37f0268020620ba8c96a1cf8de5399"}], 0xa0, 0x4040000}, 0x4000040) r3 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r3, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) [ 578.113151] loop5: rw=1, want=132, limit=112 [ 578.125724] attempt to access beyond end of device [ 578.136058] loop5: rw=1, want=133, limit=112 [ 578.140758] attempt to access beyond end of device [ 578.147392] loop5: rw=1, want=142, limit=112 [ 578.153171] attempt to access beyond end of device [ 578.181420] loop5: rw=1, want=143, limit=112 [ 578.202580] attempt to access beyond end of device [ 578.212402] loop5: rw=1, want=144, limit=112 [ 578.218474] attempt to access beyond end of device 06:08:19 executing program 1: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) socket$inet6(0xa, 0x0, 0x0) r0 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp, 0x80) gettid() ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000600)}], 0x1, &(0x7f00000009c0)}, 0x0) openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x0, 0x0) sendto$unix(0xffffffffffffffff, &(0x7f0000000100), 0x0, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r0) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:08:19 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0x1, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[], 0x2}, 0x1, 0x0, 0x0, 0x800}, 0x0) [ 578.278604] loop5: rw=1, want=145, limit=112 [ 578.311721] attempt to access beyond end of device [ 578.321740] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready 06:08:19 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000080)={&(0x7f0000000040)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f00000001c0)=ANY=[@ANYPTR=&(0x7f0000000300)=ANY=[@ANYRESDEC=r0, @ANYBLOB="00e5f38b747013de2e7e347a6a6c72247ffe6d18f014cb21c88497be04245455b8748239b17f470273d309b71d5df1ed4baf98581d4c863634fd53e643ceda2154c4", @ANYRES32=r0, @ANYRES16=r0, @ANYPTR64=&(0x7f00000000c0)=ANY=[@ANYPTR, @ANYRES16=r0, @ANYRES64=r0, @ANYPTR64, @ANYRES16=0x0, @ANYPTR64, @ANYPTR64], @ANYBLOB="88f61a014c9365d058f49b4791ac46", @ANYPTR=&(0x7f0000000140)=ANY=[@ANYRESDEC=r0, @ANYPTR64, @ANYPTR, @ANYRES64=0x0], @ANYBLOB="e4cb4c8a26baffeb5af66cb55d7783b45e95dea0a79f5b2bd797254136430ddc478354253faf952d6a7e0b5e", @ANYRESHEX], @ANYRES32], 0x2}}, 0x0) [ 578.373560] loop5: rw=1, want=2178, limit=112 06:08:19 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) clock_gettime(0x0, &(0x7f0000000140)={0x0, 0x0}) setsockopt$sock_timeval(r0, 0x1, 0x14, &(0x7f00000000c0)={0x0, r1/1000+10000}, 0x10) bind$inet6(r0, &(0x7f00001fefe4)={0xa, 0x4e22}, 0x1c) listen(r0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) accept4(r0, &(0x7f0000000000)=@xdp, &(0x7f0000000180)=0x80, 0x0) shutdown(r0, 0x1) sendto$inet6(r2, &(0x7f0000000000), 0x0, 0x20000004, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @loopback}, 0x1c) ioctl$FS_IOC_FIEMAP(0xffffffffffffffff, 0xc020660b, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, 0x2, [{}, {}]}) 06:08:19 executing program 3: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() fcntl$setpipe(r1, 0x407, 0x80000001) ioctl$LOOP_CTL_REMOVE(r2, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x3, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)=[{0x10, 0x107, 0x5}], 0x10, 0x20040000}, 0x8001) sendto$unix(0xffffffffffffffff, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r0) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) syz_mount_image$nfs4(&(0x7f0000000080)='nfs4\x00', &(0x7f00000000c0)='./file0\x00', 0x1000, 0x4, &(0x7f0000000440)=[{&(0x7f0000000340)="50542728d54bdb6dd3f319f6bb3ab302ba77477620f091509fa6dffbcb2135953eb0f8448bcf0ffe95a382a6323d6d66a7f2a0a9a2113d90e15cd3f8a208405013e569a4a2acc9a21cf86528883916cd3ed345d229d60b78", 0x58, 0xfffffffffffffff7}, {&(0x7f00000001c0)="42549be3246ed4282205680fed7e1fad01b1784f96450737164c3238cdcacaf682ebf50294f8b6c82b6434", 0x2b, 0x3ff}, {&(0x7f00000003c0)="271f798490bdefc1ade96664a972cbf826dcffc0bcba0779c54eb15e31a7464d62bc5232eab4f764b2ee7f34fa402a0e88a9f2d9821fa638b1eaa71bb7aed989242f4c3b7c5fcc7d2cf9ea5ad4c2c67a193e15ef6ac7e1dd5170", 0x5a}, {&(0x7f0000000580)="05ec9072206d3c219001dc2017498b760a7ce2166c6ddafa4a785527c9f3f396efb150ec1a5391b97f75596b9aaa4fcf5bf69da45cf175aa09ddec4f177ad8429449e9621591d1cf19650bca2f2f215bef0fd9e0e85bb5a5ccd3c562f9461eeee20f5b81b2ebd3667f8f89f8b61613f407770c7632d089bf4c4f2da8630584aac436d210183d5035345970441607247987aa9778dc06202d1883924789f27bfef72c3d6f1daf2283c3fdf026b079a13a925c1c38787396881568019ce3789ef6937b37895ff5397703b5d6", 0xcb, 0x101}], 0x0, &(0x7f00000004c0)='iocharset') truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:08:19 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) add_key$keyring(&(0x7f00000001c0)='keyring\x00', &(0x7f0000000300)={'syz', 0x3}, 0x0, 0x0, 0xfffffffffffffffe) r1 = request_key(&(0x7f0000000340)='trusted\x00', &(0x7f0000000380)={'syz', 0x0}, &(0x7f00000003c0)='syz', 0xfffffffffffffff9) r2 = add_key$keyring(&(0x7f00000000c0)='keyring\x00', &(0x7f0000000080)={'syz', 0x2}, 0x0, 0x0, r1) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x400100, 0x0) ioctl$TUNSETOFFLOAD(r3, 0x400454d0, 0x10) keyctl$setperm(0x5, r2, 0x404) r4 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/autofs\x00', 0x100, 0x0) setsockopt$inet6_MCAST_JOIN_GROUP(r4, 0x29, 0x2a, &(0x7f0000000240)={0x4, {{0xa, 0x4e21, 0x838a, @remote, 0x6}}}, 0x88) pipe2(&(0x7f0000001540)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4800) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffff9c, 0x84, 0xa, &(0x7f0000001580)={0x9, 0x1000, 0x0, 0x8c5e, 0x9, 0x8, 0x8, 0x5, 0x0}, &(0x7f00000015c0)=0x20) getsockopt$inet_sctp_SCTP_AUTH_ACTIVE_KEY(r5, 0x84, 0x18, &(0x7f0000001600)={r6, 0x99c4}, &(0x7f0000001640)=0x8) sendmsg$nl_generic(r0, &(0x7f0000000200)={&(0x7f0000000180)={0x10, 0x40030000000000, 0x0, 0xffffffffffffffff}, 0xc, &(0x7f0000000100)={&(0x7f0000000240)=ANY=[]}, 0x1, 0x0, 0x0, 0x8003}, 0x3) 06:08:19 executing program 2: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = socket$inet6(0xa, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp={0x2c, 0x0, 0x0, 0x3d}, 0x80) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r2, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000900)="b6", 0x1}], 0x1, &(0x7f00000009c0), 0x0, 0x4040000}, 0x4000040) r3 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r3, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:08:19 executing program 1: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) socket$inet6(0xa, 0x0, 0x0) r0 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp, 0x80) gettid() ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000600)}], 0x1, &(0x7f00000009c0)}, 0x0) openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x0, 0x0) sendto$unix(0xffffffffffffffff, &(0x7f0000000100), 0x0, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r0) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:08:19 executing program 5: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = socket$inet6(0xa, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp={0x2c, 0x0, 0x0, 0x3d}, 0x80) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r2, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000900)="b6d35518b48becfbd314d1fa96a307da879125869c71d40c5a385ce1d3af47c69a6acba0142b27475f2f890e1446d7e0851a8c84b5", 0x35}], 0x1, &(0x7f00000009c0)=[{0x90, 0x1ff, 0x800, "434c94cf096ca2c6e3a8a6433ea1ccf960ad859f9cabeb13bbcd113f89069f10afdedfc1c2c2a6455dc4d1cc5b8c42e105db6d89e5394ec484d7db74d839a1021c616111655c01f0d6840a2cc4a77a0a2613073b0d1e9ab634a70c9cafd212450fe14e5e32b6ee05d11e22515b1b820c7425d601c3c41b459046978582"}], 0x90, 0x4040000}, 0x4000040) r3 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r3, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x0, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) [ 579.231791] TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending cookies. Check SNMP counters. 06:08:20 executing program 0: r0 = syz_open_dev$vcsa(&(0x7f00000000c0)='/dev/vcsa#\x00', 0x7c99, 0x80000) setsockopt$inet_MCAST_MSFILTER(r0, 0x0, 0x30, &(0x7f0000000740)=ANY=[@ANYBLOB="070000000000000002004e24ac14141300000000000000f0e0bcee81b1395fdd6fde3e7abb0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000200000002004e210000000800000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002004e24ac1414bb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000026e3e372391a1843e952fa966e7711103fce4c55deb7fc1ccbc66d17b64783be39fa32cae921440fcc8526ea95fdd13a4d6ad11e2489dcb72ded3b5d58e21126a87aefc7c11052b0f1060361d98ea3c05d790eac77bdf24ddff3786b565b7b6263567097d2cc28fe7e3c569bfbc39142c316e42628b8526703a6b2327d9841bef5c6efb4ec17cf075e488e168c11d7b87850303ef4cb699b50eb9aab304be0d3200e7962b3567694dbd945611a94603e614ab2b78157f144679cf5f0cd8192743e7c271fa9510c2ea074e61bc3a6918390b7f2a726c89bb4b824fe2f"], 0x190) getsockopt$inet6_IPV6_IPSEC_POLICY(r0, 0x29, 0x22, &(0x7f00000001c0)={{{@in6=@local, @in=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@local}, 0x0, @in=@dev}}, &(0x7f0000000140)=0xe8) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/ppp\x00', 0x300, 0x0) r3 = syz_genetlink_get_family_id$team(&(0x7f0000000340)='team\x00') sendmsg$TEAM_CMD_NOOP(r2, &(0x7f0000000ac0)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x10004}, 0xc, &(0x7f0000000a80)={&(0x7f0000000b00)=ANY=[@ANYBLOB="0b17b09a409100008f50b7c2cbf5897f8210bc6a9dad09242cda3e45aa00000000000000000000000000", @ANYRES16=r3, @ANYBLOB="100225bd7000fbdbdf250000000008000100", @ANYRES32=r1, @ANYBLOB="b400020038000100240001006e6f746966795f70656572735f696e74657276616c00000000000000000000000800030003000000080004000400000038000100240001006e6f746966795f70656572735f636f756e7400000000000000000000000000000800030003000000080004000400000040000100240001006d6f646500000000000000000000000000000000000000000000000000000000080003000500000010000400726f756e64726f62696e000008000100", @ANYRES32=r1, @ANYBLOB="280102003800010024000100616374697665706f727400000000000000000000000000000000000000000000080003000300000008000400", @ANYRES32=r1, @ANYBLOB="3800010024000100616374697665706f727400000000000000000000000000000000000000000000080003000300000008000400", @ANYRES32=r1, @ANYBLOB="38000100240001006e6f746966795f70656572735f636f756e740000000000000000000000000000080003000300000008000400ff0f00003c00010024000100757365725f6c696e6b757000000000000000000000000000000000000000000008000300060000000400040008000600", @ANYRES32=r1, @ANYBLOB="40000100240001006c625f706f72745f737461747300000000000000000000000000000000000000080003000b000000080004000101000008000600", @ANYRES32=r1, @ANYBLOB="08000100", @ANYRES32=r1, @ANYBLOB="2801020074000100240001006270665f686173685f66756e6300000000000000000000000000000000000000080003000b000000440004000180000020000000ff7fff070900000000000903300a0000020008030600000006006004080000003600010100010000fdff87d00900000000040608fe78be2540000100240001007072696f72697479000000000000000000000000000000000000000000000000080003000e000000080004004000000008000600", @ANYRES32=r1, @ANYBLOB="38000100240001006c625f73746174735f726566726573685f696e74657276616c000000000000000800030003000000080004000700000038000100240001006e6f746966795f70656572735f636f756e740000000000000000000000000000080003000300000008000400df00000008000100", @ANYRES32=r1, @ANYBLOB="4800020044000100240001006270665f686173685f66756e6300000000000000000000000000000000000000080003000b0000001400040000000600060000000800062b0000008008000100", @ANYRES32=r1, @ANYBLOB="800102004c000100240001006c625f74785f6d6574686f64000000000000000000000000000000000000000008000300050000001c000400686173685f746f5f706f72745f6d617070696e67000000003800010024000100616374697665706f727400000000000000000000000000000000000000000000080003000300000008000400", @ANYRES32=r1, @ANYBLOB="3c00010024000100656e61626c65640000000000000000000000000000000000000000000000000008000300060000000400040008000600", @ANYRES32=r1, @ANYBLOB="40000100240001006c625f74785f686173685f746f5f706f72745f6d617070696e67000000000000080003000300000008000400", @ANYRES32=r1, @ANYBLOB="08000700000000003c000100240001006c625f74785f6d6574686f64000000000000000000000000000000000000000008000300050000000c000400686173680000000040000100240001007072696f72697479000000000000000000000000000000000000000000000000080003000e00000008000400f000000008000600", @ANYRES32=r1, @ANYBLOB="08000100", @ANYRES32=r1, @ANYBLOB="e401020040000100240001007072696f72697479000000000000000000000000000000000000000000000000080003000e000000080004000700000008000600", @ANYRES32=r1, @ANYBLOB="40000100240001006d6f64650000000000000000000000000000000000000000000000000000000008000300050000001000040062726f61646361737400000040000100240001006c625f74785f686173685f746f5f706f72745f6d617070696e67000000000000080003000300000008000400", @ANYRES32=r1, @ANYBLOB="080007000000000038000100240001006d636173745f72656a6f696e5f696e74657276616c0000000000000000000000080003000300000008000400acadef3f38000100240001006d636173745f72656a6f696e5f696e74657276616c0000000000000000000000080003000300000008000400ce48bc473c00010024000100656e61626c65640000000000000000000000000000000000000000000000000008000300060000000400040008000600", @ANYRES32=r1, @ANYBLOB="38000100240001006d636173745f72656a6f696e5f636f756e740000000000000000000000000000080003000300000008000400540000003c00010024000100757365725f6c696e6b75705f656e61626c65640000000000000000000000000008000300060000000400040008000600", @ANYRES32=r1], 0x6f4}, 0x1, 0x0, 0x0, 0x80}, 0x40000) finit_module(r0, &(0x7f0000000480)='bdevfmime_type%@-mime_type+*^userproc\x00', 0x3) r4 = socket$nl_generic(0x10, 0x3, 0x10) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r2, &(0x7f00000003c0)={0x40000000}) statfs(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)=""/31) syz_genetlink_get_family_id$team(&(0x7f0000000380)='team\x00') sendmsg$nl_generic(r4, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca580500000000000000b893123f89dedb03442000000000000000000000", @ANYRES32], 0x2}}, 0x0) 06:08:20 executing program 3: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r1, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x3, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)=[{0x10, 0x107, 0x5}], 0x10, 0x20040000}, 0x8001) sendto$unix(0xffffffffffffffff, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r0) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) ioctl$KVM_TRANSLATE(r0, 0xc018ae85, &(0x7f0000000080)={0x4, 0x16000, 0x0, 0x3f, 0x80000000}) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:08:20 executing program 5: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = socket$inet6(0xa, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp={0x2c, 0x0, 0x0, 0x3d}, 0x80) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r2, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000900)="b6d35518b48becfbd314d1fa96a307da879125869c71d40c5a385ce1d3af47c69a6acba0142b27475f2f890e1446d7e0851a8c84b5", 0x35}], 0x1, &(0x7f00000009c0)=[{0x90, 0x1ff, 0x800, "434c94cf096ca2c6e3a8a6433ea1ccf960ad859f9cabeb13bbcd113f89069f10afdedfc1c2c2a6455dc4d1cc5b8c42e105db6d89e5394ec484d7db74d839a1021c616111655c01f0d6840a2cc4a77a0a2613073b0d1e9ab634a70c9cafd212450fe14e5e32b6ee05d11e22515b1b820c7425d601c3c41b459046978582"}], 0x90, 0x4040000}, 0x4000040) r3 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r3, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x0, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:08:20 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafe53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca580500000000000000b893123f89dedb03442000000000000000000000000000000000000000", @ANYRES32], 0x2}}, 0x0) 06:08:20 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) r1 = socket$packet(0x11, 0x3, 0x300) r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000000)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) r3 = socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) pread64(r2, &(0x7f0000000340)=""/39, 0x27, 0x0) sendmsg$nl_route(r3, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000180)=@newlink={0x28, 0x10, 0xc362e63b3f31ba5f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x3}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) dup2(r1, r2) 06:08:20 executing program 2: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = socket$inet6(0xa, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp={0x2c, 0x0, 0x0, 0x3d}, 0x80) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r2, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000900)="b6", 0x1}], 0x1, &(0x7f00000009c0), 0x0, 0x4040000}, 0x4000040) r3 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r3, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:08:20 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed4ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca580500000000000010b893123f89dedb03442000000000000000000000", @ANYRES32], 0x2}}, 0x0) 06:08:20 executing program 1: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) socket$inet6(0xa, 0x0, 0x0) r0 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp, 0x80) gettid() ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000600)}], 0x1, &(0x7f00000009c0)}, 0x0) openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x0, 0x0) sendto$unix(0xffffffffffffffff, &(0x7f0000000100), 0x0, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r0) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:08:20 executing program 0: socket$nl_generic(0x10, 0x3, 0x10) r0 = openat(0xffffffffffffffff, &(0x7f0000000140)='./file0\x00', 0x101000, 0x10) getsockopt$IP6T_SO_GET_REVISION_MATCH(r0, 0x29, 0x44, &(0x7f0000000240)={'icmp\x00'}, &(0x7f0000000280)=0x1e) sendmsg$nl_generic(r0, &(0x7f00000001c0)={&(0x7f0000000200)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[]}, 0x1, 0x0, 0x0, 0x4002000}, 0x0) [ 579.681549] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 579.686031] attempt to access beyond end of device [ 579.693106] loop1: rw=1, want=130, limit=112 [ 579.719255] attempt to access beyond end of device [ 579.783954] loop1: rw=1, want=131, limit=112 [ 579.811652] attempt to access beyond end of device [ 579.841890] loop1: rw=1, want=132, limit=112 06:08:20 executing program 5: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = socket$inet6(0xa, 0x0, 0x0) open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp={0x2c, 0x0, 0x0, 0x3d}, 0x80) r1 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r1, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000900)="b6d35518b48becfbd314d1fa96a307da879125869c71d40c5a385ce1d3af47c69a6acba0142b27475f2f890e1446d7e0851a8c84b5", 0x35}], 0x1, &(0x7f00000009c0)=[{0x90, 0x1ff, 0x800, "434c94cf096ca2c6e3a8a6433ea1ccf960ad859f9cabeb13bbcd113f89069f10afdedfc1c2c2a6455dc4d1cc5b8c42e105db6d89e5394ec484d7db74d839a1021c616111655c01f0d6840a2cc4a77a0a2613073b0d1e9ab634a70c9cafd212450fe14e5e32b6ee05d11e22515b1b820c7425d601c3c41b459046978582"}], 0x90, 0x4040000}, 0x4000040) r2 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r2, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(0xffffffffffffffff) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:08:20 executing program 3: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r1, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x3, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)=[{0x10, 0x107, 0x5}], 0x10, 0x20040000}, 0x8001) sendto$unix(0xffffffffffffffff, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@abs={0x1, 0x0, 0x4e24}, 0xfffffffffffffe7b) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r0) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) [ 579.864511] attempt to access beyond end of device 06:08:20 executing program 2: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = socket$inet6(0xa, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp={0x2c, 0x0, 0x0, 0x3d}, 0x80) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r2, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000900)="b6", 0x1}], 0x1, &(0x7f00000009c0), 0x0, 0x4040000}, 0x4000040) r3 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r3, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) [ 579.887588] loop1: rw=1, want=133, limit=112 [ 579.895259] attempt to access beyond end of device [ 579.900296] loop1: rw=1, want=142, limit=112 [ 579.906957] attempt to access beyond end of device [ 579.914498] loop1: rw=1, want=143, limit=112 [ 579.919039] attempt to access beyond end of device [ 579.927619] loop1: rw=1, want=144, limit=112 06:08:20 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca580500000000000000b893123f89dedb03442000000000000000000000", @ANYRES32], 0x2}}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) 06:08:20 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f00000001c0)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca580500000000000000b893123f89dedb03442000000000000000000000", @ANYRES32], 0x2}}, 0x0) r1 = dup(r0) ioctl$SG_GET_ACCESS_COUNT(r1, 0x2289, &(0x7f0000000040)) [ 579.938784] attempt to access beyond end of device [ 579.944853] loop1: rw=1, want=145, limit=112 [ 579.970732] attempt to access beyond end of device [ 579.981767] loop1: rw=1, want=2178, limit=112 06:08:20 executing program 0: sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca580500000000000000b893123f89dedb03442000000000000000000000", @ANYRES32], 0x2}}, 0x0) socketpair$inet6_udplite(0xa, 0x2, 0x88, &(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_inet_sctp_SIOCINQ(r0, 0x541b, &(0x7f00000000c0)) fstat(r0, &(0x7f00000001c0)) [ 580.181103] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready 06:08:21 executing program 5: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = socket$inet6(0xa, 0x0, 0x0) open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp={0x2c, 0x0, 0x0, 0x3d}, 0x80) r1 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r1, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000900)="b6d35518b48becfbd314d1fa96a307da879125869c71d40c5a385ce1d3af47c69a6acba0142b27475f2f890e1446d7e0851a8c84b5", 0x35}], 0x1, &(0x7f00000009c0)=[{0x90, 0x1ff, 0x800, "434c94cf096ca2c6e3a8a6433ea1ccf960ad859f9cabeb13bbcd113f89069f10afdedfc1c2c2a6455dc4d1cc5b8c42e105db6d89e5394ec484d7db74d839a1021c616111655c01f0d6840a2cc4a77a0a2613073b0d1e9ab634a70c9cafd212450fe14e5e32b6ee05d11e22515b1b820c7425d601c3c41b459046978582"}], 0x90, 0x4040000}, 0x4000040) r2 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r2, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(0xffffffffffffffff) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) [ 580.616368] attempt to access beyond end of device [ 580.621361] loop1: rw=1, want=130, limit=112 [ 580.669880] attempt to access beyond end of device [ 580.722211] loop1: rw=1, want=131, limit=112 [ 580.728569] attempt to access beyond end of device [ 580.739190] loop1: rw=1, want=132, limit=112 [ 580.749294] attempt to access beyond end of device [ 580.760028] loop1: rw=1, want=133, limit=112 [ 580.770358] attempt to access beyond end of device [ 580.781246] loop1: rw=1, want=142, limit=112 [ 580.790343] attempt to access beyond end of device [ 580.801256] loop1: rw=1, want=143, limit=112 [ 580.810369] attempt to access beyond end of device [ 580.830243] loop1: rw=1, want=144, limit=112 [ 580.839388] attempt to access beyond end of device [ 580.850101] loop1: rw=1, want=145, limit=112 [ 580.862849] attempt to access beyond end of device [ 580.894430] loop1: rw=1, want=2178, limit=112 06:08:21 executing program 0: ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(0xffffffffffffffff, 0xc00c642e, &(0x7f00000001c0)={0x0, 0x80000, 0xffffffffffffffff}) ioctl$DRM_IOCTL_RM_MAP(r0, 0x4028641b, &(0x7f0000000200)={&(0x7f0000ffe000/0x2000)=nil, 0x8, 0x4, 0x20, &(0x7f0000ffe000/0x2000)=nil, 0x1ff}) socketpair$inet6(0xa, 0x80005, 0x80000001, &(0x7f0000000000)={0xffffffffffffffff}) ioctl$sock_SIOCADDDLCI(r1, 0x8980, &(0x7f0000000040)={'rose0\x00', 0x200}) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000080)='/dev/rfkill\x00', 0x400, 0x0) getsockopt$inet_sctp_SCTP_EVENTS(r3, 0x84, 0xb, &(0x7f0000000240), &(0x7f0000000280)=0xb) sendmsg$nl_generic(r2, &(0x7f00000002c0)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f00000003c0)=ANY=[]}}, 0x0) r4 = syz_open_dev$dspn(&(0x7f00000000c0)='/dev/dsp#\x00', 0x8, 0x240) setsockopt$RDS_FREE_MR(r4, 0x114, 0x3, &(0x7f0000000140)={{0x7}, 0x40}, 0x10) 06:08:21 executing program 3: r0 = memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r2, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x3, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)=[{0x10, 0x107, 0x5}], 0x10, 0x20040000}, 0x8001) sendto$unix(0xffffffffffffffff, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r1) ioctl$sock_inet_udp_SIOCOUTQ(r0, 0x5411, &(0x7f0000000080)) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:08:21 executing program 1: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) socket$inet6(0xa, 0x0, 0x0) r0 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp, 0x80) gettid() ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000600)}], 0x1, &(0x7f00000009c0)}, 0x0) openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x0, 0x0) sendto$unix(0xffffffffffffffff, &(0x7f0000000100), 0x0, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r0) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 06:08:21 executing program 2: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = socket$inet6(0xa, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp={0x2c, 0x0, 0x0, 0x3d}, 0x80) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r2, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000900)="b6", 0x1}], 0x1, &(0x7f00000009c0)=[{0xa0, 0x0, 0x800, "434c94cf096ca2c6e3a8a6433ea1ccf960ad859f9cabeb13bbcd113f89069f10afdedfc1c2c2a6455dc4d1cc5b8c42e105db6d89e5394ec484d7db74d839a1021c616111655c01f0d6840a2cc4a77a0a2613073b0d1e9ab634a70c9cafd212450fe14e5e32b6ee05d11e22515b1b820c7425d601c3c41b459046978582375e37f0268020620ba8c96a1cf8de5399"}], 0xa0, 0x4040000}, 0x4000040) r3 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r3, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:08:21 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) r1 = syz_open_procfs(0x0, &(0x7f00000006c0)='pagemap\x00') sendfile(r0, r1, &(0x7f0000000040)=0x100000, 0x8001) syz_genetlink_get_family_id$team(&(0x7f0000000180)='team\x00') getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000001c0)={{{@in=@multicast2, @in6=@ipv4={[], [], @multicast1}}}, {{@in6}, 0x0, @in=@rand_addr}}, &(0x7f00000002c0)=0xe8) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000780)={'team0\x00'}) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000002100)={{{@in=@dev, @in6}}, {{@in6=@ipv4={[], [], @multicast2}}, 0x0, @in=@loopback}}, &(0x7f0000002200)=0xe8) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f000000a240)={0x0, @remote, @remote}, &(0x7f000000a280)=0xc) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f000000b600)={{{@in, @in=@dev}}, {{@in=@multicast2}, 0x0, @in6=@local}}, &(0x7f000000b700)=0xe8) recvmmsg(0xffffffffffffffff, &(0x7f0000011780)=[{{&(0x7f000000e180)=@hci, 0x80, &(0x7f000000f540), 0x0, &(0x7f000000f5c0)=""/157, 0x9d}}], 0x1, 0x0, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r1, 0x8933, &(0x7f00000119c0)={'team0\x00'}) 06:08:21 executing program 5: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = socket$inet6(0xa, 0x0, 0x0) open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp={0x2c, 0x0, 0x0, 0x3d}, 0x80) r1 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r1, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000900)="b6d35518b48becfbd314d1fa96a307da879125869c71d40c5a385ce1d3af47c69a6acba0142b27475f2f890e1446d7e0851a8c84b5", 0x35}], 0x1, &(0x7f00000009c0)=[{0x90, 0x1ff, 0x800, "434c94cf096ca2c6e3a8a6433ea1ccf960ad859f9cabeb13bbcd113f89069f10afdedfc1c2c2a6455dc4d1cc5b8c42e105db6d89e5394ec484d7db74d839a1021c616111655c01f0d6840a2cc4a77a0a2613073b0d1e9ab634a70c9cafd212450fe14e5e32b6ee05d11e22515b1b820c7425d601c3c41b459046978582"}], 0x90, 0x4040000}, 0x4000040) r2 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r2, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(0xffffffffffffffff) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:08:21 executing program 0: r0 = accept4(0xffffffffffffff9c, 0x0, &(0x7f0000000040), 0x800) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(0xffffffffffffff9c, 0x84, 0x6d, &(0x7f00000002c0)=ANY=[@ANYRES32=0x0, @ANYBLOB="5700f4ffef4a854135119d59ace22533fc017494cbc22458263dc83b769cceae049751a2008000000000000089271c86eb2ea19ad5a20fe7c878a2526fbed7734a9cce799b630f023f1ce29bd60cd6d9a893ffffff7f00000000888fa5000000"], &(0x7f0000000140)=0x5f) setsockopt$inet_sctp_SCTP_AUTH_DELETE_KEY(r0, 0x84, 0x19, &(0x7f0000000280)={r1, 0x2}, 0x8) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f00000001c0)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb61f912c4c6d9d45c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca580500000000000000b893123f89dedb03442000000000000000400000", @ANYRES32], 0x2}}, 0x0) 06:08:21 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca580500000000000000b893123f89dedb03442000000000000000000000", @ANYRES32], 0x2}}, 0x0) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/autofs\x00', 0x0, 0x0) ioctl$KVM_SIGNAL_MSI(r1, 0x4020aea5, &(0x7f0000000140)={0xf000, 0x1, 0xffffffff, 0x10001, 0x7ff}) 06:08:22 executing program 2: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = socket$inet6(0xa, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp={0x2c, 0x0, 0x0, 0x3d}, 0x80) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r2, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000900)="b6", 0x1}], 0x1, &(0x7f00000009c0)=[{0xa0, 0x0, 0x800, "434c94cf096ca2c6e3a8a6433ea1ccf960ad859f9cabeb13bbcd113f89069f10afdedfc1c2c2a6455dc4d1cc5b8c42e105db6d89e5394ec484d7db74d839a1021c616111655c01f0d6840a2cc4a77a0a2613073b0d1e9ab634a70c9cafd212450fe14e5e32b6ee05d11e22515b1b820c7425d601c3c41b459046978582375e37f0268020620ba8c96a1cf8de5399"}], 0xa0, 0x4040000}, 0x4000040) r3 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r3, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:08:22 executing program 5: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = socket$inet6(0xa, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp={0x2c, 0x0, 0x0, 0x3d}, 0x80) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r2, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000900)="b6d35518b48becfbd314d1fa96a307da879125869c71d40c5a385ce1d3af47c69a6acba0142b27475f2f890e1446d7e0851a8c84b5", 0x35}], 0x1, &(0x7f00000009c0)=[{0x90, 0x1ff, 0x800, "434c94cf096ca2c6e3a8a6433ea1ccf960ad859f9cabeb13bbcd113f89069f10afdedfc1c2c2a6455dc4d1cc5b8c42e105db6d89e5394ec484d7db74d839a1021c616111655c01f0d6840a2cc4a77a0a2613073b0d1e9ab634a70c9cafd212450fe14e5e32b6ee05d11e22515b1b820c7425d601c3c41b459046978582"}], 0x90, 0x4040000}, 0x4000040) r3 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r3, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x0, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:08:22 executing program 1: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) socket$inet6(0xa, 0x0, 0x0) r0 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp, 0x80) gettid() ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000600)}], 0x1, &(0x7f00000009c0)}, 0x0) openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x0, 0x0) sendto$unix(0xffffffffffffffff, &(0x7f0000000100), 0x0, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r0) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 06:08:22 executing program 3: r0 = memfd_create(&(0x7f0000000040)='iocharset', 0x2) getresuid(&(0x7f00000019c0), &(0x7f0000001a00), &(0x7f0000001a40)=0x0) syz_mount_image$vfat(&(0x7f00000000c0)='vfat\x00', &(0x7f00000001c0)='./file0\x00', 0xfffffffffffffff9, 0x8, &(0x7f0000001900)=[{&(0x7f0000000340)="29a40a1dd64b8efed384c844e4caea356bed58c3aff20ef620faee3745218cc1d529523cec9fd620f7d7ff18a7a76494ad57074254061efefc4872343214824068b9794256abb6dc27f919e72844b45be47d8f1be5477040fded36e936bc1d1bf09166f856c6f0c29643c2508685191e031cce84933ec1ca6a03e5c1514cc61898e34677dd14e778b52e254b922836fc513efb34a76bbc220b2546d113255ac345209a9f91073be1c0ac8e8c65f76454535a61af61c185f71463ded002cca1e81267e9dfe306916cbee6adeac637a9b1e19007e9b7acee8be1680e3edd22966ea28869a072271ba7e0ffaca56e7f1fb3acc7b32453bf48517bb7641343", 0xfd, 0x1}, {&(0x7f0000000440)="742774320199ca782e60cfc08e9cc5775af8dc90daf49b12cf5bd46618815ac69eaa3d864b48c3e12adb113d11c243a5cea61f4c7a6271aa6877035a3252b4f8b7ff0ffbeb4b5fec0c74a9cc2acacf0a1425c41ce8f12948098334c334c566ead18b14440660e77d07249e2c76724352cbbc46804b8ffad8647a8c912a7a4f9e0d538a10f8", 0x85, 0x5}, {&(0x7f0000000580)="eba8fc84c8134940e9fa452d6f0bb0e193ca1a0254d58440b452ae394c111d8701b43d4ac215cb39d2e75c082d9f89c1708bd3d546e9d7edf9b047566ef9601c209cc7de195a0a47427333cee9ac3cb574486da8ae57cc1dcf1e827ed0750382899899f95b522a10da45462a8532158a53af3f0e46a060e03825dc30f46fcae25e4c415cb8af3f149289a3b0eff58d6863c565f231ea991a919028cbcfbcdeb6980609dac68edc63a9cd87f6c561290c72091b18934c5f10357467ce3cede2cd84665600bdb5afc3f008e9f4b6e072d27134e7a556a32398a0b1360d13f3b89fb18d8916dddf81343ef4982c9e93e57456c8af30f1a2dd3d574ba8a180", 0xfd, 0x7f}, {&(0x7f0000000680)="5186586a4799fec83c79b664eb522f7ff0703a03e16d712466945e23e50049c515812dea3ce5f5692c0d18", 0x2b, 0x401}, {&(0x7f0000000900)="38e28d47be8cdd3e0f661307b342f1de7299a33411f8006614a5f200d3c07668bfc5f720a98ef3707c14136b79d74316ef96a42a3948a323382a019734ebbc69d1ac21ea8669e4b55fa0d0cc98744417f5dffd9658dc4a472c2563491bfefb40736ae798a76ef86aae1c9e1f757a83a0ce05ed662a803e01a67c01e235bd635572f676e514d6d4262e6ed8dc9ddbc79987ab3fbfdb157a8bebcb2731e7b05dbb80175486a1006e36ab419e3233fe8c3cc30569e75ad1200c5327c01a65cd7d02d6c308afd1f736996e7dd711ee57a0c9f510188323418b9c2a73a2b4273cd2b857530ea7956643856eff77f49bd862644bebf1a6e79b59c50eb68b5d091ce2156843099496a37f5cba7751573324f1766d9d5d19d8e8062cdd1db99e18ac5558c8b795b431fda1fcebdcb83b41bcbabb952fd0a7013d580e72d0ea97ab2e2af24f3ca7c1b13afce16efa40ccd106d31871ff4caaabf7f5b78aa589a8ba91258c6e63d85db279791226457f6d915d722e0e5d17244d1cb665135d736a3d4598051e9e7af1e9b318d7fb02cf2cf21002a97ff8288c6f68851335740f39bdd600a3ca7c1b09a23a61bce7a37a67467939016b6f0de1ee04c5d328dc2c374dc48fb40793c1479ef2d72ae61ab69c7e0e9a04f99c2431bc440051b202c9362123cb089732fefb51a8a7e29ce72851781845bcac0e34807a069a2b2bc5a39b8c3c8998725fdeaa459928e2dbec950c9247107a4106d7ef08ec6b2e8dac1a2e958a6f9918ed666c52c01ac2d081490a2471169cf2c780d22ee8618d4f1a5ca8ac7bbf9c290753373b60603d0ebb95ff19d91866d744a6d4cfcaa3a87580ad182e4d9a0bfafe460a378936051d9ead3deaab7097251197ea55b3df8db71946532e07c631f4057ec1b2408c337a26c8ed42805b889bc2c9b4398dd75002fc9a0317af7ad456a1e2aff5531ee5b40540a7ad01edf683c71274e6ed828ee14aed956542baad6c5308b54fe66f73f0c6fca2b2d0655db9f4faecc7dcf47ea7e8fcec59e2640dfa70813908916a2fbf8ade6712e8bd52b3d6f1d910cc3392aec4191002d6d3c6d40094d681e83d466dcaf8d69a18784d9edb46387b66a67b0a9c07fada0f4ae73d49b6a8e63f86daac64bd0885355465aa31718aadde5d443672367047f7296df0016f1538716dd08dc70ef8810edf0b871aad3bd294266ff499199e1cfbee81aae0d93d774f275d20c7d7e13d1fc408a857171ef33eb51322d63cc5e93f04384fbbc6c9e7f7afcb6a6f55870fe8c25b61c5ac80fe0a4fff0364be741b6c72aac543847bef366e464b42c86b09eac7ebd4a24c8ea6ea0ba88a3daefa39d38e5b595b24c5ed5fffa8d461b87ef3d870c80b837755d2064b82d0643139e74bd683fc34e5e3a0e0b3ef817614effd5c8ce40522fcf1a18ea59fa3cec39b3d128c87cfcfe0931472881a36292c608a3bd73e35e2e182db46bc66239902459b29cd80e05f22e52b53918c95c038850974134383627b73ece79038dd759bdf2c513deb97a82cc33254c1fa2c5fc4ae888db3d67b2482e91cd39d999530639b350ba6516a65c4f2d5fb77015b89a6ace62d762f8781d0e129e37eb50a3af56c6badb8ddf60fc46adf0d0186956be1613600dbf700cf8df4b14884ffe5c7180103ce84ec62b4fce8e05f485dbb9964d84d34d34aef6b17534692dfe4c6f95bf7b9a4f6c2ea1aad8317dcef2847377b98a6a96ab46df1467a78cdedb6c21bb4e786b90965ce894529965f39c5a9995173ba42d47246c6e91f707831b6ec1b792c9f7731e285e8d1f145bf7359a5e376719d2a080f4ee144c7809600696524bf92a244e944913d9731694abaac2d203bb51500878674da4ceac11fd1387592ad92686e810eb3059b8304571650c3bcddaec7e9a4f1c288823d8f65e76fbf4570c6845c5388d710fa03d2591a0a648d07fdb3ae58442db19e40597b76819d628480bb3014b4793e2ab621b0be2a1ac7437ba1c012620e679971493d5237f8cbdc2958606dccf86fe4c6661f1811c6f4bf990fe3da0b070ff0cf7d06ce3cf7d43880d43bb57d2ac8a88fa26ef000ab9eda99167eac9f1a0239a0c2cdef12ff83fd65d8aae2ba6f33ba2d712898582617a2c3cf49156a2a7b0a4333e55e3d29680d6ce02dec99b5ca41d855dfbe7cf9b587821767630585d27677dc5068fd9753deaf442c86626b73a732267f3fd5ca1ea2b26a120df5c808936937b4cd8a105e592300ec8484bb5abeedca740f52ae8a82aaeff4528730aff73d11aaf6ba1f87581ac0537073c0a31c96af17801e98eba5fa025c9a896ab892d54a8ebf3ea367d3a227812e39a44f96c993ea080c42d6e88ef5cf749817f5b1169eb1e99ba0b6a66fccdfaba90b3b2bcbc60a387f97bd7965b60c37e9f07b59009a03b8ae42298ff4a4b5354471cb02c5caf4082ac59e811fad4a6b3dfefbaad2722123fa3ba00a4646cf5ba2aede6d19adc353847de0e43465b4a2e289fc286c76f6277e1f3f18a6925435781f2763eaa37b4319d68d405aa1b377dc04cd1e886b35c3847555ac41270d294d1f32568d54cc79af3512ec8458afe0f354b1ed1fff143601f07f05296c7478db7f0d312ac8707a772462d21465d55eca4aa47a2f65fb2bfb6e28b6212220d7d86f02a13cfd85039b9d95f9f645c963bf55056a9d2db081e642577d483feba02cc601eafc20043bec5edf1ce9a3af07a313f03957e964227d9fef6950fc77dd289db379b66db402ad577d646e5870d06e328d78ba30ae7af7c50783fec109940ef9eb7e2b5ab40d1d3b492743a2fcf962f50f0c5b404176a68c4a1f3c50c1ffe57b28b1cb82304b3ec27e1cac065832690a4750b65700fb4b505a0a3d95d2809a516ec38f8b8f08ee72ded8278a6c5f3c870ff7e1f172b83bee0f0e15965631a2a4ad5cc1f65b356f234feec3bfd3ac445059d2185a44de78333277c52e3a694f270edf5f47986c5d189343d57282dfa2578950650f27aea4df31ceb341526e13958c7dd00f237824b0f6abcd8885255cabe67a7e8c66829aef7b453e22cb2cce32fc37911d6d864c04e50ae85b4de168345a6b21b0ee8f4b4bb8021dd52734c3fdd2de04ccf8b7d108219a58454ffe0ed894f08a60646f2234af9825c1c9e391114f2328d2b0cc13e36a02865a5c92fec78cc1c8ba1af2b1840feb4fc4d0369db28cd99f46484db97d75d9140bc45a16da2d3f4f7d6bccecf568ede88cb1023da4351217c08f7f9309cac0c049ccbb7116ab6f5d92443d4b1802d27cdcbfb1d1088ad4c1d6fa9c7ed96f2ebb6002932f9d4f7fcee21a55700f2d9535921a755a23bd7280dcadc95c591867dc79d01df34c507a55566f178c9c3139d529a7fafecabb73f4e153408432208c6f67b92e73e0b315e805d2a8ed795d37d2dbb2d3458e0174ce4a0516b8addc009eed02bf807f201b36a5536f76cb0a0e775cd3296075668433922b65b3ad1ecc68f233f17f6778024300f7f325f9be43bc781d286e107ad1ee0f64000db82ea6deef248839967bec51d954960e6b61b34271fb8859ffb188e2cdf5075190a0f88fffcc73498eece3c20368c6eca8e6c6d68ce9ecf7c953e4ad048018236959d746595c1f35ca1def43c53b86449b8cc882cadedbb55d94d6ca11a06179943f457579d622a7e114e615034ca129c8f8ac7e7d5fe70f584f1b02ff2e5917ee2cda9b8dc4837fa27373ca80d8f919b76355fcaff96b6f620fdf06e55f5d8a6a7458c34289e4820ec19c6566998e2f93403523c6985bd3203d740b433a41cb3d6720f6a587f6239e6119cf13297e4aeb25a12fd95752e68f5f8063cf12b188090ee080f93b7680e9c6cc945b40cf45e57cd10ebb6047870be4481167781ca41ba48ccc419e79d3558bf85e5592ffef89fd6cc8aa1bf3bb35cd0c09be5fa09bf375490e8f5263bdb46bd339d05c41520993bdcdb6338f711c6cf0b0bbbb3ace0e433e0c258af7c58cbade451174a24dd3027f980f3dee3185ee46c2f4924e6aaf9d1223de5ddca2411e5d91e40451e688808f0a45af74d433bab32c5d50051e9ea10db742d776c23c989f986ecb1a4e80dc14664d900228b5b58b3459006b02e377239fc86b6b811ad16c724a22aa758c3df13583f45aec0ce38372600217679fc1fc952559c8f922a00b572699aa51f9d29db2101be219e111e1f67cdc85d76252021a00f64b9e370ab5d6d2e79e4db943e40928f33a403b5dbaaee79cc5026672ec39c7e9d3283a20cd4de4106595015376677e15e308d4c95a43646b4badcc899c5acb699c72db5104b25d2ed56ca601eda5e1b8b3d924389f65643610ef71d5fcb001a8b2f7e91eb0f0a8aee1338d51ffb7294ef9073f5da9eea911815a7b79e06fbd977684ad713f1f168ba1b9cb62e0841e67b6dc54c9012b87eb55e286810f8ed6b9f903c0177db795233dae04657899a02fcf3f152045a31987ef84a857226dc36dc6cc46a4f8516fe045068facf9ee7da420c816f19b7e13ab9c3eb5d2b36b0ca59b3b01f3f886bf012be0604b4079f50d6921483ea20b857fb1987dd46e2a77949b848d54db62ce76f53c3ab84eb1146b65aeae16109a36307109c2120627920c764802d8c2204776cb59429c95b2d123bdf465af2c118726dca3fd21491cef75398269ee986d6ce2b636d26db875b21d502bd25cb5d4c50eb6df7b8682e7e157399c9ff0cdfaa6347bf56c42e3b710482fbedc312f1768c453fdd7191e4155a2224e9337bcfe80a9010a58e8428a8bb052ac52ba7bfe7fb627942f14706fd782256a472703d187c83e5e76444fc6c1652a1670b1c83873cff24bf143719d2498f45cfaf3665617bbd4c28627f031aab19e4bba8c66ede3be4af4a4a2cfd84b5a4661e774828083659124be45dcf81b807acff6b52055d7c51fca826e0383516bcfa5b9e7d611d69fcd3275923abcbb7abd5039198935633979d9b45e57171d7fed7f7f1a895abde0a6fd47b4488a1cecf9822b854a22235fde6a1a3e31bb0c9a1ce095710753aa3277d5769ad45a37d18f1a934ae41549f2b91889d488b86bfdbb8736873388bb645c70226090aadb1c9874f95a9eb4966b36e167587caba0e4706adfa97f1327ce5954504e819c5639aaf618ed7b206acc56cd93f4420df427232efd576cd82c5523cd961cba51288a5b49a3e68d680798b8af3472f4506e745c143420a270e754037f9df1fb9aec1da033baa3e20f689916503c6797aec821364cbdfaac7d78847816578427ee4002369a2be89f096bd84718a6ced3b2b215833ae7736db5791473242ffa08a3b220abe4c6fe8bf098c62476899700fe29824603f5326af915a83f0985ad4cd5bc3d4704701b999c06591e5bcffa205430b728fa76240c0a234f403eb55bb827c876bb651e387c8cd25ccbf5a9e4c54cefd2561d6f6fadb28c3e2ef4d0d8869c24d1ab6a9e462169b82c6e1f82298722b651659a4dbb7be62a62c4797dfd0b4dcf5ed8d61a0bba073904715776996a70128fbb14e5b05ae7022003283a4b69f42a4453f68ab32b32e7e3349e5418039ca96127fb3a70e0339c838d24f2182905989e32384664380a343a51da99bb32503d0e6c336b76a163b869a36e397ef2225f1bcd880638f92b349f19a72ac8f4ff70656d7ec22fb927d2a937be5df5949518dc2bf4ecaface0856c606567a1982c3ca77ca5d82c55a3ab6d88aa9e7ac8aaafc8cd01905c1f4db7609de4ab5586982f029f2e78f39c1c01987ddda1acf33cd4aa871e", 0x1000}, {&(0x7f00000006c0)="c2adb9de0993971c754df549532ca08e4088e4a081c6ac238f36", 0x1a, 0x100000000}, {&(0x7f0000000780)="f0a31c12512b8427a1de495e2ab5d4cab3a30fafd3912098de9f4608ccdfb8afb818e8eb3e6d4721", 0x28, 0x8}, {&(0x7f00000007c0)="4af4a242a2aa4e5ecac5a3d9bc398cfdc204d5f2e6cc897dbe3be696435356fee5c2deb841d62055d925779fd365f57d6ec4cae9090811e2c57860d98e8fa1291a588989e7058420e6960c2f0f3636637b8ce649834acbe073102681576dafc4e5191c8accaf10644f97c1bf8a596c305245030975f160148e1f943488ebfe57623b844adcdb3648bb3cbe3cc2bec512352891cbe6148bfc3dd997d22f76f468d344c69a669dcb1618fc07f549b124ac755ea55158e56e921d4bf3f843674abdb55c902a3e7ce274d8e5e119501618d788e3ca030db018c2a0f1bab82c0e9e909ffeace06316c1471ec4a83868bafab0f41e", 0xf2}], 0x1, &(0x7f0000001b40)=ANY=[@ANYBLOB='shortname=mixed,nonumtail=0,utf8=0,nnonumtail=1,utf8=0,fowner<', @ANYRESDEC=r1, @ANYBLOB="2c7375626a5f747970653d7d76626f786e657431237070703170726f6373656c662c387182cd70b62b9d79d57e0ba5006b1944fcea357a"]) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r2 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r3, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x3, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)=[{0x10, 0x107, 0x5}], 0x10, 0x20040000}, 0x8001) sendto$unix(0xffffffffffffffff, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r2) syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x4, 0x200) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$VHOST_SET_VRING_KICK(r0, 0x4008af20, &(0x7f0000001b00)={0x3, r2}) 06:08:22 executing program 0: r0 = creat(&(0x7f0000000240)='./file0\x00', 0x4) getsockname$unix(r0, &(0x7f00000001c0)=@abs, &(0x7f0000000140)=0x6e) r1 = socket$nl_generic(0x10, 0x3, 0x10) setsockopt$inet6_MRT6_ADD_MIF(r0, 0x29, 0xca, &(0x7f0000000300)={0x3, 0x0, 0x5, 0x8ac0, 0x7}, 0xc) sendmsg$nl_generic(r1, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c000000340019010000001000040000000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca580500000000000000b893123f89dedb03442000000000000000000000", @ANYRES32], 0x2}}, 0x0) 06:08:22 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) r1 = syz_open_procfs(0x0, &(0x7f00000006c0)='pagemap\x00') sendfile(r0, r1, &(0x7f0000000040)=0x100000, 0x8001) syz_genetlink_get_family_id$team(&(0x7f0000000180)='team\x00') getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000001c0)={{{@in=@multicast2, @in6=@ipv4={[], [], @multicast1}}}, {{@in6}, 0x0, @in=@rand_addr}}, &(0x7f00000002c0)=0xe8) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000780)={'team0\x00'}) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000002100)={{{@in=@dev, @in6}}, {{@in6=@ipv4={[], [], @multicast2}}, 0x0, @in=@loopback}}, &(0x7f0000002200)=0xe8) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f000000a240)={0x0, @remote, @remote}, &(0x7f000000a280)=0xc) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f000000b600)={{{@in, @in=@dev}}, {{@in=@multicast2}, 0x0, @in6=@local}}, &(0x7f000000b700)=0xe8) recvmmsg(0xffffffffffffffff, &(0x7f0000011780)=[{{&(0x7f000000e180)=@hci, 0x80, &(0x7f000000f540), 0x0, &(0x7f000000f5c0)=""/157, 0x9d}}], 0x1, 0x0, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r1, 0x8933, &(0x7f00000119c0)={'team0\x00'}) 06:08:22 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000140)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca580500000000000000b893123f89dedb03442000000000000000000000", @ANYRES32], 0x2}}, 0x0) 06:08:22 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca580500000000000000b893123f89dedb03442000000000000000000000", @ANYRES32], 0x2}}, 0x0) setsockopt$netlink_NETLINK_LISTEN_ALL_NSID(r0, 0x10e, 0x8, &(0x7f00000000c0)=0x2, 0x4) 06:08:22 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) r1 = syz_open_procfs(0x0, &(0x7f00000006c0)='pagemap\x00') sendfile(r0, r1, &(0x7f0000000040)=0x100000, 0x8001) syz_genetlink_get_family_id$team(&(0x7f0000000180)='team\x00') getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000001c0)={{{@in=@multicast2, @in6=@ipv4={[], [], @multicast1}}}, {{@in6}, 0x0, @in=@rand_addr}}, &(0x7f00000002c0)=0xe8) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000780)={'team0\x00'}) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000002100)={{{@in=@dev, @in6}}, {{@in6=@ipv4={[], [], @multicast2}}, 0x0, @in=@loopback}}, &(0x7f0000002200)=0xe8) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f000000a240)={0x0, @remote, @remote}, &(0x7f000000a280)=0xc) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f000000b600)={{{@in, @in=@dev}}, {{@in=@multicast2}, 0x0, @in6=@local}}, &(0x7f000000b700)=0xe8) recvmmsg(0xffffffffffffffff, &(0x7f0000011780)=[{{&(0x7f000000e180)=@hci, 0x80, &(0x7f000000f540), 0x0, &(0x7f000000f5c0)=""/157, 0x9d}}], 0x1, 0x0, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r1, 0x8933, &(0x7f00000119c0)={'team0\x00'}) 06:08:22 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f00000001c0)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008dbd000f300d36f2953ed5ffdbaf9080641c5ee5c20c1863eabafbbb6c8918c00ce292de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61b3cfef48c0bcc9ca580500000000000000b893123f89dedb03442000000000000000000000f9030cdcc45789b0f0930572899d0350d8dc2926f1f8115fbf0125de44ef0ac99e4b0a9fe1f61f7bd74bfc273366232e22c11293bc9b4c18e7c47255577b1e20", @ANYRES32], 0x2}}, 0x0) ioctl$EXT4_IOC_RESIZE_FS(r0, 0x40086610, &(0x7f0000000140)=0x9) inotify_init() [ 581.662881] FAT-fs (loop3): Unrecognized mount option "nnonumtail=1" or missing value 06:08:22 executing program 5: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = socket$inet6(0xa, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp={0x2c, 0x0, 0x0, 0x3d}, 0x80) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r2, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000900)="b6d35518b48becfbd314d1fa96a307da879125869c71d40c5a385ce1d3af47c69a6acba0142b27475f2f890e1446d7e0851a8c84b5", 0x35}], 0x1, &(0x7f00000009c0)=[{0x90, 0x1ff, 0x800, "434c94cf096ca2c6e3a8a6433ea1ccf960ad859f9cabeb13bbcd113f89069f10afdedfc1c2c2a6455dc4d1cc5b8c42e105db6d89e5394ec484d7db74d839a1021c616111655c01f0d6840a2cc4a77a0a2613073b0d1e9ab634a70c9cafd212450fe14e5e32b6ee05d11e22515b1b820c7425d601c3c41b459046978582"}], 0x90, 0x4040000}, 0x4000040) r3 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r3, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x0, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) [ 581.833194] FAT-fs (loop3): Unrecognized mount option ") [ 581.833194] KӄD5kXï 7E!)R< dWBTHr42@hyBV'(D[}Gp@66fV–CP΄>jQLFwx.%K(6Q>4k" %F%ZE ;edTSZaac̡gl7鷬h>"n" or missing value 06:08:22 executing program 4: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'hash\x00', 0x0, 0x0, 'cmac(twofish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000100)="de75e1fe7d0e7634b214a3765ba0017995103a08917fc2a1", 0x18) 06:08:22 executing program 2: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = socket$inet6(0xa, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp={0x2c, 0x0, 0x0, 0x3d}, 0x80) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r2, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000900)="b6", 0x1}], 0x1, &(0x7f00000009c0)=[{0xa0, 0x0, 0x800, "434c94cf096ca2c6e3a8a6433ea1ccf960ad859f9cabeb13bbcd113f89069f10afdedfc1c2c2a6455dc4d1cc5b8c42e105db6d89e5394ec484d7db74d839a1021c616111655c01f0d6840a2cc4a77a0a2613073b0d1e9ab634a70c9cafd212450fe14e5e32b6ee05d11e22515b1b820c7425d601c3c41b459046978582375e37f0268020620ba8c96a1cf8de5399"}], 0xa0, 0x4040000}, 0x4000040) r3 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r3, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:08:22 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca580500000000000000b893123f89dedb03442000000000000000000000", @ANYRES32], 0x2}}, 0x0) r1 = openat(0xffffffffffffffff, &(0x7f00000000c0)='./file0\x00', 0x292000, 0x80) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000140)={r1, 0x50, &(0x7f00000001c0)}, 0x10) [ 582.291964] FAT-fs (loop3): Unrecognized mount option "nnonumtail=1" or missing value 06:08:23 executing program 1: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) socket$inet6(0xa, 0x0, 0x0) r0 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp, 0x80) gettid() ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000600)}], 0x1, &(0x7f00000009c0)}, 0x0) openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x0, 0x0) sendto$unix(0xffffffffffffffff, &(0x7f0000000100), 0x0, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r0) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) 06:08:23 executing program 3: r0 = memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x1, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0xfffffe03}], 0x800000000000, &(0x7f0000000080)=ANY=[@ANYRES64=r0]) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r2, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x3, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)=[{0x10, 0x107, 0x5}], 0x10, 0x20040000}, 0x8001) sendto$unix(0xffffffffffffffff, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:08:23 executing program 4: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000180)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000040)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000200)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @mcast1}, r1}}, 0x48) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000300)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000280)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f00000002c0)=0x1, r2, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f00000000c0)={0xe, 0x18, 0xfa00, @id_resuseaddr={&(0x7f0000000000)=0x1, r1, 0x0, 0x1, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21}, {0xa, 0x0, 0x0, @local}, r2}}, 0x1ff) 06:08:23 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={&(0x7f0000000180)={0x10, 0x40030000000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000003400190100000010000400000100000008000200d36f2953ed5ffdbaf9080641c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca580500000000000000b893123f89dedb03442000000000000000000000", @ANYRES32], 0x2}}, 0x0) ioctl$FS_IOC_SETVERSION(r0, 0x40087602, &(0x7f00000000c0)=0x5) 06:08:23 executing program 5: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = socket$inet6(0xa, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp={0x2c, 0x0, 0x0, 0x3d}, 0x80) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r2, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000900)="b6d35518b48becfbd314d1fa96a307da879125869c71d40c5a385ce1d3af47c69a6acba0142b27475f2f890e1446d7e0851a8c84b5", 0x35}], 0x1, &(0x7f00000009c0)=[{0x90, 0x1ff, 0x800, "434c94cf096ca2c6e3a8a6433ea1ccf960ad859f9cabeb13bbcd113f89069f10afdedfc1c2c2a6455dc4d1cc5b8c42e105db6d89e5394ec484d7db74d839a1021c616111655c01f0d6840a2cc4a77a0a2613073b0d1e9ab634a70c9cafd212450fe14e5e32b6ee05d11e22515b1b820c7425d601c3c41b459046978582"}], 0x90, 0x4040000}, 0x4000040) r3 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r3, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x0, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) 06:08:23 executing program 2: memfd_create(&(0x7f0000000040)='iocharset', 0x2) syz_mount_image$vfat(&(0x7f0000000300)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0xe004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x0, &(0x7f0000000340)=ANY=[]) r0 = socket$inet6(0xa, 0x0, 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) accept4(0xffffffffffffff9c, &(0x7f0000000140)=@rc, &(0x7f0000000040)=0x80, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind(0xffffffffffffffff, &(0x7f00000003c0)=@xdp={0x2c, 0x0, 0x0, 0x3d}, 0x80) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) gettid() ioctl$LOOP_CTL_REMOVE(r2, 0x5421, 0x0) sendmsg(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000500)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000000880), 0x0, &(0x7f0000003b40)}, 0x0) sendmsg(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000900)="b6", 0x1}], 0x1, &(0x7f00000009c0)=[{0xa0, 0x1ff, 0x0, "434c94cf096ca2c6e3a8a6433ea1ccf960ad859f9cabeb13bbcd113f89069f10afdedfc1c2c2a6455dc4d1cc5b8c42e105db6d89e5394ec484d7db74d839a1021c616111655c01f0d6840a2cc4a77a0a2613073b0d1e9ab634a70c9cafd212450fe14e5e32b6ee05d11e22515b1b820c7425d601c3c41b459046978582375e37f0268020620ba8c96a1cf8de5399"}], 0xa0, 0x4040000}, 0x4000040) r3 = openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x100, 0x0) sendto$unix(r3, &(0x7f0000000100)="9b0f3bc6445750cd60df6190fbc894ab56871030fc490859", 0x18, 0x4844, &(0x7f0000000700)=@file={0x1, './file0/file0/file0\x00'}, 0x6e) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) fchdir(r1) open$dir(&(0x7f0000000240)='./file0\x00', 0x80440, 0x0) truncate(&(0x7f0000000280)='./file0\x00', 0x100007) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) [ 582.467608] attempt to access beyond end of device [ 582.473914] loop1: rw=1, want=130, limit=112 [ 582.481976] buffer_io_error: 30 callbacks suppressed [ 582.481986] Buffer I/O error on dev loop1, logical block 129, lost async page write [ 582.497523] attempt to access beyond end of device [ 582.511815] loop1: rw=1, want=131, limit=112 06:08:23 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000040)={&(0x7f0000000180)={0x10, 0x40030000000000, 0x0, 0xfffffffffffffffc}, 0xc, &(0x7f0000000100)={&(0x7f0000000340)=ANY=[@ANYBLOB="1c000000340019010000006f2953ed5ffdbaf908060ea8d594bb1dc50a4f5979ac41c5ee5c2005863eabafbbb6c8918c00ce232de53f78a96e3a5f90edbd8088b6045c09e058c62026ccdcf6db7b61f3cfef48c0bcc9ca580500000000000000b893123f89dedb03442000000000000000000000b30162e518b99e3d3ba4e5155d7f1cdf3910320b662267507a672101321d590383032914d31231bbf7e836b29b9fb93c96ee1e0ac3b491fd5bc0e5f7a23a21e1e1cd00af151a06c654934d0b46c334b65ee9baa56f73863506b7fa08b1ee7a1ce6d9da7ea8640b38b70a710196d3b3327e246d2f68c10e17b6f1ec5ddb466b49fde89f1f52788c36f3372e415bd832b41e979da4bbaf2feb969a8b0367f0559b3ba58a0f7c4133a8a54a813fcd425e6f872c2bc6590c5b3564f8edb933d16ac8858d5c786ed5ca576041dbbbb98ae298e87e32429e8fdd8e42a4261ede299a17f7426fe088cc03d8ddb9cb9d3ed3ce8263416e6ae254098fe70d92753a3fbb8814", @ANYPTR64], 0x2}}, 0x0) [ 582.522253] Buffer I/O error on dev loop1, logical block 130, lost async page write [ 582.528388] ------------[ cut here ]------------ [ 582.534893] ODEBUG: free active (active state 1) object type: rcu_head hint: (null) [ 582.543907] WARNING: CPU: 1 PID: 5702 at lib/debugobjects.c:329 debug_print_object+0x16a/0x210 [ 582.552663] Kernel panic - not syncing: panic_on_warn set ... [ 582.558558] CPU: 1 PID: 5702 Comm: kworker/1:2 Not tainted 4.19.0-rc8-next-20181016+ #95 [ 582.566786] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 582.575333] attempt to access beyond end of device [ 582.576159] Workqueue: (null) (events) [ 582.585911] Call Trace: [ 582.588004] loop1: rw=1, want=132, limit=112 [ 582.588521] dump_stack+0x244/0x39d [ 582.596557] ? dump_stack_print_info.cold.1+0x20/0x20 [ 582.601766] panic+0x2ad/0x55c [ 582.602890] Buffer I/O error on dev loop1, logical block 131, lost async page write [ 582.604961] ? add_taint.cold.5+0x16/0x16 [ 582.604980] ? __warn.cold.8+0x5/0x45 [ 582.604992] ? __warn+0xe8/0x1d0 [ 582.605008] ? debug_print_object+0x16a/0x210 [ 582.605027] __warn.cold.8+0x20/0x45 [ 582.624620] kobject: 'loop3' (00000000afc34a57): kobject_uevent_env [ 582.628584] ? debug_print_object+0x16a/0x210 [ 582.632302] kobject: 'loop3' (00000000afc34a57): fill_kobj_path: path = '/devices/virtual/block/loop3' [ 582.638688] report_bug+0x254/0x2d0 [ 582.638776] do_error_trap+0x11b/0x200 [ 582.638794] do_invalid_op+0x36/0x40 [ 582.649241] attempt to access beyond end of device [ 582.652734] ? debug_print_object+0x16a/0x210 [ 582.673342] invalid_op+0x14/0x20 [ 582.676805] RIP: 0010:debug_print_object+0x16a/0x210 [ 582.681911] Code: 40 88 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 92 00 00 00 48 8b 14 dd 80 fc 40 88 4c 89 fe 48 c7 c7 20 f2 40 88 e8 96 25 b5 fd <0f> 0b 83 05 79 6a 60 06 01 48 83 c4 18 5b 41 5c 41 5d 41 5e 41 5f [ 582.700817] RSP: 0018:ffff88018c42f460 EFLAGS: 00010082 [ 582.706181] RAX: 0000000000000000 RBX: 0000000000000003 RCX: 0000000000000000 [ 582.713449] RDX: 0000000000000000 RSI: ffffffff81647515 RDI: 0000000000000005 [ 582.720738] RBP: ffff88018c42f4a0 R08: ffff88018c4223c0 R09: fffffbfff1271fec [ 582.728016] R10: fffffbfff1271fec R11: ffffffff8938ff63 R12: 0000000000000001 [ 582.735302] R13: ffffffff8939a4e0 R14: 0000000000000000 R15: ffffffff8840f6c0 [ 582.742593] ? vprintk_func+0x85/0x181 [ 582.746505] debug_check_no_obj_freed+0x3ae/0x58d [ 582.751359] ? debug_object_activate+0x600/0x600 [ 582.756117] ? check_preemption_disabled+0x48/0x280 [ 582.761146] kmem_cache_free+0x202/0x290 [ 582.765209] free_task+0x16e/0x1f0 [ 582.768769] ? arch_release_task_struct+0x10/0x10 [ 582.773616] ? atomic_notifier_call_chain+0xed/0x190 [ 582.778727] __put_task_struct+0x2e6/0x620 [ 582.782965] ? free_task+0x1f0/0x1f0 [ 582.786715] ? free_unref_page+0x960/0x960 [ 582.790976] finish_task_switch+0x66b/0x920 [ 582.795299] ? __switch_to_asm+0x40/0x70 [ 582.799364] ? preempt_notifier_register+0x200/0x200 [ 582.804465] ? __switch_to_asm+0x34/0x70 [ 582.808539] ? __switch_to_asm+0x34/0x70 [ 582.812597] ? __switch_to_asm+0x40/0x70 [ 582.816659] ? __switch_to_asm+0x34/0x70 [ 582.820718] ? __switch_to_asm+0x40/0x70 [ 582.824777] ? __switch_to_asm+0x34/0x70 [ 582.828836] ? __switch_to_asm+0x40/0x70 [ 582.832900] ? __switch_to_asm+0x34/0x70 [ 582.836969] ? __switch_to_asm+0x34/0x70 [ 582.841044] ? __switch_to_asm+0x40/0x70 [ 582.845105] ? __switch_to_asm+0x34/0x70 [ 582.849167] ? __switch_to_asm+0x40/0x70 [ 582.853229] ? __switch_to_asm+0x34/0x70 [ 582.857291] ? __switch_to_asm+0x40/0x70 [ 582.861597] __schedule+0x8d7/0x21d0 [ 582.865322] ? __sched_text_start+0x8/0x8 [ 582.869470] ? trace_hardirqs_on_caller+0x310/0x310 [ 582.874507] ? zap_class+0x640/0x640 [ 582.878230] ? lockdep_hardirqs_on+0x3bb/0x5b0 [ 582.882829] schedule+0xfe/0x460 [ 582.886203] ? __schedule+0x21d0/0x21d0 [ 582.890182] ? lockdep_hardirqs_on+0x3bb/0x5b0 [ 582.894768] ? trace_hardirqs_on+0xbd/0x310 [ 582.899089] ? kasan_check_read+0x11/0x20 [ 582.903247] ? worker_thread+0x3ca/0x1390 [ 582.907403] ? trace_hardirqs_off_caller+0x300/0x300 [ 582.912530] worker_thread+0x3cf/0x1390 [ 582.916521] ? __switch_to_asm+0x34/0x70 [ 582.920609] ? process_one_work+0x1c40/0x1c40 [ 582.925115] ? zap_class+0x640/0x640 [ 582.928825] ? find_held_lock+0x36/0x1c0 [ 582.932897] ? __kthread_parkme+0xce/0x1a0 [ 582.937138] ? _raw_spin_unlock_irqrestore+0x82/0xd0 [ 582.942254] ? _raw_spin_unlock_irqrestore+0x82/0xd0 [ 582.947369] ? lockdep_hardirqs_on+0x3bb/0x5b0 [ 582.951959] ? trace_hardirqs_on+0xbd/0x310 [ 582.956284] ? kasan_check_read+0x11/0x20 [ 582.960435] ? __kthread_parkme+0xce/0x1a0 [ 582.964671] ? trace_hardirqs_off_caller+0x300/0x300 [ 582.969779] ? trace_hardirqs_off_caller+0x300/0x300 [ 582.974887] ? _raw_spin_unlock_irqrestore+0x6d/0xd0 [ 582.979994] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 582.985534] ? __kthread_parkme+0xfb/0x1a0 [ 582.989772] ? process_one_work+0x1c40/0x1c40 [ 582.994265] kthread+0x35a/0x440 [ 582.997632] ? kthread_stop+0x8f0/0x8f0 [ 583.001610] ret_from_fork+0x3a/0x50 [ 583.005330] [ 583.005337] ====================================================== [ 583.005342] WARNING: possible circular locking dependency detected [ 583.005347] 4.19.0-rc8-next-20181016+ #95 Not tainted [ 583.005353] ------------------------------------------------------ [ 583.005358] kworker/1:2/5702 is trying to acquire lock: [ 583.005361] 00000000b382830b ((console_sem).lock){-.-.}, at: down_trylock+0x13/0x70 [ 583.005377] [ 583.005381] but task is already holding lock: [ 583.005384] 00000000d40cb653 (&obj_hash[i].lock){-.-.}, at: debug_check_no_obj_freed+0x17a/0x58d [ 583.005400] [ 583.005404] which lock already depends on the new lock. [ 583.005407] [ 583.005410] [ 583.005415] the existing dependency chain (in reverse order) is: [ 583.005417] [ 583.005420] -> #3 (&obj_hash[i].lock){-.-.}: [ 583.005435] _raw_spin_lock_irqsave+0x99/0xd0 [ 583.005439] __debug_object_init+0x127/0x1290 [ 583.005443] debug_object_init+0x16/0x20 [ 583.005447] hrtimer_init+0x97/0x490 [ 583.005451] init_dl_task_timer+0x1b/0x50 [ 583.005455] __sched_fork+0x2ae/0x590 [ 583.005459] init_idle+0x75/0x740 [ 583.005463] sched_init+0xb33/0xc02 [ 583.005467] start_kernel+0x4be/0xa2b [ 583.005472] x86_64_start_reservations+0x2e/0x30 [ 583.005476] x86_64_start_kernel+0x76/0x79 [ 583.005480] secondary_startup_64+0xa4/0xb0 [ 583.005491] [ 583.005495] -> #2 (&rq->lock){-.-.}: [ 583.005509] _raw_spin_lock+0x2d/0x40 [ 583.005513] task_fork_fair+0xb0/0x6d0 [ 583.005517] sched_fork+0x443/0xba0 [ 583.005521] copy_process+0x2585/0x8770 [ 583.005525] _do_fork+0x1cb/0x11c0 [ 583.005529] kernel_thread+0x34/0x40 [ 583.005533] rest_init+0x28/0x372 [ 583.005537] arch_call_rest_init+0xe/0x1b [ 583.005541] start_kernel+0x9f0/0xa2b [ 583.005547] x86_64_start_reservations+0x2e/0x30 [ 583.005551] x86_64_start_kernel+0x76/0x79 [ 583.005556] secondary_startup_64+0xa4/0xb0 [ 583.005558] [ 583.005560] -> #1 (&p->pi_lock){-.-.}: [ 583.005576] _raw_spin_lock_irqsave+0x99/0xd0 [ 583.005580] try_to_wake_up+0xd2/0x12e0 [ 583.005584] wake_up_process+0x10/0x20 [ 583.005588] __up.isra.1+0x1c0/0x2a0 [ 583.005591] up+0x13c/0x1c0 [ 583.005596] __up_console_sem+0xbe/0x1b0 [ 583.005600] console_unlock+0x80c/0x1190 [ 583.005604] vprintk_emit+0x391/0x990 [ 583.005608] vprintk_default+0x28/0x30 [ 583.005612] vprintk_func+0x7e/0x181 [ 583.005615] printk+0xa7/0xcf [ 583.005619] do_exit.cold.18+0x57/0x16f [ 583.005624] do_group_exit+0x177/0x440 [ 583.005628] __x64_sys_exit_group+0x3e/0x50 [ 583.005632] do_syscall_64+0x1b9/0x820 [ 583.005637] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 583.005639] [ 583.005642] -> #0 ((console_sem).lock){-.-.}: [ 583.005657] lock_acquire+0x1ed/0x520 [ 583.005661] _raw_spin_lock_irqsave+0x99/0xd0 [ 583.005665] down_trylock+0x13/0x70 [ 583.005670] __down_trylock_console_sem+0xae/0x1f0 [ 583.005674] console_trylock+0x15/0xa0 [ 583.005678] vprintk_emit+0x372/0x990 [ 583.005682] vprintk_default+0x28/0x30 [ 583.005686] vprintk_func+0x7e/0x181 [ 583.005689] printk+0xa7/0xcf [ 583.005693] __warn_printk+0x8c/0xe0 [ 583.005698] debug_print_object+0x16a/0x210 [ 583.005702] debug_check_no_obj_freed+0x3ae/0x58d [ 583.005707] kmem_cache_free+0x202/0x290 [ 583.005710] free_task+0x16e/0x1f0 [ 583.005715] __put_task_struct+0x2e6/0x620 [ 583.005719] finish_task_switch+0x66b/0x920 [ 583.005723] __schedule+0x8d7/0x21d0 [ 583.005727] schedule+0xfe/0x460 [ 583.005731] worker_thread+0x3cf/0x1390 [ 583.005735] kthread+0x35a/0x440 [ 583.005739] ret_from_fork+0x3a/0x50 [ 583.005741] [ 583.005746] other info that might help us debug this: [ 583.005748] [ 583.005751] Chain exists of: [ 583.005754] (console_sem).lock --> &rq->lock --> &obj_hash[i].lock [ 583.005773] [ 583.005777] Possible unsafe locking scenario: [ 583.005780] [ 583.005784] CPU0 CPU1 [ 583.005788] ---- ---- [ 583.005791] lock(&obj_hash[i].lock); [ 583.005800] lock(&rq->lock); [ 583.005810] lock(&obj_hash[i].lock); [ 583.005819] lock((console_sem).lock); [ 583.005827] [ 583.005831] *** DEADLOCK *** [ 583.005833] [ 583.005837] 1 lock held by kworker/1:2/5702: [ 583.005840] #0: 00000000d40cb653 (&obj_hash[i].lock){-.-.}, at: debug_check_no_obj_freed+0x17a/0x58d [ 583.005858] [ 583.005862] stack backtrace: [ 583.005868] CPU: 1 PID: 5702 Comm: kworker/1:2 Not tainted 4.19.0-rc8-next-20181016+ #95 [ 583.005875] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 583.005879] Workqueue: (null) (events) [ 583.005888] Call Trace: [ 583.005892] dump_stack+0x244/0x39d [ 583.005896] ? dump_stack_print_info.cold.1+0x20/0x20 [ 583.005900] ? vprintk_func+0x85/0x181 [ 583.005905] print_circular_bug.isra.35.cold.54+0x1bd/0x27d [ 583.005909] ? save_trace+0xe0/0x290 [ 583.005914] __lock_acquire+0x3399/0x4c20 [ 583.005918] ? mark_held_locks+0x130/0x130 [ 583.005922] ? mark_held_locks+0x130/0x130 [ 583.005926] ? debug_smp_processor_id+0x1c/0x20 [ 583.005931] ? perf_trace_lock_acquire+0x15b/0x800 [ 583.005935] ? zap_class+0x640/0x640 [ 583.005940] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 583.005944] ? debug_smp_processor_id+0x1c/0x20 [ 583.005949] ? perf_trace_lock_acquire+0x15b/0x800 [ 583.005954] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 583.005958] ? print_usage_bug+0xc0/0xc0 [ 583.005963] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 583.005967] lock_acquire+0x1ed/0x520 [ 583.005971] ? down_trylock+0x13/0x70 [ 583.005975] ? lock_release+0xa10/0xa10 [ 583.005979] ? trace_hardirqs_off+0xb8/0x310 [ 583.005983] ? vprintk_emit+0x1de/0x990 [ 583.005988] ? trace_hardirqs_on+0x310/0x310 [ 583.005992] ? trace_hardirqs_off+0xb8/0x310 [ 583.005996] ? log_store+0x344/0x4c0 [ 583.006000] ? vprintk_emit+0x372/0x990 [ 583.006004] _raw_spin_lock_irqsave+0x99/0xd0 [ 583.006008] ? down_trylock+0x13/0x70 [ 583.006012] down_trylock+0x13/0x70 [ 583.006017] __down_trylock_console_sem+0xae/0x1f0 [ 583.006021] console_trylock+0x15/0xa0 [ 583.006025] vprintk_emit+0x372/0x990 [ 583.006029] ? wake_up_klogd+0x180/0x180 [ 583.006033] ? debug_smp_processor_id+0x1c/0x20 [ 583.006044] ? perf_trace_lock_acquire+0x15b/0x800 [ 583.006048] ? unwind_next_frame.part.7+0x1ae/0x9e0 [ 583.006052] ? find_held_lock+0x36/0x1c0 [ 583.006056] ? zap_class+0x640/0x640 [ 583.006060] vprintk_default+0x28/0x30 [ 583.006064] vprintk_func+0x7e/0x181 [ 583.006068] printk+0xa7/0xcf [ 583.006072] ? kmsg_dump_rewind_nolock+0xe4/0xe4 [ 583.006076] ? lock_acquire+0x1ed/0x520 [ 583.006080] ? __warn_printk+0x80/0xe0 [ 583.006084] __warn_printk+0x8c/0xe0 [ 583.006088] ? test_taint+0x20/0x20 [ 583.006097] ? kasan_check_read+0x11/0x20 [ 583.006102] ? do_raw_spin_lock+0x14f/0x350 [ 583.006106] ? kasan_check_read+0x11/0x20 [ 583.006110] ? rwlock_bug.part.2+0x90/0x90 [ 583.006114] debug_print_object+0x16a/0x210 [ 583.006119] debug_check_no_obj_freed+0x3ae/0x58d [ 583.006123] ? debug_object_activate+0x600/0x600 [ 583.006128] ? check_preemption_disabled+0x48/0x280 [ 583.006132] kmem_cache_free+0x202/0x290 [ 583.006136] free_task+0x16e/0x1f0 [ 583.006141] ? arch_release_task_struct+0x10/0x10 [ 583.006145] ? atomic_notifier_call_chain+0xed/0x190 [ 583.006149] __put_task_struct+0x2e6/0x620 [ 583.006153] ? free_task+0x1f0/0x1f0 [ 583.006158] ? free_unref_page+0x960/0x960 [ 583.006162] finish_task_switch+0x66b/0x920 [ 583.006166] ? __switch_to_asm+0x40/0x70 [ 583.006171] ? preempt_notifier_register+0x200/0x200 [ 583.006175] ? __switch_to_asm+0x34/0x70 [ 583.006179] ? __switch_to_asm+0x34/0x70 [ 583.006183] ? __switch_to_asm+0x40/0x70 [ 583.006187] ? __switch_to_asm+0x34/0x70 [ 583.006191] ? __switch_to_asm+0x40/0x70 [ 583.006195] ? __switch_to_asm+0x34/0x70 [ 583.006199] ? __switch_to_asm+0x40/0x70 [ 583.006203] ? __switch_to_asm+0x34/0x70 [ 583.006207] ? __switch_to_asm+0x34/0x70 [ 583.006212] ? __switch_to_asm+0x40/0x70 [ 583.006216] ? __switch_to_asm+0x34/0x70 [ 583.006220] ? __switch_to_asm+0x40/0x70 [ 583.006224] ? __switch_to_asm+0x34/0x70 [ 583.006228] ? __switch_to_asm+0x40/0x70 [ 583.006232] __schedule+0x8d7/0x21d0 [ 583.006236] ? __sched_text_start+0x8/0x8 [ 583.006241] ? trace_hardirqs_on_caller+0x310/0x310 [ 583.006245] ? zap_class+0x640/0x640 [ 583.006249] ? lockdep_hardirqs_on+0x3bb/0x5b0 [ 583.006253] schedule+0xfe/0x460 [ 583.006257] ? __schedule+0x21d0/0x21d0 [ 583.006261] ? lockdep_hardirqs_on+0x3bb/0x5b0 [ 583.006265] ? trace_hardirqs_on+0xbd/0x310 [ 583.006270] ? kasan_check_read+0x11/0x20 [ 583.006274] ? worker_thread+0x3ca/0x1390 [ 583.006279] ? trace_hardirqs_off_caller+0x300/0x300 [ 583.006283] worker_thread+0x3cf/0x1390 [ 583.006287] ? __switch_to_asm+0x34/0x70 [ 583.006291] ? process_one_work+0x1c40/0x1c40 [ 583.006295] ? zap_class+0x640/0x640 [ 583.006299] ? find_held_lock+0x36/0x1c0 [ 583.006303] ? __kthread_parkme+0xce/0x1a0 [ 583.006308] ? _raw_spin_unlock_irqrestore+0x82/0xd0 [ 583.006313] ? _raw_spin_unlock_irqrestore+0x82/0xd0 [ 583.006317] ? lockdep_hardirqs_on+0x3bb/0x5b0 [ 583.006321] ? trace_hardirqs_on+0xbd/0x310 [ 583.006326] ? kasan_check_read+0x11/0x20 [ 583.006330] ? __kthread_parkme+0xce/0x1a0 [ 583.006335] ? trace_hardirqs_off_caller+0x300/0x300 [ 583.006339] ? trace_hardirqs_off_caller+0x300/0x300 [ 583.006344] ? _raw_spin_unlock_irqrestore+0x6d/0xd0 [ 583.006349] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 583.006353] ? __kthread_parkme+0xfb/0x1a0 [ 583.006358] ? process_one_work+0x1c40/0x1c40 [ 583.006361] kthread+0x35a/0x440 [ 583.006365] ? kthread_stop+0x8f0/0x8f0 [ 583.006369] ret_from_fork+0x3a/0x50 [ 583.007374] Kernel Offset: disabled [ 583.956402] Rebooting in 86400 seconds..