d3b17aeda82a6c8db3d3895a27294b91df9a262aaf703f9e262657c597d8110eb8a92b4d9bc94c24ba030e1683bf6e010553f746f24fc78cd8d60b017982d7604194190b13e06ee513cf8dd47080bf4df1820c03c2d8a0c345bfb17f8014991516f56eb9377b055c7879afeb7735296b4af91a207dfc88c4ced1834da060e5e6772328032abcdef1697fe5790a007258ff6380245f5d99ffdbd84f63cd8ef8bdaf052de3227fbe0dcae1a508db3d64c1d744b9b48caac3f6e1d9f63db3a5f7ab04a0e682ab19a82d4e50795ccbd47d03cf1466be111eec35602d225257a38167082df1ce0f9c40efc6f0b5917d26febdb154c48590435e7d380089b6e85a0772fd2a20b7ab75745c8c0eb39456ba06f1136431cca536e88abe338032fb9b43c235bd93a3d6f37bb0d6a752b37cf32a7965634e1957490d1d4bdf66194a472ac9d98fec9b58246081ca4294d852b3a937895dadd15c3513f1f078da4cc01c89cef4161513e8b5e545b59fb0717768a0fc5d61ab520d75888d99e5f84eebf6158890b0fc98bac085b588449c79faf205d1c5be5d4289ae4871f6541e6bcc05a25ffe05bbc3597c636ecd92f2a34d286c8958dada14e143350fc75ac4e3c07e96bc661cc97e86d4849540fdddbd3993a4bc35ac42d9d7da79915e2e0e0c9ab9c2ec3ab2cb72db48991587ed47289825dc13dab3f003b9d7a545b056d1917460ded69722f2ada0ec666e018d762224a92d8ef84e620cc45ed84c4334a87224974f52b438c68929dd1524744c3f848e9eb722b03ce7f3c65a0b1f2b20cf484673edf383fe2eca3998d1b17732ba8e5f4723e4958a6509e8f868a23267bfaf03c38d8cf8f43b45fbb8c2d7d589d301661bae69592a40b48418440b6c0d555849887759a588af471b59aa4280a80c8c0e49f72aec8807fed8824d6e8b834615fcc2625775eec97122e8835c4184289efc8b4393e1fa197e9c0a4fb92e8f1282c7e63d838ec784118fe6afad7977363c18f9e9e1b5703d477b1fa94376d44b7e1e2f8a1bef6dbf6d86a6cbe30133a7080d1d02c24fbae72ac0754864edc74104a790d38b290897227367d57037656facded922b61b50e77f4874e34847f7cb29d82c44323fded10d266c8c169ccc81745691ab0e771af6e7a816028541969e87381005bf50a1fae7801739d20fe0b23c7f45219f485873cf1d981619b200e9a2e856ba211ec642108f5d54e4b0e5fc16690ab490f12ab0d07ce433810b55ccce9cb9edd416fcce27b7ffc92ab2cec0d24b7401dcbce39206802876f621f6c146c33913d0aad9135013390407a1106b98c9a609ebb513b015b646ea83d51bc0f8ab764a47ba071df23471400548eef089eb68d28ae52a1991871874499371b622323e827a92a208f80800c52188034e367023f14fca3ca0391bcf18c2372f9f631daf6cf0d80b8e40a723e41607e06a9e2d141a3c55f32d7875a877accafc49302b759598c2d4df7e53dd1a344615b4f4cd7cd889de72b8b8d7a00dda349ac92c2e198dd5b1428dc220312b8a7298cf26bd1433d06350b5a4cf356cea38d172369d5e1bc8c23af624bb740617a738231e4c05e5b27f70c3066f57a99829696820ada86d78d9b7b3eabd9218a7cd4aea5b6d43dc9e10fef09471c31ef45b72170756297785caebaddbaf61d9fe28ec85108df71db95b1fd2fc587beb367f50cf6f6c472302efe069bbce791eb01db81d270459dfa361fabba21a788cac02ae474a0262b28813946134fb316af4e1affdc47c39596f02aa90e17a456f50b4de194b08d28b673e83bdd3219f2b5a466fbe8bfe51435efae17a1a4af6dd12951a6332745a9798f3ea04bd6f2555f113f138622a05574b09001c5a8dfd2081188193d3244788b7e78dd04f5fa3830f1ddba2d63930ebcd90a87d4e4768961951b39d66c7909f5cd90a83391ca4a5945f987e511fc0042729b9ba4ea99ecc4e0f6261fb3a90381591508de972eb7e3654baedbec258a6e483c0af5c00c0176a4e5bd2126b63033d401bd670bbab951ee51dbe864c87c8bfee4ebabb63b58b9bff128f6d6748183c7f9d206259ad60ac2c7b67287a20e8142da0c0d69001fa2a15da76b9d0e23de6a0301273a1e3a33f7ad37082be143f7f6bb5aaf16d62278cfbb2e6c10d900a0438260ab41a7e5d00611076e2f112ce408aeea9641a1c23007617586a023898fd5608e3ae8b8afc25f185945e9b56e58cc31d7b9bc5d36ef962da137a90ac8ff9fd11f8245b532eb89456c80407259752f487c6fc1e7875ca2ebd4eb085a621b3c91ee914722b8eae09cc51ca8ad1ccf54ff68308d194416090a8c8a9c6b558c70bf9280e1bb3d31263c4672f78032a06884a09659970c5b2d12dd70bd8502e68271192df9d3c5a89f30d828f269f43769df5b095b62895cde067445bd468408afad473762f69cd22c42220db635cfa87ad42a38fc9f3458a0584ac14c0d799b1dbe18b7e78b8b9b7650025e40dbd805ed590c48436b0d7feb181dad6bc359a0a6b19814a633750406970c374b81b4955141b22633005b4cc61308fd32a2415be20e4aa77ed28cc30b8933e5cc3d1ebfae811aafe2718370ec438cfa6b15ddf0911344266cd30d8509960ae9fa3fa1b92a49df36269caa3d386ada1d0d6929cc5e6a25ae88b39d2cc29ed493d11c8f51ca54329241b5f3e13b87cfed625127ac0df54b3e22e37856561d90af2af2e0061d72843b60b3c44eb93f7978b6700cb0194688969091c8fd39e8404003cb41dcf00a45fda483345ac4d90744a1fc5fc2c71212edd4a6bccf5566eb8641bd89f6a44b5231d04fbb7dc85262d5b7bab628bd82b3c167b3839aa34e3437e7d77bc1d827b4d8c4e8012f8134712914700fac06abc11803fdbcfcd0c6018275e74e5885925c4f50feed35f62e8de3accd057c8f2447d7c1090a1d147d858f9f41238435ef1cb4a79e742e21b3f5d0f4ef1c89c2b0a854cd1da47b1d244cb8dbaf0dd4abecc35bfd8f4bdc4038031ac2fadfe53b8af521de0c6db14e3fd8092e3a4d317b4801674f4be3a58d372574b75aac65b2588f1b4bf07753fa95ccb9a3d0a9f3dde4af079c58d20f84f8553abaf3f17fd83cf4caf0929e4d9326bfbaeb10e53bf995b5497d18ed6ae80ed4489b66e77e6ede9c8d205c6d15f68af5aff2becbb3c23042a00718bcc6d9e2f087f1974af9b636cc33ed0e80e2ba0fc55956e95a1fad5d190c59740fb1ad80bff1bce9bdfe32f254adac8991a0605a5d649309a7788c62b51d7a8d599b02450bbec9f9f0fe06ccc9bf45ecd01977183b43187c757f50ba5d4477f561ab765e3fd29d19dc41424ea7033f323aeb7e241135acccf50ae3cff9ecbfdb9c90943bd1b87c3550b3854300698e739451734c6f4e9c76903127edb02821395934c4573d0bab70953040c5ef8039dc0eef2ec01df1b2d6195be7cc08728dcf606497879038ce81c03b07220b1bdba9dddba68ee14f795bac1bc9b8731b669acfd7b86e43cd2314dc44a61f443efd1b44b009bda1a5652bb8b2d3a171dd43143da99cc5775701196ad8a90d6f6584806f13e36a911b79d19d686c3a712ce6b25c3a2134887cc96299746536f3a99e2171489aedc1c3bdfec6ad0978eff930e1e35579689fff60f2cb6f8a9e5089c3375caf01edcb4d7c52f0954958fe9a0f016a996cd9edf2fecfa53302047bc4f7fb9005faaa9526a919dbb569f6276bec4062bb20f04d26a6bb79fbb5a4e8fce97bd76d5695be469fca8ed545e29250687ba88a8001301c1ba1f21f556fc571312c576db14ae6dd4ccff4ca1f5c79971eae0b2fa2239111e1ce5fdc0b8f20d58f324a7d88e4406ce7db556c27ca7d08ab26861e13a9a8a34a5941e8a6beda5127d44c1e17917772077046588ca8869489e1c0d1e72e31590011906a0b63bdbccdbb67373e687e1b28aa0d48bc58150bbd568ff30c39a54b0f6b5176a4610561bf85fff060e1ee738caf9d930a1b8071c28b8c5a566e355d2aa57c348ca50610559df6d9e06f1891bd2ba68da0cd3f57a280fd3592f275bde4c74ca7cb168beba88fe324a9313344dc59ee52911b10d53807ad3e85b99b511066170ea7bea4d3f47ee1c3167d54e02f4e34055d6ac263894317d9b26253874090c994a20ea2d83d389520a2bc454998912143d9b2b33d6793d7cdccf01c83f629113718c660b8c9589a8a53b3593dded6d942ac047ce0b02cc2deb95a9cbca2378fdbaf28340c7b3f78fa6a83f8441ada8a68d556e6fb8b80081075549c23e29ca1861d7c28c07198d0ee920520e42f196c783713d64a8b2e1fffbecea14d9ce9e6146ac774f0b59b323681ed881ea7bc871a2e177d6cfc8f5cb85ea4ae118769f344b24e5a7d8c063c9517f8149b88e25750d5fd824a249246929f58c619ab28034f9a0f32c3d71193e1a0230eef8f822fb9e13d42729e04c9055831adfda676cd548985c5aef6aa50472b477d594fd614208697b7d4b4d7d45b2bb57cb5d3fabebfa4adf4859ae5f318c77eafd0da312512eca0a9b1daa8d202fa90af43183dc423475577ab39f898d1786117c69cd1df7a2e3f314df92c14ba7aa1d900f957d28ee79400655c8899197377a13c86300dd4bd42799c8824caf8fb9ba014e60cfae0d79bc71827e2eeba5b5c31e9f2d767c0e39713466f7dc77212231702b38ef6770758e8667cd6aca8e3fe3b8828f2550ddfe8d01f163cb946e02a91d278e8a42dd80869a44048ad7349d616b682cec180ec38e3e35f4dd724c4495214ac194d63b492ba50058cca85fb1e73efc4b970c0a8af1bf01a67059f1a456f1e5ae0f9d31ae69e02f79ef529e647a439ad4409d76f09f6873a8305a7b661a4a7fecc0ba0c68da70c72aab1b4ca43473ae079875e8ce3059606971b850b3d3b949726d8f129778c5140bdcd7c332ed48b9c0690563f572bb0b2e6361e8b13b3272cb4df8639d21326cbdaef2a38cf81084e2d5c2ff9a9f78aa873614b7bc7fee1cc50c4afe35f1ab6d51e446cb440e438a6074fd4938ad92fabffb0baab78df2813030f8087434fdd9f09071b266b61f5d88cd1a27c833899923eb465037fbaddc0b7cd053613f44b5f8e3624cad86fabad03507a83be04f425485923c8e5f9f9532454dffd14f8557c2f3b6929e52d812e199184768add467f258c89549d6b10d8aacdda881c9fd08b4c9d878da26416dae2fa27eb97529b91545653ce95592ca3a188bb26ca86838e76191d9fcbfc2d89561de19e49d7cc9fb83d500c905df262e4c9216dbfa7dca89a78bba81a2cca17c6dfba2e6cea2a5609c326ade12b7b01695a19db0506225b022e6166086c03fe41d5661df0a7c7fd9f351be0b58555020dec01dded2f916f9b8c29ca2b97d813f263b04f8c11f45ea8203ffd6383fc766b2b962a0a35122744d1281cc23e7cfaf27e3ec0b8914909b3c482bcff6b5b4daa1ab8367de994212b5727dca4bb410dce8c8b47afaf7d70298631bf6aed55b7a7e328154bd72cd71303b47ffacfebd1bae43876105b67d243a24e8d40e7e010259099dc5ff0591c2bce6f888f2593022eb8adc3583bb50c45927db11e75dcff7e0fd230543c93e43ec89f2ae44bdcfa652175f40aaee6d0659ade67f2e0a846d6b9d1745999dd59693e396e807f21abd2a571d188afc143ad3a92", 0x1000, 0x80000000}, {&(0x7f0000000300)="cd6ee2c84b33a96d521ad9bf0b41ca22d28d40a561a9e5c30baf6bd009e29bf4c5fd1972af53ff5f27ef66ce8a6b79e5e28435288b21976606bf2effece48c28dcdd51b22b24536dd1ef1f0307c16aee55bbe8f85d635c3ccfe96b30d978b710d3df5c24f9defd523e08ba88aada14622d0792078377d3efdb868891d17d70ea6265849bb5953b72a4a3935c077b76b3ee7b832b87ceae2c5f22e2efe03b6b7cc6", 0xa1, 0xffffffffffff8001}, {&(0x7f00000003c0)="6ce2c70d1c14f88297d190d1ef426ce64bd033eec0b7a49b44436a5c5621ca23df4ff89291344962dc3d62908523de9f004f441f89ec5f2a160ccfc4c394740ec2d85b305c519f1802e5f292d6d99058cb79ad2d8d70593b0de134c735642e1369a5388692f469ff361e9f013fc67fbe7a48c66895a9551bb7be7e49b0bf3839c1edeb80e4cb929cd2b0ff6090bc19514a98acd9388cbe2ccfa146cab292d0d7f5dfa612f81206345b7651d134984df0895e209c70f47716ea27bfca64a9d3e7", 0xc0, 0x2}, {0xfffffffffffffffc, 0x0, 0x4}], 0x0, &(0x7f0000000500)={[{}, {'&'}, {'mountinfo\x00'}, {'}'}, {'}V\xbb/(/\'\\\'%@$\xf7\',%'}, {'cgroup.controllers\x00'}, {'/proc/self\x00'}, {'cgroup.controllers\x00'}, {'#'}], [{@seclabel}, {@obj_role={'obj_role', 0x3d, '^((@)(-+*$'}}]}) openat$pidfd(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) recvmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000004c80)={0x77359400}) setresgid(0x0, 0x0, 0x0) r6 = syz_open_dev$tty1(0xc, 0x4, 0x1) r7 = syz_open_procfs(0x0, &(0x7f0000000240)='mountinfo\x00') sendfile(r6, r7, 0x0, 0x800000080004103) ioctl$FS_IOC_SETFLAGS(r7, 0x40086602, &(0x7f00000000c0)=0x200) r8 = socket$nl_xfrm(0x10, 0x3, 0x6) sendfile(r8, r1, 0x0, 0x100000002) 05:05:36 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020004002dbf4655fdbf4655f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:05:36 executing program 2: r0 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ftruncate(0xffffffffffffffff, 0x0) lseek(r0, 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000040)) getpgid(0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat2(0xffffffffffffffff, &(0x7f00000001c0)='./bus\x00', 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000100)={'syztnl0\x00', 0x0}) r1 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r1, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5, 0x8}, 0x0, 0x0, 0x9, 0x7, 0x7fffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f0000062c40)={0x8000000000, [], 0x0, "00001000"}) r2 = creat(&(0x7f0000000140)='./bus\x00', 0x0) io_setup(0x1, &(0x7f0000000180)=0x0) io_submit(r3, 0x45, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000000000, 0x0, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) fallocate(r0, 0x3, 0x0, 0x100000fe) 05:05:36 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020009e02dbf4655fdbf4655f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) [ 2907.976460][ C0] sd 0:0:1:0: [sg0] tag#689 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2907.986814][ C0] sd 0:0:1:0: [sg0] tag#689 CDB: opcode=0xe5 (vendor) [ 2907.993582][ C0] sd 0:0:1:0: [sg0] tag#689 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2908.003102][ C0] sd 0:0:1:0: [sg0] tag#689 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2908.012762][ C0] sd 0:0:1:0: [sg0] tag#689 CDB[20]: ba 05:05:36 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f00000000000000020000000600000000000800008000002000a702dbf4655fdbf4655f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:05:36 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000003dbf4655fdbf4655f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:05:36 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f00000000000000020000000600000000000800008000002000c103dbf4655fdbf4655f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:05:36 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f00000000000000020000000600000000000800008000002000d403dbf4655fdbf4655f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:05:37 executing program 4: r0 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ftruncate(0xffffffffffffffff, 0x0) lseek(r0, 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000040)) getpgid(0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat2(0xffffffffffffffff, &(0x7f00000001c0)='./bus\x00', 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, 0x0) r1 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r1, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5, 0x8}, 0x0, 0x0, 0x9, 0x7, 0x7fffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f0000062c40)={0x8000000000, [], 0x0, "00001000"}) r2 = creat(&(0x7f0000000140)='./bus\x00', 0x0) io_setup(0x1, &(0x7f0000000180)=0x0) io_submit(r3, 0x45, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000000000, 0x0, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) fallocate(r0, 0x3, 0x0, 0x100000fe) 05:05:37 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000204dbf4655fdbf4655f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:05:37 executing program 0: r0 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ftruncate(0xffffffffffffffff, 0x0) lseek(r0, 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(0xffffffffffffffff, 0x40086602, &(0x7f0000000040)) r1 = getpgid(0x0) perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, r1, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat2(0xffffffffffffffff, &(0x7f00000001c0)='./bus\x00', 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000100)={'syztnl0\x00', &(0x7f0000000240)={'syztnl1\x00', 0x0, 0x2f, 0x1, 0x5, 0x1, 0x48, @mcast2, @ipv4={'\x00', '\xff\xff', @local}, 0x40, 0x8, 0x1, 0x2}}) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f0000062c40)={0x8000000000, [], 0x0, "00001000"}) r2 = creat(&(0x7f0000000140)='./bus\x00', 0x0) io_setup(0x1, &(0x7f0000000180)=0x0) io_submit(r3, 0x45, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000000000, 0x0, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) fallocate(r0, 0x3, 0x0, 0x100000fe) 05:05:37 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f00000004c0)=ANY=[], 0x208e24b) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r2 = syz_io_uring_setup(0x70c4, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000400000/0xc00000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000000)=0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000180)=@IORING_OP_LINK_TIMEOUT={0xf, 0xa89a1c1bd660819, 0x0, 0x0, 0x0, &(0x7f0000000140)}, 0x0) r5 = dup(r2) syz_io_uring_submit(r3, r4, &(0x7f0000000040)=@IORING_OP_CONNECT={0x10, 0x0, 0x0, r5, 0x0, 0x0}, 0x0) io_uring_enter(r5, 0x6700, 0x0, 0x0, 0x0, 0x0) setresgid(0x0, 0x0, 0x0) r6 = socket$nl_xfrm(0x10, 0x3, 0x6) sendfile(r6, r1, 0x0, 0x100000002) 05:05:37 executing program 5: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f00000004c0)=ANY=[], 0x208e24b) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r2 = syz_io_uring_setup(0x70c4, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000400000/0xc00000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000000)=0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000180)=@IORING_OP_LINK_TIMEOUT={0xf, 0xa89a1c1bd660819, 0x0, 0x0, 0x0, &(0x7f0000000140)}, 0x0) r5 = dup(r2) syz_io_uring_submit(r3, r4, &(0x7f0000000040)=@IORING_OP_CONNECT={0x10, 0x0, 0x0, r5, 0x0, 0x0}, 0x1) io_uring_enter(r5, 0x6700, 0x0, 0x0, 0x0, 0x0) r6 = openat$pidfd(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) recvmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000004c80)={0x77359400}) setresgid(0x0, 0x0, 0x0) r7 = socket$nl_xfrm(0x10, 0x3, 0x6) sendfile(r7, r1, 0x0, 0x100000002) ioctl$BTRFS_IOC_INO_LOOKUP(r6, 0xd0009412, &(0x7f0000000940)={0x0, 0x9}) [ 2908.729132][ C0] sd 0:0:1:0: [sg0] tag#688 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2908.739451][ C0] sd 0:0:1:0: [sg0] tag#688 CDB: opcode=0xe5 (vendor) [ 2908.746337][ C0] sd 0:0:1:0: [sg0] tag#688 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2908.755957][ C0] sd 0:0:1:0: [sg0] tag#688 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2908.765689][ C0] sd 0:0:1:0: [sg0] tag#688 CDB[20]: ba 05:05:37 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000604dbf4655fdbf4655f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:05:37 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000005dbf4655fdbf4655f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:05:37 executing program 2: r0 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ftruncate(0xffffffffffffffff, 0x0) lseek(r0, 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000040)) getpgid(0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat2(0xffffffffffffffff, &(0x7f00000001c0)='./bus\x00', 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000100)={'syztnl0\x00', &(0x7f0000000240)={'syztnl1\x00', 0x0, 0x0, 0x1, 0x5, 0x1, 0x48, @mcast2, @ipv4={'\x00', '\xff\xff', @local}, 0x40, 0x8, 0x1, 0x2}}) r1 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r1, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5, 0x8}, 0x0, 0x0, 0x9, 0x7, 0x7fffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f0000062c40)={0x8000000000, [], 0x0, "00001000"}) r2 = creat(&(0x7f0000000140)='./bus\x00', 0x0) io_setup(0x1, &(0x7f0000000180)=0x0) io_submit(r3, 0x45, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000000000, 0x0, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) fallocate(r0, 0x3, 0x0, 0x100000fe) 05:05:37 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000006dbf4655fdbf4655f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) [ 2908.997556][ C0] sd 0:0:1:0: [sg0] tag#687 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2909.008431][ C0] sd 0:0:1:0: [sg0] tag#687 CDB: opcode=0xe5 (vendor) [ 2909.015230][ C0] sd 0:0:1:0: [sg0] tag#687 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2909.024741][ C0] sd 0:0:1:0: [sg0] tag#687 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2909.034366][ C0] sd 0:0:1:0: [sg0] tag#687 CDB[20]: ba 05:05:37 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000406dbf4655fdbf4655f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:05:37 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000007dbf4655fdbf4655f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:05:37 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000009dbf4655fdbf4655f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:05:37 executing program 4: r0 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ftruncate(0xffffffffffffffff, 0x0) lseek(r0, 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000040)) getpgid(0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat2(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000100)={'syztnl0\x00', &(0x7f0000000240)={'syztnl1\x00', 0x0, 0x2f, 0x1, 0x5, 0x1, 0x48, @mcast2, @ipv4={'\x00', '\xff\xff', @local}, 0x40, 0x8, 0x1, 0x2}}) r1 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r1, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5, 0x8}, 0x0, 0x0, 0x9, 0x7, 0x7fffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f0000062c40)={0x8000000000, [], 0x0, "00001000"}) r2 = creat(&(0x7f0000000140)='./bus\x00', 0x0) io_setup(0x1, &(0x7f0000000180)=0x0) io_submit(r3, 0x45, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000000000, 0x0, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) fallocate(r0, 0x3, 0x0, 0x100000fe) 05:05:37 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f00000000000000020000000600000000000800008000002000000adbf4655fdbf4655f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:05:37 executing program 0: r0 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ftruncate(0xffffffffffffffff, 0x0) lseek(r0, 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(0xffffffffffffffff, 0x40086602, &(0x7f0000000040)) r1 = getpgid(0x0) perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, r1, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat2(0xffffffffffffffff, &(0x7f00000001c0)='./bus\x00', 0x0, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f0000062c40)={0x8000000000, [], 0x0, "00001000"}) r3 = creat(&(0x7f0000000140)='./bus\x00', 0x0) io_setup(0x1, &(0x7f0000000180)=0x0) io_submit(r4, 0x45, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000000000, 0x0, 0x1, 0x0, r3, &(0x7f0000000000), 0x377140be6b5ef4c7}]) fallocate(r0, 0x3, 0x0, 0x100000fe) [ 2909.437595][ C1] sd 0:0:1:0: [sg0] tag#681 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2909.448376][ C1] sd 0:0:1:0: [sg0] tag#681 CDB: opcode=0xe5 (vendor) [ 2909.455150][ C1] sd 0:0:1:0: [sg0] tag#681 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2909.464651][ C1] sd 0:0:1:0: [sg0] tag#681 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2909.474246][ C1] sd 0:0:1:0: [sg0] tag#681 CDB[20]: ba [ 2909.480669][ C0] sd 0:0:1:0: [sg0] tag#683 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2909.491006][ C0] sd 0:0:1:0: [sg0] tag#683 CDB: opcode=0xe5 (vendor) [ 2909.497927][ C0] sd 0:0:1:0: [sg0] tag#683 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2909.507413][ C0] sd 0:0:1:0: [sg0] tag#683 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2909.517110][ C0] sd 0:0:1:0: [sg0] tag#683 CDB[20]: ba 05:05:38 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f00000004c0)=ANY=[], 0x208e24b) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r2 = syz_io_uring_setup(0x70c4, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000400000/0xc00000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000000)=0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000180)=@IORING_OP_LINK_TIMEOUT={0xf, 0xa89a1c1bd660819, 0x0, 0x0, 0x0, &(0x7f0000000140)}, 0x0) r5 = dup(r2) syz_io_uring_submit(r3, r4, &(0x7f0000000040)=@IORING_OP_CONNECT={0x10, 0x0, 0x0, r5, 0x0, 0x0}, 0x0) io_uring_enter(r5, 0x6700, 0x0, 0x0, 0x0, 0x0) setresgid(0x0, 0x0, 0x0) r6 = socket$nl_xfrm(0x10, 0x3, 0x6) sendfile(r6, r1, 0x0, 0x100000002) 05:05:38 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f00000000000000020000000600000000000800008000002000000bdbf4655fdbf4655f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:05:38 executing program 5: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f00000004c0)=ANY=[], 0x208e24b) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r2 = syz_io_uring_setup(0x70c4, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000400000/0xc00000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000000)=0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000180)=@IORING_OP_LINK_TIMEOUT={0xf, 0xa89a1c1bd660819, 0x0, 0x0, 0x0, &(0x7f0000000140)}, 0x0) r5 = dup(r2) syz_io_uring_submit(r3, r4, &(0x7f0000000040)=@IORING_OP_CONNECT={0x10, 0x0, 0x0, r5, 0x0, 0x0}, 0x1) io_uring_enter(r5, 0x6700, 0x0, 0x0, 0x0, 0x0) openat$pidfd(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) recvmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000004c80)={0x77359400}) setresgid(0x0, 0x0, 0x0) r6 = socket$nl_xfrm(0x10, 0x3, 0x6) sendfile(r6, r1, 0x0, 0x100000002) r7 = openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x200001, 0x32) recvmmsg$unix(r5, &(0x7f00000008c0)=[{{&(0x7f00000002c0), 0x6e, &(0x7f0000000740)=[{&(0x7f0000000340)=""/197, 0xc5}, {&(0x7f0000000440)=""/9, 0x9}, {&(0x7f0000000480)=""/232, 0xe8}, {&(0x7f0000000580)=""/217, 0xd9}, {&(0x7f0000000680)=""/71, 0x47}, {&(0x7f0000000700)=""/26, 0x1a}], 0x6, &(0x7f00000007c0)=[@cred={{0x1c}}, @rights={{0x18, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x30, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @cred={{0x1c, 0x1, 0x2, {0x0, 0x0}}}, @cred={{0x1c}}, @cred={{0x1c}}], 0xe8}}], 0x1, 0x10022, &(0x7f0000000940)) fchownat(r7, &(0x7f0000000200)='./file0\x00', r8, 0x0, 0x1000) 05:05:38 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f00000000000000020000000600000000000800008000002000000cdbf4655fdbf4655f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:05:38 executing program 2: r0 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ftruncate(0xffffffffffffffff, 0x0) lseek(r0, 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000040)) getpgid(0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat2(0xffffffffffffffff, &(0x7f00000001c0)='./bus\x00', 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000100)={'syztnl0\x00', &(0x7f0000000240)={'syztnl1\x00', 0x0, 0x0, 0x1, 0x5, 0x1, 0x48, @mcast2, @ipv4={'\x00', '\xff\xff', @local}, 0x40, 0x8, 0x1, 0x2}}) r1 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r1, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5, 0x8}, 0x0, 0x0, 0x9, 0x7, 0x7fffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f0000062c40)={0x8000000000, [], 0x0, "00001000"}) r2 = creat(&(0x7f0000000140)='./bus\x00', 0x0) io_setup(0x1, &(0x7f0000000180)=0x0) io_submit(r3, 0x45, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000000000, 0x0, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) fallocate(r0, 0x3, 0x0, 0x100000fe) 05:05:38 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f00000000000000020000000600000000000800008000002000000ddbf4655fdbf4655f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:05:38 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f00000000000000020000000600000000000800008000002000000edbf4655fdbf4655f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) [ 2910.063874][ C1] sd 0:0:1:0: [sg0] tag#700 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2910.074549][ C1] sd 0:0:1:0: [sg0] tag#700 CDB: opcode=0xe5 (vendor) [ 2910.081762][ C1] sd 0:0:1:0: [sg0] tag#700 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2910.091358][ C1] sd 0:0:1:0: [sg0] tag#700 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2910.100949][ C1] sd 0:0:1:0: [sg0] tag#700 CDB[20]: ba 05:05:38 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f00000000000000020000000600000000000800008000002000000fdbf4655fdbf4655f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:05:38 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f00000000000000020000000600000000000800008000002000f80fdbf4655fdbf4655f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:05:39 executing program 4: r0 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ftruncate(0xffffffffffffffff, 0x0) lseek(r0, 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000040)) getpgid(0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat2(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000100)={'syztnl0\x00', &(0x7f0000000240)={'syztnl1\x00', 0x0, 0x2f, 0x1, 0x5, 0x1, 0x48, @mcast2, @ipv4={'\x00', '\xff\xff', @local}, 0x40, 0x8, 0x1, 0x2}}) r1 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r1, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5, 0x8}, 0x0, 0x0, 0x9, 0x7, 0x7fffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f0000062c40)={0x8000000000, [], 0x0, "00001000"}) r2 = creat(&(0x7f0000000140)='./bus\x00', 0x0) io_setup(0x1, &(0x7f0000000180)=0x0) io_submit(r3, 0x45, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000000000, 0x0, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) fallocate(r0, 0x3, 0x0, 0x100000fe) 05:05:39 executing program 0: r0 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ftruncate(0xffffffffffffffff, 0x0) lseek(r0, 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(0xffffffffffffffff, 0x40086602, &(0x7f0000000040)) r1 = getpgid(0x0) perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, r1, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat2(0xffffffffffffffff, &(0x7f00000001c0)='./bus\x00', 0x0, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f0000062c40)={0x8000000000, [], 0x0, "00001000"}) r3 = creat(&(0x7f0000000140)='./bus\x00', 0x0) io_setup(0x1, &(0x7f0000000180)=0x0) io_submit(r4, 0x45, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000000000, 0x0, 0x1, 0x0, r3, &(0x7f0000000000), 0x377140be6b5ef4c7}]) fallocate(r0, 0x3, 0x0, 0x100000fe) 05:05:39 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020002010dbf4655fdbf4655f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) [ 2910.492152][ C1] sd 0:0:1:0: [sg0] tag#647 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2910.502647][ C1] sd 0:0:1:0: [sg0] tag#647 CDB: opcode=0xe5 (vendor) [ 2910.509729][ C1] sd 0:0:1:0: [sg0] tag#647 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2910.519320][ C1] sd 0:0:1:0: [sg0] tag#647 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2910.529101][ C1] sd 0:0:1:0: [sg0] tag#647 CDB[20]: ba [ 2910.535947][ C0] sd 0:0:1:0: [sg0] tag#648 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2910.546764][ C0] sd 0:0:1:0: [sg0] tag#648 CDB: opcode=0xe5 (vendor) [ 2910.553601][ C0] sd 0:0:1:0: [sg0] tag#648 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2910.563432][ C0] sd 0:0:1:0: [sg0] tag#648 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2910.572908][ C0] sd 0:0:1:0: [sg0] tag#648 CDB[20]: ba 05:05:39 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f00000004c0)=ANY=[], 0x208e24b) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r2 = syz_io_uring_setup(0x70c4, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000400000/0xc00000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000000)=0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000180)=@IORING_OP_LINK_TIMEOUT={0xf, 0xa89a1c1bd660819, 0x0, 0x0, 0x0, &(0x7f0000000140)}, 0x0) r5 = dup(r2) syz_io_uring_submit(r3, r4, &(0x7f0000000040)=@IORING_OP_CONNECT={0x10, 0x0, 0x0, r5, 0x0, 0x0}, 0x1) io_uring_enter(0xffffffffffffffff, 0x6700, 0x0, 0x0, 0x0, 0x0) setresgid(0x0, 0x0, 0x0) r6 = socket$nl_xfrm(0x10, 0x3, 0x6) sendfile(r6, r1, 0x0, 0x100000002) 05:05:39 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000011dbf4655fdbf4655f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:05:39 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000012dbf4655fdbf4655f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:05:39 executing program 5: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f00000004c0)=ANY=[], 0x208e24b) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpuset.effective_mems\x00', 0xb00000000065808, 0x0) syz_io_uring_setup(0x70c4, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000400000/0xc00000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000000)=0x0) syz_io_uring_submit(r2, r3, &(0x7f0000000180)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x2, 0x0, 0x80, 0x1, &(0x7f0000000400)="61c69e7d533779dd80dae6ae6be1344f7eb1ffd4023306e14f63190f82068be4a7f5579eda3bfa8d82e3e39be7bed7a6ad2198a80281562cb1f643b4d0c05c949ae8dddfd6978f14b5dcf8304b6a922b2f332b90bbf5cd2da4fd2d18daa2d79b99c80fa6a7a1f83709f71aa1f2c0675e521e0b5510e833d8409ce9", 0x0, 0x0, 0x0, {0x3}}, 0x0) r4 = dup(r1) r5 = syz_open_dev$tty1(0xc, 0x4, 0x1) r6 = syz_open_procfs(0x0, &(0x7f0000000240)='mountinfo\x00') sendfile(r5, r6, 0x0, 0x800000080004103) syz_io_uring_submit(r2, r3, &(0x7f0000000040)=@IORING_OP_CONNECT={0x10, 0x4, 0x0, r6, 0x0, 0x0}, 0x1) io_uring_enter(r4, 0x6700, 0x0, 0x0, 0x0, 0x0) r7 = fcntl$dupfd(r1, 0x0, r6) waitid$P_PIDFD(0x3, r7, 0x0, 0x2, &(0x7f00000002c0)) openat$pidfd(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) recvmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000004c80)={0x77359400}) setresgid(0x0, 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) fadvise64(0xffffffffffffffff, 0x9, 0x0, 0x4) r8 = socket$nl_xfrm(0x10, 0x3, 0x6) sendfile(r8, r1, 0x0, 0x100000002) 05:05:39 executing program 2: r0 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ftruncate(0xffffffffffffffff, 0x0) lseek(r0, 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000040)) getpgid(0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat2(0xffffffffffffffff, &(0x7f00000001c0)='./bus\x00', 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000100)={'syztnl0\x00', &(0x7f0000000240)={'syztnl1\x00', 0x0, 0x0, 0x1, 0x5, 0x1, 0x48, @mcast2, @ipv4={'\x00', '\xff\xff', @local}, 0x40, 0x8, 0x1, 0x2}}) r1 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r1, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5, 0x8}, 0x0, 0x0, 0x9, 0x7, 0x7fffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f0000062c40)={0x8000000000, [], 0x0, "00001000"}) r2 = creat(&(0x7f0000000140)='./bus\x00', 0x0) io_setup(0x1, &(0x7f0000000180)=0x0) io_submit(r3, 0x45, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000000000, 0x0, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) fallocate(r0, 0x3, 0x0, 0x100000fe) 05:05:39 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000018dbf4655fdbf4655f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:05:39 executing program 0: r0 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ftruncate(0xffffffffffffffff, 0x0) lseek(r0, 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(0xffffffffffffffff, 0x40086602, &(0x7f0000000040)) r1 = getpgid(0x0) perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, r1, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat2(0xffffffffffffffff, &(0x7f00000001c0)='./bus\x00', 0x0, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f0000062c40)={0x8000000000, [], 0x0, "00001000"}) r3 = creat(&(0x7f0000000140)='./bus\x00', 0x0) io_setup(0x1, &(0x7f0000000180)=0x0) io_submit(r4, 0x45, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000000000, 0x0, 0x1, 0x0, r3, &(0x7f0000000000), 0x377140be6b5ef4c7}]) fallocate(r0, 0x3, 0x0, 0x100000fe) 05:05:39 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000118dbf4655fdbf4655f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:05:39 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000019dbf4655fdbf4655f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:05:40 executing program 4: r0 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ftruncate(0xffffffffffffffff, 0x0) lseek(r0, 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000040)) getpgid(0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat2(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000100)={'syztnl0\x00', &(0x7f0000000240)={'syztnl1\x00', 0x0, 0x2f, 0x1, 0x5, 0x1, 0x48, @mcast2, @ipv4={'\x00', '\xff\xff', @local}, 0x40, 0x8, 0x1, 0x2}}) r1 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r1, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5, 0x8}, 0x0, 0x0, 0x9, 0x7, 0x7fffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f0000062c40)={0x8000000000, [], 0x0, "00001000"}) r2 = creat(&(0x7f0000000140)='./bus\x00', 0x0) io_setup(0x1, &(0x7f0000000180)=0x0) io_submit(r3, 0x45, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000000000, 0x0, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) fallocate(r0, 0x3, 0x0, 0x100000fe) 05:05:40 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f00000000000000020000000600000000000800008000002000001fdbf4655fdbf4655f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:05:40 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f00000004c0)=ANY=[], 0x208e24b) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r2 = syz_io_uring_setup(0x70c4, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000400000/0xc00000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000000)=0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000180)=@IORING_OP_LINK_TIMEOUT={0xf, 0xa89a1c1bd660819, 0x0, 0x0, 0x0, &(0x7f0000000140)}, 0x0) r5 = dup(r2) syz_io_uring_submit(r3, r4, &(0x7f0000000040)=@IORING_OP_CONNECT={0x10, 0x0, 0x0, r5, 0x0, 0x0}, 0x1) io_uring_enter(0xffffffffffffffff, 0x6700, 0x0, 0x0, 0x0, 0x0) setresgid(0x0, 0x0, 0x0) r6 = socket$nl_xfrm(0x10, 0x3, 0x6) sendfile(r6, r1, 0x0, 0x100000002) 05:05:40 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000020dbf4655fdbf4655f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) [ 2911.578896][ C0] scsi_io_completion_action: 2 callbacks suppressed [ 2911.578929][ C0] sd 0:0:1:0: [sg0] tag#665 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2911.596686][ C0] sd 0:0:1:0: [sg0] tag#665 CDB: opcode=0xe5 (vendor) [ 2911.603655][ C0] sd 0:0:1:0: [sg0] tag#665 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2911.613127][ C0] sd 0:0:1:0: [sg0] tag#665 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2911.622607][ C0] sd 0:0:1:0: [sg0] tag#665 CDB[20]: ba 05:05:40 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020001020dbf4655fdbf4655f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:05:40 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000022dbf4655fdbf4655f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:05:40 executing program 5: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f00000004c0)=ANY=[], 0x208e24b) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r2 = syz_io_uring_setup(0x70c4, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000400000/0xc00000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000000)=0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000180)=@IORING_OP_LINK_TIMEOUT={0xf, 0xa89a1c1bd660819, 0x0, 0x0, 0x0, &(0x7f0000000140)}, 0x0) r5 = dup(r2) syz_io_uring_submit(r3, r4, &(0x7f0000000040)=@IORING_OP_CONNECT={0x10, 0x0, 0x0, r5, 0x0, 0x0}, 0x1) io_uring_enter(r5, 0x6700, 0x0, 0x0, 0x0, 0x0) r6 = syz_open_dev$tty1(0xc, 0x4, 0x1) r7 = syz_open_procfs(0x0, &(0x7f0000000240)='oom_adj\x00') sendfile(r6, r7, 0x0, 0x800000080004103) io_uring_register$IORING_REGISTER_BUFFERS(r7, 0x0, &(0x7f0000000780)=[{&(0x7f0000000940)=""/4096, 0x1000}, {&(0x7f0000001940)=""/4096, 0x1000}, {&(0x7f00000002c0)=""/172, 0xac}, {&(0x7f0000000380)=""/117, 0x75}, {&(0x7f0000000400)=""/75, 0x4b}, {&(0x7f0000000480)=""/186, 0xba}, {&(0x7f0000000540)=""/87, 0x57}, {&(0x7f00000000c0)=""/13, 0xd}, {&(0x7f00000005c0)=""/147, 0x93}, {&(0x7f0000000680)=""/210, 0xd2}], 0xa) openat$pidfd(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) ioctl$BTRFS_IOC_QGROUP_CREATE(0xffffffffffffffff, 0x4010942a, &(0x7f0000000200)={0x0, 0x86e7}) recvmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000004c80)={0x77359400}) setresgid(0x0, 0x0, 0x0) r8 = openat$pidfd(0xffffffffffffff9c, &(0x7f0000000840), 0x2200, 0x0) pidfd_send_signal(r8, 0x16, &(0x7f0000000880)={0x9, 0x40, 0xf457}, 0x0) r9 = socket$nl_xfrm(0x10, 0x3, 0x6) sendfile(r9, r1, 0x0, 0x100000002) 05:05:40 executing program 2: r0 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ftruncate(0xffffffffffffffff, 0x0) lseek(r0, 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000040)) getpgid(0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat2(0xffffffffffffffff, &(0x7f00000001c0)='./bus\x00', 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000100)={'syztnl0\x00', &(0x7f0000000240)={'syztnl1\x00', 0x0, 0x2f, 0x0, 0x5, 0x1, 0x48, @mcast2, @ipv4={'\x00', '\xff\xff', @local}, 0x40, 0x8, 0x1, 0x2}}) r1 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r1, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5, 0x8}, 0x0, 0x0, 0x9, 0x7, 0x7fffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f0000062c40)={0x8000000000, [], 0x0, "00001000"}) r2 = creat(&(0x7f0000000140)='./bus\x00', 0x0) io_setup(0x1, &(0x7f0000000180)=0x0) io_submit(r3, 0x45, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000000000, 0x0, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) fallocate(r0, 0x3, 0x0, 0x100000fe) 05:05:40 executing program 0: r0 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ftruncate(0xffffffffffffffff, 0x0) lseek(r0, 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(0xffffffffffffffff, 0x40086602, &(0x7f0000000040)) r1 = getpgid(0x0) perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, r1, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000100)={'syztnl0\x00', &(0x7f0000000240)={'syztnl1\x00', 0x0, 0x2f, 0x1, 0x5, 0x1, 0x48, @mcast2, @ipv4={'\x00', '\xff\xff', @local}, 0x40, 0x8, 0x1, 0x2}}) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f0000062c40)={0x8000000000, [], 0x0, "00001000"}) r3 = creat(&(0x7f0000000140)='./bus\x00', 0x0) io_setup(0x1, &(0x7f0000000180)=0x0) io_submit(r4, 0x45, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000000000, 0x0, 0x1, 0x0, r3, &(0x7f0000000000), 0x377140be6b5ef4c7}]) fallocate(r0, 0x3, 0x0, 0x100000fe) 05:05:40 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000124dbf4655fdbf4655f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:05:40 executing program 4: r0 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ftruncate(0xffffffffffffffff, 0x0) lseek(r0, 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(0xffffffffffffffff, 0x40086602, &(0x7f0000000040)) r1 = getpgid(0x0) perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, r1, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat2(0xffffffffffffffff, &(0x7f00000001c0)='./bus\x00', 0x0, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f0000062c40)={0x8000000000, [], 0x0, "00001000"}) r3 = creat(&(0x7f0000000140)='./bus\x00', 0x0) io_setup(0x1, &(0x7f0000000180)=0x0) io_submit(r4, 0x45, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000000000, 0x0, 0x1, 0x0, r3, &(0x7f0000000000), 0x377140be6b5ef4c7}]) fallocate(r0, 0x3, 0x0, 0x100000fe) 05:05:40 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000025dbf4655fdbf4655f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) [ 2912.099911][ C1] sd 0:0:1:0: [sg0] tag#679 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2912.110618][ C1] sd 0:0:1:0: [sg0] tag#679 CDB: opcode=0xe5 (vendor) [ 2912.117384][ C1] sd 0:0:1:0: [sg0] tag#679 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2912.127184][ C1] sd 0:0:1:0: [sg0] tag#679 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2912.137056][ C1] sd 0:0:1:0: [sg0] tag#679 CDB[20]: ba [ 2912.146586][ C1] sd 0:0:1:0: [sg0] tag#680 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2912.157237][ C1] sd 0:0:1:0: [sg0] tag#680 CDB: opcode=0xe5 (vendor) [ 2912.161750][ C0] sd 0:0:1:0: [sg0] tag#681 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2912.164062][ C1] sd 0:0:1:0: [sg0] tag#680 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2912.174388][ C0] sd 0:0:1:0: [sg0] tag#681 CDB: opcode=0xe5 (vendor) [ 2912.183943][ C1] sd 0:0:1:0: [sg0] tag#680 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2912.190794][ C0] sd 0:0:1:0: [sg0] tag#681 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2912.200347][ C1] sd 0:0:1:0: [sg0] tag#680 CDB[20]: ba [ 2912.209797][ C0] sd 0:0:1:0: [sg0] tag#681 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2912.224930][ C0] sd 0:0:1:0: [sg0] tag#681 CDB[20]: ba 05:05:40 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f00000000000000020000000600000000000800008000002000002edbf4655fdbf4655f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:05:41 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000032dbf4655fdbf4655f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:05:41 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f00000004c0)=ANY=[], 0x208e24b) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r2 = syz_io_uring_setup(0x70c4, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000400000/0xc00000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000000)=0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000180)=@IORING_OP_LINK_TIMEOUT={0xf, 0xa89a1c1bd660819, 0x0, 0x0, 0x0, &(0x7f0000000140)}, 0x0) r5 = dup(r2) syz_io_uring_submit(r3, r4, &(0x7f0000000040)=@IORING_OP_CONNECT={0x10, 0x0, 0x0, r5, 0x0, 0x0}, 0x1) io_uring_enter(0xffffffffffffffff, 0x6700, 0x0, 0x0, 0x0, 0x0) setresgid(0x0, 0x0, 0x0) r6 = socket$nl_xfrm(0x10, 0x3, 0x6) sendfile(r6, r1, 0x0, 0x100000002) 05:05:41 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f00000000000000020000000600000000000800008000002000003fdbf4655fdbf4655f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:05:41 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000040dbf4655fdbf4655f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:05:41 executing program 5: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f00000004c0)=ANY=[], 0x208e24b) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r2 = syz_io_uring_setup(0x70c4, &(0x7f0000000240)={0x0, 0x7674, 0x10}, &(0x7f0000002000/0x2000)=nil, &(0x7f0000400000/0xc00000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000000)=0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000180)=@IORING_OP_LINK_TIMEOUT={0xf, 0xa89a1c1bd660819, 0x0, 0x0, 0x0, &(0x7f0000000140)}, 0x0) r5 = dup(r2) syz_io_uring_submit(r3, r4, &(0x7f0000000040)=@IORING_OP_CONNECT={0x10, 0x0, 0x0, r5, 0x0, 0x0}, 0x1) io_uring_enter(r5, 0x6700, 0x0, 0x0, 0x0, 0x0) openat$pidfd(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) recvmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000004c80)={0x77359400}) pipe2(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4000) r7 = syz_open_dev$tty1(0xc, 0x4, 0x1) r8 = syz_open_procfs(0x0, &(0x7f0000000240)='mountinfo\x00') sendfile(r7, r8, 0x0, 0x800000080004103) io_uring_register$IORING_REGISTER_EVENTFD(r6, 0x4, &(0x7f0000000200)=r8, 0x1) setresgid(0x0, 0x0, 0x0) r9 = socket$nl_xfrm(0x10, 0x3, 0x6) sendfile(r9, r1, 0x0, 0x100000002) 05:05:41 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000240dbf4655fdbf4655f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:05:41 executing program 2: r0 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ftruncate(0xffffffffffffffff, 0x0) lseek(r0, 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000040)) getpgid(0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat2(0xffffffffffffffff, &(0x7f00000001c0)='./bus\x00', 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000100)={'syztnl0\x00', &(0x7f0000000240)={'syztnl1\x00', 0x0, 0x2f, 0x0, 0x5, 0x1, 0x48, @mcast2, @ipv4={'\x00', '\xff\xff', @local}, 0x40, 0x8, 0x1, 0x2}}) r1 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r1, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5, 0x8}, 0x0, 0x0, 0x9, 0x7, 0x7fffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f0000062c40)={0x8000000000, [], 0x0, "00001000"}) r2 = creat(&(0x7f0000000140)='./bus\x00', 0x0) io_setup(0x1, &(0x7f0000000180)=0x0) io_submit(r3, 0x45, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000000000, 0x0, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) fallocate(r0, 0x3, 0x0, 0x100000fe) [ 2912.922418][ C1] sd 0:0:1:0: [sg0] tag#651 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2912.932742][ C1] sd 0:0:1:0: [sg0] tag#651 CDB: opcode=0xe5 (vendor) [ 2912.939557][ C1] sd 0:0:1:0: [sg0] tag#651 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2912.949108][ C1] sd 0:0:1:0: [sg0] tag#651 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2912.958667][ C1] sd 0:0:1:0: [sg0] tag#651 CDB[20]: ba 05:05:41 executing program 0: r0 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ftruncate(0xffffffffffffffff, 0x0) lseek(r0, 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(0xffffffffffffffff, 0x40086602, &(0x7f0000000040)) r1 = getpgid(0x0) perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, r1, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000100)={'syztnl0\x00', &(0x7f0000000240)={'syztnl1\x00', 0x0, 0x2f, 0x1, 0x5, 0x1, 0x48, @mcast2, @ipv4={'\x00', '\xff\xff', @local}, 0x40, 0x8, 0x1, 0x2}}) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f0000062c40)={0x8000000000, [], 0x0, "00001000"}) r3 = creat(&(0x7f0000000140)='./bus\x00', 0x0) io_setup(0x1, &(0x7f0000000180)=0x0) io_submit(r4, 0x45, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000000000, 0x0, 0x1, 0x0, r3, &(0x7f0000000000), 0x377140be6b5ef4c7}]) fallocate(r0, 0x3, 0x0, 0x100000fe) 05:05:41 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000048dbf4655fdbf4655f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:05:41 executing program 4: r0 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ftruncate(0xffffffffffffffff, 0x0) lseek(r0, 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(0xffffffffffffffff, 0x40086602, &(0x7f0000000040)) r1 = getpgid(0x0) perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, r1, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat2(0xffffffffffffffff, &(0x7f00000001c0)='./bus\x00', 0x0, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f0000062c40)={0x8000000000, [], 0x0, "00001000"}) r3 = creat(&(0x7f0000000140)='./bus\x00', 0x0) io_setup(0x1, &(0x7f0000000180)=0x0) io_submit(r4, 0x45, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000000000, 0x0, 0x1, 0x0, r3, &(0x7f0000000000), 0x377140be6b5ef4c7}]) fallocate(r0, 0x3, 0x0, 0x100000fe) [ 2913.159849][ C1] sd 0:0:1:0: [sg0] tag#660 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2913.170465][ C1] sd 0:0:1:0: [sg0] tag#660 CDB: opcode=0xe5 (vendor) [ 2913.177298][ C1] sd 0:0:1:0: [sg0] tag#660 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2913.186760][ C1] sd 0:0:1:0: [sg0] tag#660 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2913.190963][ C0] sd 0:0:1:0: [sg0] tag#661 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2913.196417][ C1] sd 0:0:1:0: [sg0] tag#660 CDB[20]: ba [ 2913.206709][ C0] sd 0:0:1:0: [sg0] tag#661 CDB: opcode=0xe5 (vendor) [ 2913.218986][ C0] sd 0:0:1:0: [sg0] tag#661 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2913.228467][ C0] sd 0:0:1:0: [sg0] tag#661 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2913.238068][ C0] sd 0:0:1:0: [sg0] tag#661 CDB[20]: ba 05:05:41 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f00000000000000020000000600000000000800008000002000004cdbf4655fdbf4655f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:05:41 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f00000000000000020000000600000000000800008000002000015edbf4655fdbf4655f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:05:42 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000060dbf4655fdbf4655f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:05:42 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f00000004c0)=ANY=[], 0x208e24b) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r2 = syz_io_uring_setup(0x70c4, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000400000/0xc00000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000000)=0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000180)=@IORING_OP_LINK_TIMEOUT={0xf, 0xa89a1c1bd660819, 0x0, 0x0, 0x0, &(0x7f0000000140)}, 0x0) r5 = dup(r2) syz_io_uring_submit(r3, r4, &(0x7f0000000040)=@IORING_OP_CONNECT={0x10, 0x0, 0x0, r5, 0x0, 0x0}, 0x1) io_uring_enter(r5, 0x0, 0x0, 0x0, 0x0, 0x0) setresgid(0x0, 0x0, 0x0) r6 = socket$nl_xfrm(0x10, 0x3, 0x6) sendfile(r6, r1, 0x0, 0x100000002) 05:05:42 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000068dbf4655fdbf4655f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:05:42 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f00000000000000020000000600000000000800008000002000006cdbf4655fdbf4655f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:05:42 executing program 5: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) sendfile(r0, r0, 0x0, 0xf65) write$binfmt_script(r0, &(0x7f00000004c0)=ANY=[], 0x208e24b) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r2 = syz_io_uring_setup(0x70c4, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000400000/0xc00000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000000)=0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000180)=@IORING_OP_LINK_TIMEOUT={0xf, 0xa89a1c1bd660819, 0x0, 0x0, 0x0, &(0x7f0000000140)}, 0x0) r5 = dup(r2) syz_io_uring_submit(r3, r4, &(0x7f0000000040)=@IORING_OP_CONNECT={0x10, 0x0, 0x0, r5, 0x0, 0x0}, 0x1) io_uring_enter(r5, 0x6700, 0x0, 0x0, 0x0, 0x0) openat$pidfd(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) recvmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000004c80)={0x77359400}) setresgid(0x0, 0x0, 0x0) r6 = socket$nl_xfrm(0x10, 0x3, 0x6) sendfile(r6, r1, 0x0, 0x100000002) r7 = openat$bsg(0xffffffffffffff9c, &(0x7f00000000c0), 0x40000, 0x0) sendto$inet6(r7, &(0x7f00000002c0)="cfcd18c03e53164a86d9131b3acd35bcf5676ed6b77f1c28f6cedd34fe85be47d95494a0c38ffae5d52dac19db6bbf5116511bf658b6df80a808f8e5268bd9415cc31f7d40c2841ba3a1f81b43f28b5bcb35698701284a070e8e85e1472f60e15c3a5152d700b379d39db2bbbc8be29ede08623e3aa48b2e898fe4488696b30c0a0496770eb7e0f215faf85ddc28b5483aa560a3c5e6836451520d93ed0f5d0c02c98bbbaa3a852aea171ab0367b51189bc2ee6bb9df7774c66a2e4449d6775028d955add13c552da1fc2c96b8acf4988afd1944bcdc63b004152cbf", 0xdc, 0x8000, &(0x7f0000000200)={0xa, 0x4e24, 0x1, @mcast2, 0x100}, 0x1c) 05:05:42 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000074dbf4655fdbf4655f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:05:42 executing program 2: r0 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ftruncate(0xffffffffffffffff, 0x0) lseek(r0, 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000040)) getpgid(0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat2(0xffffffffffffffff, &(0x7f00000001c0)='./bus\x00', 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000100)={'syztnl0\x00', &(0x7f0000000240)={'syztnl1\x00', 0x0, 0x2f, 0x0, 0x5, 0x1, 0x48, @mcast2, @ipv4={'\x00', '\xff\xff', @local}, 0x40, 0x8, 0x1, 0x2}}) r1 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r1, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5, 0x8}, 0x0, 0x0, 0x9, 0x7, 0x7fffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f0000062c40)={0x8000000000, [], 0x0, "00001000"}) r2 = creat(&(0x7f0000000140)='./bus\x00', 0x0) io_setup(0x1, &(0x7f0000000180)=0x0) io_submit(r3, 0x45, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000000000, 0x0, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) fallocate(r0, 0x3, 0x0, 0x100000fe) [ 2913.958795][ C1] sd 0:0:1:0: [sg0] tag#651 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2913.969828][ C1] sd 0:0:1:0: [sg0] tag#651 CDB: opcode=0xe5 (vendor) [ 2913.976792][ C1] sd 0:0:1:0: [sg0] tag#651 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2913.986374][ C1] sd 0:0:1:0: [sg0] tag#651 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2913.995849][ C1] sd 0:0:1:0: [sg0] tag#651 CDB[20]: ba 05:05:42 executing program 0: r0 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ftruncate(0xffffffffffffffff, 0x0) lseek(r0, 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(0xffffffffffffffff, 0x40086602, &(0x7f0000000040)) getpgid(0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000100)={'syztnl0\x00', &(0x7f0000000240)={'syztnl1\x00', 0x0, 0x2f, 0x1, 0x5, 0x1, 0x48, @mcast2, @ipv4={'\x00', '\xff\xff', @local}, 0x40, 0x8, 0x1, 0x2}}) r1 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r1, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f0000062c40)={0x8000000000, [], 0x0, "00001000"}) r2 = creat(&(0x7f0000000140)='./bus\x00', 0x0) io_setup(0x1, &(0x7f0000000180)=0x0) io_submit(r3, 0x45, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000000000, 0x0, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) fallocate(r0, 0x3, 0x0, 0x100000fe) 05:05:42 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f00000000000000020000000600000000000800008000002000007adbf4655fdbf4655f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) [ 2914.127081][ C1] sd 0:0:1:0: [sg0] tag#656 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2914.138073][ C1] sd 0:0:1:0: [sg0] tag#656 CDB: opcode=0xe5 (vendor) [ 2914.145117][ C1] sd 0:0:1:0: [sg0] tag#656 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2914.154848][ C1] sd 0:0:1:0: [sg0] tag#656 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2914.164525][ C1] sd 0:0:1:0: [sg0] tag#656 CDB[20]: ba 05:05:42 executing program 4: r0 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ftruncate(0xffffffffffffffff, 0x0) lseek(r0, 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(0xffffffffffffffff, 0x40086602, &(0x7f0000000040)) r1 = getpgid(0x0) perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, r1, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat2(0xffffffffffffffff, &(0x7f00000001c0)='./bus\x00', 0x0, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f0000062c40)={0x8000000000, [], 0x0, "00001000"}) r3 = creat(&(0x7f0000000140)='./bus\x00', 0x0) io_setup(0x1, &(0x7f0000000180)=0x0) io_submit(r4, 0x45, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000000000, 0x0, 0x1, 0x0, r3, &(0x7f0000000000), 0x377140be6b5ef4c7}]) fallocate(r0, 0x3, 0x0, 0x100000fe) 05:05:42 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f00000000000000020000000600000000000800008000002000029edbf4655fdbf4655f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:05:42 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f0000000000000002000000060000000000080000800000200002a7dbf4655fdbf4655f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) [ 2914.351466][ C0] sd 0:0:1:0: [sg0] tag#641 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2914.361778][ C0] sd 0:0:1:0: [sg0] tag#641 CDB: opcode=0xe5 (vendor) [ 2914.368575][ C0] sd 0:0:1:0: [sg0] tag#641 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2914.378253][ C0] sd 0:0:1:0: [sg0] tag#641 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2914.387926][ C0] sd 0:0:1:0: [sg0] tag#641 CDB[20]: ba 05:05:43 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f0000000000000002000000060000000000080000800000200003c1dbf4655fdbf4655f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:05:43 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f00000004c0)=ANY=[], 0x208e24b) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r2 = syz_io_uring_setup(0x70c4, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000400000/0xc00000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000000)=0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000180)=@IORING_OP_LINK_TIMEOUT={0xf, 0xa89a1c1bd660819, 0x0, 0x0, 0x0, &(0x7f0000000140)}, 0x0) r5 = dup(r2) syz_io_uring_submit(r3, r4, &(0x7f0000000040)=@IORING_OP_CONNECT={0x10, 0x0, 0x0, r5, 0x0, 0x0}, 0x1) io_uring_enter(r5, 0x0, 0x0, 0x0, 0x0, 0x0) setresgid(0x0, 0x0, 0x0) r6 = socket$nl_xfrm(0x10, 0x3, 0x6) sendfile(r6, r1, 0x0, 0x100000002) 05:05:43 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f0000000000000002000000060000000000080000800000200003d4dbf4655fdbf4655f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:05:43 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000ff8dbf4655fdbf4655f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:05:43 executing program 5: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f00000004c0)=ANY=[], 0x208e24b) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r2 = syz_io_uring_setup(0x70c4, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000400000/0xc00000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000000)=0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000180)=@IORING_OP_LINK_TIMEOUT={0xf, 0xa89a1c1bd660819, 0x0, 0x0, 0x0, &(0x7f0000000140)}, 0x0) r5 = dup(r2) syz_io_uring_submit(r3, r4, &(0x7f0000000040)=@IORING_OP_CONNECT={0x10, 0x0, 0x0, r5, 0x0, 0x0}, 0x1) io_uring_enter(r5, 0x6700, 0x0, 0x0, 0x0, 0x0) openat$pidfd(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) r6 = syz_io_uring_setup(0x7bd6, &(0x7f0000000100), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000400000/0xc00000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) io_uring_register$IORING_REGISTER_PERSONALITY(r6, 0x9, 0x0, 0x0) io_uring_register$IORING_UNREGISTER_PERSONALITY(r6, 0xa, 0x0, 0x0) r7 = syz_io_uring_setup(0x7bd6, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x3}, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000400000/0xc00000)=nil, &(0x7f00000002c0), &(0x7f00000001c0)) r8 = io_uring_register$IORING_REGISTER_PERSONALITY(r7, 0x9, 0x0, 0x0) io_uring_register$IORING_UNREGISTER_PERSONALITY(r6, 0xa, 0x0, r8) syz_io_uring_submit(r3, 0x0, &(0x7f00000000c0)=@IORING_OP_ASYNC_CANCEL={0xe, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, {0x0, r8}}, 0x3) recvmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000004c80)={0x77359400}) setresgid(0x0, 0x0, 0x0) r9 = socket$nl_xfrm(0x10, 0x3, 0x6) sendfile(r9, r1, 0x0, 0x100000002) 05:05:43 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f00000000000000020000000600000000000800008000002000fffedbf4655fdbf4655f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:05:43 executing program 2: r0 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ftruncate(0xffffffffffffffff, 0x0) lseek(r0, 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000040)) getpgid(0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat2(0xffffffffffffffff, &(0x7f00000001c0)='./bus\x00', 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000100)={'syztnl0\x00', &(0x7f0000000240)={'syztnl1\x00', 0x0, 0x2f, 0x1, 0x0, 0x1, 0x48, @mcast2, @ipv4={'\x00', '\xff\xff', @local}, 0x40, 0x8, 0x1, 0x2}}) r1 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r1, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5, 0x8}, 0x0, 0x0, 0x9, 0x7, 0x7fffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f0000062c40)={0x8000000000, [], 0x0, "00001000"}) r2 = creat(&(0x7f0000000140)='./bus\x00', 0x0) io_setup(0x1, &(0x7f0000000180)=0x0) io_submit(r3, 0x45, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000000000, 0x0, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) fallocate(r0, 0x3, 0x0, 0x100000fe) 05:05:43 executing program 0: r0 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ftruncate(0xffffffffffffffff, 0x0) lseek(r0, 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(0xffffffffffffffff, 0x40086602, &(0x7f0000000040)) getpgid(0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000100)={'syztnl0\x00', &(0x7f0000000240)={'syztnl1\x00', 0x0, 0x2f, 0x1, 0x5, 0x1, 0x48, @mcast2, @ipv4={'\x00', '\xff\xff', @local}, 0x40, 0x8, 0x1, 0x2}}) r1 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r1, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f0000062c40)={0x8000000000, [], 0x0, "00001000"}) r2 = creat(&(0x7f0000000140)='./bus\x00', 0x0) io_setup(0x1, &(0x7f0000000180)=0x0) io_submit(r3, 0x45, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000000000, 0x0, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) fallocate(r0, 0x3, 0x0, 0x100000fe) 05:05:43 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000fffdbf4655fdbf4655f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:05:43 executing program 4: r0 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ftruncate(0xffffffffffffffff, 0x0) lseek(r0, 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(0xffffffffffffffff, 0x40086602, &(0x7f0000000040)) getpgid(0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000100)={'syztnl0\x00', &(0x7f0000000240)={'syztnl1\x00', 0x0, 0x2f, 0x1, 0x5, 0x1, 0x48, @mcast2, @ipv4={'\x00', '\xff\xff', @local}, 0x40, 0x8, 0x1, 0x2}}) r1 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r1, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f0000062c40)={0x8000000000, [], 0x0, "00001000"}) r2 = creat(&(0x7f0000000140)='./bus\x00', 0x0) io_setup(0x1, &(0x7f0000000180)=0x0) io_submit(r3, 0x45, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000000000, 0x0, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) fallocate(r0, 0x3, 0x0, 0x100000fe) 05:05:43 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f00000000000000020000000600000000000800008000002000feffdbf4655fdbf4655f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:05:44 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000002dbf4655fdbf4655f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:05:44 executing program 0: r0 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ftruncate(0xffffffffffffffff, 0x0) lseek(r0, 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(0xffffffffffffffff, 0x40086602, &(0x7f0000000040)) getpgid(0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000100)={'syztnl0\x00', &(0x7f0000000240)={'syztnl1\x00', 0x0, 0x2f, 0x1, 0x5, 0x1, 0x48, @mcast2, @ipv4={'\x00', '\xff\xff', @local}, 0x40, 0x8, 0x1, 0x2}}) r1 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r1, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f0000062c40)={0x8000000000, [], 0x0, "00001000"}) r2 = creat(&(0x7f0000000140)='./bus\x00', 0x0) io_setup(0x1, &(0x7f0000000180)=0x0) io_submit(r3, 0x45, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000000000, 0x0, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) fallocate(r0, 0x3, 0x0, 0x100000fe) 05:05:44 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f00000004c0)=ANY=[], 0x208e24b) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r2 = syz_io_uring_setup(0x70c4, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000400000/0xc00000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000000)=0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000180)=@IORING_OP_LINK_TIMEOUT={0xf, 0xa89a1c1bd660819, 0x0, 0x0, 0x0, &(0x7f0000000140)}, 0x0) r5 = dup(r2) syz_io_uring_submit(r3, r4, &(0x7f0000000040)=@IORING_OP_CONNECT={0x10, 0x0, 0x0, r5, 0x0, 0x0}, 0x1) io_uring_enter(r5, 0x0, 0x0, 0x0, 0x0, 0x0) setresgid(0x0, 0x0, 0x0) r6 = socket$nl_xfrm(0x10, 0x3, 0x6) sendfile(r6, r1, 0x0, 0x100000002) 05:05:44 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000003dbf4655fdbf4655f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:05:44 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000004dbf4655fdbf4655f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:05:44 executing program 5: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f00000004c0)=ANY=[], 0x208e24b) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r2 = syz_io_uring_setup(0x70c4, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000400000/0xc00000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000000)=0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000180)=@IORING_OP_LINK_TIMEOUT={0xf, 0xa89a1c1bd660819, 0x0, 0x0, 0x0, &(0x7f0000000140)}, 0x0) r5 = dup(r2) syz_io_uring_submit(r3, r4, &(0x7f0000000040)=@IORING_OP_CONNECT={0x10, 0x0, 0x0, r5, 0x0, 0x0}, 0x1) io_uring_enter(r5, 0x6700, 0x0, 0x0, 0x0, 0x0) r6 = syz_open_dev$tty1(0xc, 0x4, 0x1) r7 = syz_open_procfs(0x0, &(0x7f0000000240)='mountinfo\x00') sendfile(r6, r7, 0x0, 0x800000080004103) ioctl$BTRFS_IOC_QUOTA_RESCAN_WAIT(r6, 0x942e, 0x0) openat$pidfd(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) recvmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000004c80)={0x77359400}) setresgid(0x0, 0x0, 0x0) r8 = socket$nl_xfrm(0x10, 0x3, 0x6) sendfile(r8, r1, 0x0, 0x100000002) 05:05:44 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000005dbf4655fdbf4655f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:05:44 executing program 2: r0 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ftruncate(0xffffffffffffffff, 0x0) lseek(r0, 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000040)) getpgid(0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat2(0xffffffffffffffff, &(0x7f00000001c0)='./bus\x00', 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000100)={'syztnl0\x00', &(0x7f0000000240)={'syztnl1\x00', 0x0, 0x2f, 0x1, 0x0, 0x1, 0x48, @mcast2, @ipv4={'\x00', '\xff\xff', @local}, 0x40, 0x8, 0x1, 0x2}}) r1 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r1, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5, 0x8}, 0x0, 0x0, 0x9, 0x7, 0x7fffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f0000062c40)={0x8000000000, [], 0x0, "00001000"}) r2 = creat(&(0x7f0000000140)='./bus\x00', 0x0) io_setup(0x1, &(0x7f0000000180)=0x0) io_submit(r3, 0x45, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000000000, 0x0, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) fallocate(r0, 0x3, 0x0, 0x100000fe) 05:05:44 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000006dbf4655fdbf4655f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:05:44 executing program 0: r0 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ftruncate(0xffffffffffffffff, 0x0) lseek(r0, 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(0xffffffffffffffff, 0x40086602, &(0x7f0000000040)) perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000100)={'syztnl0\x00', &(0x7f0000000240)={'syztnl1\x00', 0x0, 0x2f, 0x1, 0x5, 0x1, 0x48, @mcast2, @ipv4={'\x00', '\xff\xff', @local}, 0x40, 0x8, 0x1, 0x2}}) r1 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r1, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f0000062c40)={0x8000000000, [], 0x0, "00001000"}) r2 = creat(&(0x7f0000000140)='./bus\x00', 0x0) io_setup(0x1, &(0x7f0000000180)=0x0) io_submit(r3, 0x45, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000000000, 0x0, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) fallocate(r0, 0x3, 0x0, 0x100000fe) 05:05:44 executing program 4: r0 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ftruncate(0xffffffffffffffff, 0x0) lseek(r0, 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(0xffffffffffffffff, 0x40086602, &(0x7f0000000040)) r1 = getpgid(0x0) perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, r1, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000100)={'syztnl0\x00', &(0x7f0000000240)={'syztnl1\x00', 0x0, 0x2f, 0x1, 0x5, 0x1, 0x48, @mcast2, @ipv4={'\x00', '\xff\xff', @local}, 0x40, 0x8, 0x1, 0x2}}) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f0000062c40)={0x8000000000, [], 0x0, "00001000"}) r3 = creat(&(0x7f0000000140)='./bus\x00', 0x0) io_setup(0x1, &(0x7f0000000180)=0x0) io_submit(r4, 0x45, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000000000, 0x0, 0x1, 0x0, r3, &(0x7f0000000000), 0x377140be6b5ef4c7}]) fallocate(r0, 0x3, 0x0, 0x100000fe) 05:05:44 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000007dbf4655fdbf4655f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:05:44 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000008dbf4655fdbf4655f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:05:44 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000009dbf4655fdbf4655f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:05:45 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f00000004c0)=ANY=[], 0x208e24b) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r2 = syz_io_uring_setup(0x70c4, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000400000/0xc00000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000000)=0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000180)=@IORING_OP_LINK_TIMEOUT={0xf, 0xa89a1c1bd660819, 0x0, 0x0, 0x0, &(0x7f0000000140)}, 0x0) r5 = dup(r2) syz_io_uring_submit(r3, r4, &(0x7f0000000040)=@IORING_OP_CONNECT={0x10, 0x0, 0x0, r5, 0x0, 0x0}, 0x1) io_uring_enter(r5, 0x6700, 0x0, 0x0, 0x0, 0x0) setresgid(0x0, 0x0, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) sendfile(0xffffffffffffffff, r1, 0x0, 0x100000002) 05:05:45 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f00000000000000020000000600000000000800008000002000000adbf4655fdbf4655f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:05:45 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f00000000000000020000000600000000000800008000002000000bdbf4655fdbf4655f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:05:45 executing program 5: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f00000004c0)=ANY=[], 0x208e24b) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r2 = syz_io_uring_setup(0x70c4, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000400000/0xc00000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000000)=0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000180)=@IORING_OP_LINK_TIMEOUT={0xf, 0xa89a1c1bd660819, 0x0, 0x0, 0x0, &(0x7f0000000140)}, 0x0) r5 = dup(r2) syz_io_uring_submit(r3, r4, &(0x7f0000000040)=@IORING_OP_CONNECT={0x10, 0x0, 0x0, r5, 0x0, 0x0}, 0x1) io_uring_enter(r5, 0x6700, 0x0, 0x0, 0x0, 0x0) mmap(&(0x7f0000aea000/0x4000)=nil, 0x4000, 0x5, 0x11, r2, 0x9e5b6000) openat$pidfd(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) recvmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000004c80)={0x77359400}) setresgid(0x0, 0x0, 0x0) r6 = socket$nl_xfrm(0x10, 0x3, 0x6) sendfile(r6, r1, 0x0, 0x100000002) 05:05:45 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f00000000000000020000000600000000000800008000002000000cdbf4655fdbf4655f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:05:45 executing program 2: r0 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ftruncate(0xffffffffffffffff, 0x0) lseek(r0, 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000040)) getpgid(0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat2(0xffffffffffffffff, &(0x7f00000001c0)='./bus\x00', 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000100)={'syztnl0\x00', &(0x7f0000000240)={'syztnl1\x00', 0x0, 0x2f, 0x1, 0x0, 0x1, 0x48, @mcast2, @ipv4={'\x00', '\xff\xff', @local}, 0x40, 0x8, 0x1, 0x2}}) r1 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r1, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5, 0x8}, 0x0, 0x0, 0x9, 0x7, 0x7fffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f0000062c40)={0x8000000000, [], 0x0, "00001000"}) r2 = creat(&(0x7f0000000140)='./bus\x00', 0x0) io_setup(0x1, &(0x7f0000000180)=0x0) io_submit(r3, 0x45, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000000000, 0x0, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) fallocate(r0, 0x3, 0x0, 0x100000fe) 05:05:45 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f00000000000000020000000600000000000800008000002000000ddbf4655fdbf4655f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:05:45 executing program 0: r0 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ftruncate(0xffffffffffffffff, 0x0) lseek(r0, 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(0xffffffffffffffff, 0x40086602, &(0x7f0000000040)) perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000100)={'syztnl0\x00', &(0x7f0000000240)={'syztnl1\x00', 0x0, 0x2f, 0x1, 0x5, 0x1, 0x48, @mcast2, @ipv4={'\x00', '\xff\xff', @local}, 0x40, 0x8, 0x1, 0x2}}) r1 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r1, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f0000062c40)={0x8000000000, [], 0x0, "00001000"}) r2 = creat(&(0x7f0000000140)='./bus\x00', 0x0) io_setup(0x1, &(0x7f0000000180)=0x0) io_submit(r3, 0x45, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000000000, 0x0, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) fallocate(r0, 0x3, 0x0, 0x100000fe) [ 2917.076624][ C1] scsi_io_completion_action: 7 callbacks suppressed [ 2917.076652][ C1] sd 0:0:1:0: [sg0] tag#661 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2917.095157][ C1] sd 0:0:1:0: [sg0] tag#661 CDB: opcode=0xe5 (vendor) [ 2917.102139][ C1] sd 0:0:1:0: [sg0] tag#661 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2917.111597][ C1] sd 0:0:1:0: [sg0] tag#661 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2917.112486][ C0] sd 0:0:1:0: [sg0] tag#662 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2917.122310][ C1] sd 0:0:1:0: [sg0] tag#661 CDB[20]: ba [ 2917.133941][ C0] sd 0:0:1:0: [sg0] tag#662 CDB: opcode=0xe5 (vendor) [ 2917.146252][ C0] sd 0:0:1:0: [sg0] tag#662 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2917.156011][ C0] sd 0:0:1:0: [sg0] tag#662 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2917.165682][ C0] sd 0:0:1:0: [sg0] tag#662 CDB[20]: ba 05:05:45 executing program 4: r0 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ftruncate(0xffffffffffffffff, 0x0) lseek(r0, 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(0xffffffffffffffff, 0x40086602, &(0x7f0000000040)) r1 = getpgid(0x0) perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, r1, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000100)={'syztnl0\x00', &(0x7f0000000240)={'syztnl1\x00', 0x0, 0x2f, 0x1, 0x5, 0x1, 0x48, @mcast2, @ipv4={'\x00', '\xff\xff', @local}, 0x40, 0x8, 0x1, 0x2}}) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f0000062c40)={0x8000000000, [], 0x0, "00001000"}) r3 = creat(&(0x7f0000000140)='./bus\x00', 0x0) io_setup(0x1, &(0x7f0000000180)=0x0) io_submit(r4, 0x45, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000000000, 0x0, 0x1, 0x0, r3, &(0x7f0000000000), 0x377140be6b5ef4c7}]) fallocate(r0, 0x3, 0x0, 0x100000fe) 05:05:45 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f00000004c0)=ANY=[], 0x208e24b) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r2 = syz_io_uring_setup(0x70c4, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000400000/0xc00000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000000)=0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000180)=@IORING_OP_LINK_TIMEOUT={0xf, 0xa89a1c1bd660819, 0x0, 0x0, 0x0, &(0x7f0000000140)}, 0x0) r5 = dup(r2) syz_io_uring_submit(r3, r4, &(0x7f0000000040)=@IORING_OP_CONNECT={0x10, 0x0, 0x0, r5, 0x0, 0x0}, 0x1) io_uring_enter(r5, 0x6700, 0x0, 0x0, 0x0, 0x0) setresgid(0x0, 0x0, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) sendfile(0xffffffffffffffff, r1, 0x0, 0x100000002) 05:05:45 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f00000000000000020000000600000000000800008000002000000edbf4655fdbf4655f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:05:46 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f00000000000000020000000600000000000800008000002000000fdbf4655fdbf4655f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) [ 2917.329274][ C0] sd 0:0:1:0: [sg0] tag#675 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2917.339612][ C0] sd 0:0:1:0: [sg0] tag#675 CDB: opcode=0xe5 (vendor) [ 2917.346502][ C0] sd 0:0:1:0: [sg0] tag#675 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2917.356090][ C0] sd 0:0:1:0: [sg0] tag#675 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2917.366188][ C0] sd 0:0:1:0: [sg0] tag#675 CDB[20]: ba 05:05:46 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000010dbf4655fdbf4655f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:05:46 executing program 5: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f00000004c0)=ANY=[], 0x208e24b) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r2 = syz_io_uring_setup(0x70c4, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x3}, &(0x7f0000002000/0x2000)=nil, &(0x7f0000a9a000/0x1000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000000)=0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000180)=@IORING_OP_LINK_TIMEOUT={0xf, 0xa89a1c1bd660819, 0x0, 0x0, 0x0, &(0x7f0000000140)}, 0x0) openat$sysfs(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/module/hid_apple', 0x100, 0x41) r5 = io_uring_register$IORING_REGISTER_PERSONALITY(r2, 0x9, 0x0, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000040)=@IORING_OP_REMOVE_BUFFERS={0x1f, 0x1, 0x0, 0x57b5, 0x0, 0x0, 0x0, 0x0, 0x0, {0x1, r5}}, 0x1) syz_io_uring_submit(0x0, 0x0, &(0x7f00000000c0)=@IORING_OP_REMOVE_BUFFERS={0x1f, 0x0, 0x0, 0x8}, 0x0) syz_io_uring_setup(0x70c4, &(0x7f00000023c0), &(0x7f0000501000/0x3000)=nil, &(0x7f0000935000/0x1000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000380)=0x0) syz_io_uring_submit(r6, r7, &(0x7f00000000c0)=@IORING_OP_REMOVE_BUFFERS={0x1f, 0x0, 0x0, 0x8}, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000300)=@IORING_OP_FADVISE={0x18, 0x4, 0x0, @fd_index=0x5, 0x9, 0x0, 0x1, 0x4, 0x0, {0x0, r5}}, 0x9) io_uring_enter(0xffffffffffffffff, 0x6700, 0x0, 0x0, 0x0, 0x0) openat$pidfd(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) recvmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000004c80)={0x77359400}) setresgid(0x0, 0x0, 0x0) write$tcp_congestion(r1, &(0x7f0000000340)='highspeed\x00', 0xa) r8 = socket$nl_xfrm(0x10, 0x3, 0x6) setxattr$security_evm(&(0x7f0000000200)='./file0\x00', &(0x7f00000002c0), &(0x7f00000003c0)=ANY=[@ANYBLOB="0402dc7dde613048cf9d07f88ec22afac05a1ba4be7631c243258ea90f0750e1ff5c1d57fae8be1755d1487b998d5f329ee6c92367f7907608ea5ab7c4c219963fd57e5a7b0f1d7f1317af8a05853df4983bdea539e3282a63cf453e36e8833c43b1ae66730d9bebfff6a560f3f2f30595efa750272e6c2f379f7bc2527e8900"/142], 0xd, 0x3) sendfile(r8, r1, 0x0, 0x100000002) 05:05:46 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000011dbf4655fdbf4655f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:05:46 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000012dbf4655fdbf4655f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:05:46 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000018dbf4655fdbf4655f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:05:46 executing program 2: r0 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ftruncate(0xffffffffffffffff, 0x0) lseek(r0, 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000040)) getpgid(0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat2(0xffffffffffffffff, &(0x7f00000001c0)='./bus\x00', 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000100)={'syztnl0\x00', &(0x7f0000000240)={'syztnl1\x00', 0x0, 0x2f, 0x1, 0x5, 0x0, 0x48, @mcast2, @ipv4={'\x00', '\xff\xff', @local}, 0x40, 0x8, 0x1, 0x2}}) r1 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r1, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5, 0x8}, 0x0, 0x0, 0x9, 0x7, 0x7fffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f0000062c40)={0x8000000000, [], 0x0, "00001000"}) r2 = creat(&(0x7f0000000140)='./bus\x00', 0x0) io_setup(0x1, &(0x7f0000000180)=0x0) io_submit(r3, 0x45, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000000000, 0x0, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) fallocate(r0, 0x3, 0x0, 0x100000fe) 05:05:46 executing program 0: r0 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ftruncate(0xffffffffffffffff, 0x0) lseek(r0, 0x0, 0x0) perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000100)={'syztnl0\x00', &(0x7f0000000240)={'syztnl1\x00', 0x0, 0x2f, 0x1, 0x5, 0x1, 0x48, @mcast2, @ipv4={'\x00', '\xff\xff', @local}, 0x40, 0x8, 0x1, 0x2}}) r1 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r1, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f0000062c40)={0x8000000000, [], 0x0, "00001000"}) r2 = creat(&(0x7f0000000140)='./bus\x00', 0x0) io_setup(0x1, &(0x7f0000000180)=0x0) io_submit(r3, 0x45, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000000000, 0x0, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) fallocate(r0, 0x3, 0x0, 0x100000fe) 05:05:46 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000019dbf4655fdbf4655f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) [ 2918.079106][ C1] sd 0:0:1:0: [sg0] tag#669 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2918.089517][ C1] sd 0:0:1:0: [sg0] tag#669 CDB: opcode=0xe5 (vendor) [ 2918.096492][ C1] sd 0:0:1:0: [sg0] tag#669 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2918.106069][ C1] sd 0:0:1:0: [sg0] tag#669 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2918.115561][ C1] sd 0:0:1:0: [sg0] tag#669 CDB[20]: ba [ 2918.134142][ C1] sd 0:0:1:0: [sg0] tag#674 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2918.144545][ C1] sd 0:0:1:0: [sg0] tag#674 CDB: opcode=0xe5 (vendor) [ 2918.151386][ C1] sd 0:0:1:0: [sg0] tag#674 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2918.161321][ C1] sd 0:0:1:0: [sg0] tag#674 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2918.170826][ C1] sd 0:0:1:0: [sg0] tag#674 CDB[20]: ba 05:05:46 executing program 4: r0 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ftruncate(0xffffffffffffffff, 0x0) lseek(r0, 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(0xffffffffffffffff, 0x40086602, &(0x7f0000000040)) r1 = getpgid(0x0) perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, r1, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000100)={'syztnl0\x00', &(0x7f0000000240)={'syztnl1\x00', 0x0, 0x2f, 0x1, 0x5, 0x1, 0x48, @mcast2, @ipv4={'\x00', '\xff\xff', @local}, 0x40, 0x8, 0x1, 0x2}}) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f0000062c40)={0x8000000000, [], 0x0, "00001000"}) r3 = creat(&(0x7f0000000140)='./bus\x00', 0x0) io_setup(0x1, &(0x7f0000000180)=0x0) io_submit(r4, 0x45, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000000000, 0x0, 0x1, 0x0, r3, &(0x7f0000000000), 0x377140be6b5ef4c7}]) fallocate(r0, 0x3, 0x0, 0x100000fe) 05:05:46 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f00000004c0)=ANY=[], 0x208e24b) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r2 = syz_io_uring_setup(0x70c4, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000400000/0xc00000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000000)=0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000180)=@IORING_OP_LINK_TIMEOUT={0xf, 0xa89a1c1bd660819, 0x0, 0x0, 0x0, &(0x7f0000000140)}, 0x0) r5 = dup(r2) syz_io_uring_submit(r3, r4, &(0x7f0000000040)=@IORING_OP_CONNECT={0x10, 0x0, 0x0, r5, 0x0, 0x0}, 0x1) io_uring_enter(r5, 0x6700, 0x0, 0x0, 0x0, 0x0) setresgid(0x0, 0x0, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) sendfile(0xffffffffffffffff, r1, 0x0, 0x100000002) 05:05:46 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000022dbf4655fdbf4655f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:05:47 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000025dbf4655fdbf4655f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) [ 2918.302522][ C1] sd 0:0:1:0: [sg0] tag#657 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2918.312950][ C1] sd 0:0:1:0: [sg0] tag#657 CDB: opcode=0xe5 (vendor) [ 2918.319971][ C1] sd 0:0:1:0: [sg0] tag#657 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2918.329696][ C1] sd 0:0:1:0: [sg0] tag#657 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2918.340501][ C1] sd 0:0:1:0: [sg0] tag#657 CDB[20]: ba 05:05:47 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f00000000000000020000000600000000000800008000002000002edbf4655fdbf4655f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:05:47 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000032dbf4655fdbf4655f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:05:47 executing program 5: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f00000004c0)=ANY=[], 0x208e24b) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r2 = pidfd_getfd(r0, r0, 0x0) r3 = syz_io_uring_setup(0x70c4, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x2, 0x0, 0x0, r2}, &(0x7f0000c12000/0x4000)=nil, &(0x7f0000400000/0xc00000)=nil, &(0x7f0000000100)=0x0, &(0x7f00000000c0)=0x0) syz_io_uring_submit(r4, r5, &(0x7f0000000180)=@IORING_OP_LINK_TIMEOUT={0xf, 0xa89a1c1bd660819, 0x0, 0x0, 0x0, &(0x7f0000000140)}, 0x0) r6 = dup(r3) syz_io_uring_submit(r4, r5, &(0x7f0000000040)=@IORING_OP_CONNECT={0x10, 0x0, 0x0, r6, 0x0, 0x0}, 0x1) io_uring_enter(r6, 0x6700, 0x0, 0x0, 0x0, 0x0) openat$pidfd(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) recvmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000004c80)={0x77359400}) setresgid(0x0, 0x0, 0x0) r7 = socket$nl_xfrm(0x10, 0x3, 0x6) sendfile(r7, r1, 0x0, 0x100000002) 05:05:47 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000048dbf4655fdbf4655f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:05:47 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f00000000000000020000000600000000000800008000002000004cdbf4655fdbf4655f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:05:47 executing program 2: r0 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ftruncate(0xffffffffffffffff, 0x0) lseek(r0, 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000040)) getpgid(0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat2(0xffffffffffffffff, &(0x7f00000001c0)='./bus\x00', 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000100)={'syztnl0\x00', &(0x7f0000000240)={'syztnl1\x00', 0x0, 0x2f, 0x1, 0x5, 0x0, 0x48, @mcast2, @ipv4={'\x00', '\xff\xff', @local}, 0x40, 0x8, 0x1, 0x2}}) r1 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r1, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5, 0x8}, 0x0, 0x0, 0x9, 0x7, 0x7fffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f0000062c40)={0x8000000000, [], 0x0, "00001000"}) r2 = creat(&(0x7f0000000140)='./bus\x00', 0x0) io_setup(0x1, &(0x7f0000000180)=0x0) io_submit(r3, 0x45, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000000000, 0x0, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) fallocate(r0, 0x3, 0x0, 0x100000fe) 05:05:47 executing program 0: r0 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ftruncate(0xffffffffffffffff, 0x0) lseek(r0, 0x0, 0x0) perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000100)={'syztnl0\x00', &(0x7f0000000240)={'syztnl1\x00', 0x0, 0x2f, 0x1, 0x5, 0x1, 0x48, @mcast2, @ipv4={'\x00', '\xff\xff', @local}, 0x40, 0x8, 0x1, 0x2}}) r1 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r1, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f0000062c40)={0x8000000000, [], 0x0, "00001000"}) r2 = creat(&(0x7f0000000140)='./bus\x00', 0x0) io_setup(0x1, &(0x7f0000000180)=0x0) io_submit(r3, 0x45, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000000000, 0x0, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) fallocate(r0, 0x3, 0x0, 0x100000fe) 05:05:47 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000060dbf4655fdbf4655f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) [ 2919.074138][ C1] sd 0:0:1:0: [sg0] tag#660 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2919.084432][ C1] sd 0:0:1:0: [sg0] tag#660 CDB: opcode=0xe5 (vendor) [ 2919.091242][ C1] sd 0:0:1:0: [sg0] tag#660 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2919.100861][ C1] sd 0:0:1:0: [sg0] tag#660 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2919.110348][ C1] sd 0:0:1:0: [sg0] tag#660 CDB[20]: ba [ 2919.150205][ C1] sd 0:0:1:0: [sg0] tag#663 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2919.160511][ C1] sd 0:0:1:0: [sg0] tag#663 CDB: opcode=0xe5 (vendor) [ 2919.167287][ C1] sd 0:0:1:0: [sg0] tag#663 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2919.176778][ C1] sd 0:0:1:0: [sg0] tag#663 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2919.186470][ C1] sd 0:0:1:0: [sg0] tag#663 CDB[20]: ba 05:05:47 executing program 4: r0 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ftruncate(0xffffffffffffffff, 0x0) lseek(r0, 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(0xffffffffffffffff, 0x40086602, &(0x7f0000000040)) r1 = getpgid(0x0) perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, r1, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000100)={'syztnl0\x00', &(0x7f0000000240)={'syztnl1\x00', 0x0, 0x2f, 0x1, 0x5, 0x1, 0x48, @mcast2, @ipv4={'\x00', '\xff\xff', @local}, 0x40, 0x8, 0x1, 0x2}}) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f0000062c40)={0x8000000000, [], 0x0, "00001000"}) r3 = creat(&(0x7f0000000140)='./bus\x00', 0x0) io_setup(0x1, &(0x7f0000000180)=0x0) io_submit(r4, 0x45, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000000000, 0x0, 0x1, 0x0, r3, &(0x7f0000000000), 0x377140be6b5ef4c7}]) fallocate(r0, 0x3, 0x0, 0x100000fe) 05:05:47 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f00000004c0)=ANY=[], 0x208e24b) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r1 = syz_io_uring_setup(0x70c4, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000400000/0xc00000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000000)=0x0) syz_io_uring_submit(r2, r3, &(0x7f0000000180)=@IORING_OP_LINK_TIMEOUT={0xf, 0xa89a1c1bd660819, 0x0, 0x0, 0x0, &(0x7f0000000140)}, 0x0) r4 = dup(r1) syz_io_uring_submit(r2, r3, &(0x7f0000000040)=@IORING_OP_CONNECT={0x10, 0x0, 0x0, r4, 0x0, 0x0}, 0x1) io_uring_enter(r4, 0x6700, 0x0, 0x0, 0x0, 0x0) setresgid(0x0, 0x0, 0x0) r5 = socket$nl_xfrm(0x10, 0x3, 0x6) sendfile(r5, 0xffffffffffffffff, 0x0, 0x100000002) 05:05:47 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000068dbf4655fdbf4655f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:05:48 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f00000000000000020000000600000000000800008000002000006cdbf4655fdbf4655f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) [ 2919.293626][ C1] sd 0:0:1:0: [sg0] tag#686 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2919.304128][ C1] sd 0:0:1:0: [sg0] tag#686 CDB: opcode=0xe5 (vendor) [ 2919.310921][ C1] sd 0:0:1:0: [sg0] tag#686 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2919.320409][ C1] sd 0:0:1:0: [sg0] tag#686 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2919.330242][ C1] sd 0:0:1:0: [sg0] tag#686 CDB[20]: ba 05:05:48 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000074dbf4655fdbf4655f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:05:48 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f00000000000000020000000600000000000800008000002000007adbf4655fdbf4655f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:05:48 executing program 5: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f00000004c0)=ANY=[], 0x208e24b) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r2 = syz_io_uring_setup(0x70c4, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x2, 0x0, 0x0, r1}, &(0x7f0000002000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000000)=0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000180)=@IORING_OP_LINK_TIMEOUT={0xf, 0xa89a1c1bd660819, 0x0, 0x0, 0x0, &(0x7f0000000140)}, 0x0) r5 = dup(r2) syz_io_uring_submit(r3, r4, &(0x7f0000000040)=@IORING_OP_CONNECT={0x10, 0x0, 0x0, r5, 0x0, 0x0}, 0x1) io_uring_enter(r5, 0x6700, 0x0, 0x0, 0x0, 0x0) openat$pidfd(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) epoll_ctl$EPOLL_CTL_MOD(r0, 0x3, r1, &(0x7f00000000c0)={0x2000}) recvmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000004c80)={0x77359400}) setresgid(0x0, 0x0, 0x0) r6 = socket$nl_xfrm(0x10, 0x3, 0x6) sendfile(r6, r1, 0x0, 0x100000002) 05:05:48 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f0000000000000002000000060000000000080000800000200000fedbf4655fdbf4655f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:05:48 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4095fdbf4655f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:05:48 executing program 2: r0 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ftruncate(0xffffffffffffffff, 0x0) lseek(r0, 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000040)) getpgid(0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat2(0xffffffffffffffff, &(0x7f00000001c0)='./bus\x00', 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000100)={'syztnl0\x00', &(0x7f0000000240)={'syztnl1\x00', 0x0, 0x2f, 0x1, 0x5, 0x0, 0x48, @mcast2, @ipv4={'\x00', '\xff\xff', @local}, 0x40, 0x8, 0x1, 0x2}}) r1 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r1, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5, 0x8}, 0x0, 0x0, 0x9, 0x7, 0x7fffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f0000062c40)={0x8000000000, [], 0x0, "00001000"}) r2 = creat(&(0x7f0000000140)='./bus\x00', 0x0) io_setup(0x1, &(0x7f0000000180)=0x0) io_submit(r3, 0x45, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000000000, 0x0, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) fallocate(r0, 0x3, 0x0, 0x100000fe) 05:05:48 executing program 0: r0 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ftruncate(0xffffffffffffffff, 0x0) lseek(r0, 0x0, 0x0) perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000100)={'syztnl0\x00', &(0x7f0000000240)={'syztnl1\x00', 0x0, 0x2f, 0x1, 0x5, 0x1, 0x48, @mcast2, @ipv4={'\x00', '\xff\xff', @local}, 0x40, 0x8, 0x1, 0x2}}) r1 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r1, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f0000062c40)={0x8000000000, [], 0x0, "00001000"}) r2 = creat(&(0x7f0000000140)='./bus\x00', 0x0) io_setup(0x1, &(0x7f0000000180)=0x0) io_submit(r3, 0x45, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000000000, 0x0, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) fallocate(r0, 0x3, 0x0, 0x100000fe) 05:05:48 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf40a5fdbf4655f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) [ 2920.083735][ C0] sd 0:0:1:0: [sg0] tag#650 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2920.094394][ C0] sd 0:0:1:0: [sg0] tag#650 CDB: opcode=0xe5 (vendor) [ 2920.101253][ C0] sd 0:0:1:0: [sg0] tag#650 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2920.110729][ C0] sd 0:0:1:0: [sg0] tag#650 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2920.120199][ C0] sd 0:0:1:0: [sg0] tag#650 CDB[20]: ba 05:05:48 executing program 4: r0 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ftruncate(0xffffffffffffffff, 0x0) lseek(r0, 0x0, 0x0) perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000100)={'syztnl0\x00', &(0x7f0000000240)={'syztnl1\x00', 0x0, 0x2f, 0x1, 0x5, 0x1, 0x48, @mcast2, @ipv4={'\x00', '\xff\xff', @local}, 0x40, 0x8, 0x1, 0x2}}) r1 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r1, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f0000062c40)={0x8000000000, [], 0x0, "00001000"}) r2 = creat(&(0x7f0000000140)='./bus\x00', 0x0) io_setup(0x1, &(0x7f0000000180)=0x0) io_submit(r3, 0x45, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000000000, 0x0, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) fallocate(r0, 0x3, 0x0, 0x100000fe) 05:05:48 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f00000004c0)=ANY=[], 0x208e24b) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r1 = syz_io_uring_setup(0x70c4, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000400000/0xc00000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000000)=0x0) syz_io_uring_submit(r2, r3, &(0x7f0000000180)=@IORING_OP_LINK_TIMEOUT={0xf, 0xa89a1c1bd660819, 0x0, 0x0, 0x0, &(0x7f0000000140)}, 0x0) r4 = dup(r1) syz_io_uring_submit(r2, r3, &(0x7f0000000040)=@IORING_OP_CONNECT={0x10, 0x0, 0x0, r4, 0x0, 0x0}, 0x1) io_uring_enter(r4, 0x6700, 0x0, 0x0, 0x0, 0x0) setresgid(0x0, 0x0, 0x0) r5 = socket$nl_xfrm(0x10, 0x3, 0x6) sendfile(r5, 0xffffffffffffffff, 0x0, 0x100000002) 05:05:48 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4225fdbf4655f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:05:48 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4255fdbf4655f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:05:49 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf42c5fdbf4655f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:05:49 executing program 5: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f00000004c0)=ANY=[], 0x208e24b) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) ioctl$SG_SET_RESERVED_SIZE(r0, 0x2275, &(0x7f0000000380)=0x4) r2 = syz_io_uring_setup(0x70c4, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000400000/0xc00000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000000)=0x0) mmap(&(0x7f0000c9d000/0x1000)=nil, 0x1000, 0x3, 0x10010, r2, 0x1913c000) syz_io_uring_submit(r3, r4, &(0x7f0000000180)=@IORING_OP_LINK_TIMEOUT={0xf, 0xa89a1c1bd660819, 0x0, 0x0, 0x0, &(0x7f0000000140)}, 0x0) r5 = dup(r2) syz_io_uring_submit(r3, r4, &(0x7f0000000040)=@IORING_OP_CONNECT={0x10, 0x4, 0x0, r5, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x1) r6 = syz_open_dev$vcsa(&(0x7f00000000c0), 0x2, 0x40400) syz_io_uring_setup(0x310, &(0x7f00000002c0)={0x0, 0x1385, 0x1, 0x0, 0x2da, 0x0, r6}, &(0x7f00006d6000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000200), &(0x7f0000000340)) io_uring_enter(r5, 0x6700, 0x0, 0x0, 0x0, 0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f00000003c0), 0xa040, 0x0) openat$pidfd(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) recvmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000004c80)={0x77359400}) setresgid(0x0, 0x0, 0x0) r7 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x4000000, 0x50, r2, 0x0) syz_io_uring_submit(r7, 0x0, &(0x7f0000000400)=@IORING_OP_READ_FIXED={0x4, 0x1, 0x2000, @fd=r5, 0x1000, 0x400, 0x7, 0x1d}, 0xfffffffc) r8 = socket$nl_xfrm(0x10, 0x3, 0x6) sendfile(r8, r1, 0x0, 0x100000002) 05:05:49 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4795fdbf4655f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:05:49 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4095f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:05:49 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf40a5f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:05:49 executing program 2: r0 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ftruncate(0xffffffffffffffff, 0x0) lseek(r0, 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000040)) getpgid(0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat2(0xffffffffffffffff, &(0x7f00000001c0)='./bus\x00', 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000100)={'syztnl0\x00', &(0x7f0000000240)={'syztnl1\x00', 0x0, 0x2f, 0x1, 0x5, 0x1, 0x0, @mcast2, @ipv4={'\x00', '\xff\xff', @local}, 0x40, 0x8, 0x1, 0x2}}) r1 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r1, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5, 0x8}, 0x0, 0x0, 0x9, 0x7, 0x7fffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f0000062c40)={0x8000000000, [], 0x0, "00001000"}) r2 = creat(&(0x7f0000000140)='./bus\x00', 0x0) io_setup(0x1, &(0x7f0000000180)=0x0) io_submit(r3, 0x45, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000000000, 0x0, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) fallocate(r0, 0x3, 0x0, 0x100000fe) 05:05:49 executing program 0: r0 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ftruncate(0xffffffffffffffff, 0x0) ioctl$FS_IOC_SETFLAGS(0xffffffffffffffff, 0x40086602, &(0x7f0000000040)) perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000100)={'syztnl0\x00', &(0x7f0000000240)={'syztnl1\x00', 0x0, 0x2f, 0x1, 0x5, 0x1, 0x48, @mcast2, @ipv4={'\x00', '\xff\xff', @local}, 0x40, 0x8, 0x1, 0x2}}) r1 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r1, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f0000062c40)={0x8000000000, [], 0x0, "00001000"}) r2 = creat(&(0x7f0000000140)='./bus\x00', 0x0) io_setup(0x1, &(0x7f0000000180)=0x0) io_submit(r3, 0x45, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000000000, 0x0, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) fallocate(r0, 0x3, 0x0, 0x100000fe) 05:05:49 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4225f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:05:49 executing program 4: r0 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ftruncate(0xffffffffffffffff, 0x0) lseek(r0, 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000040)) getpgid(0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat2(0xffffffffffffffff, &(0x7f00000001c0)='./bus\x00', 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000100)={'syztnl0\x00', &(0x7f0000000240)={'syztnl1\x00', 0x0, 0x2f, 0x1, 0x5, 0x0, 0x48, @mcast2, @ipv4={'\x00', '\xff\xff', @local}, 0x40, 0x8, 0x1, 0x2}}) r1 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r1, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5, 0x8}, 0x0, 0x0, 0x9, 0x7, 0x7fffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f0000062c40)={0x8000000000, [], 0x0, "00001000"}) r2 = creat(&(0x7f0000000140)='./bus\x00', 0x0) io_setup(0x1, &(0x7f0000000180)=0x0) io_submit(r3, 0x45, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000000000, 0x0, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) fallocate(r0, 0x3, 0x0, 0x100000fe) 05:05:49 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f00000004c0)=ANY=[], 0x208e24b) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r1 = syz_io_uring_setup(0x70c4, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000400000/0xc00000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000000)=0x0) syz_io_uring_submit(r2, r3, &(0x7f0000000180)=@IORING_OP_LINK_TIMEOUT={0xf, 0xa89a1c1bd660819, 0x0, 0x0, 0x0, &(0x7f0000000140)}, 0x0) r4 = dup(r1) syz_io_uring_submit(r2, r3, &(0x7f0000000040)=@IORING_OP_CONNECT={0x10, 0x0, 0x0, r4, 0x0, 0x0}, 0x1) io_uring_enter(r4, 0x6700, 0x0, 0x0, 0x0, 0x0) setresgid(0x0, 0x0, 0x0) r5 = socket$nl_xfrm(0x10, 0x3, 0x6) sendfile(r5, 0xffffffffffffffff, 0x0, 0x100000002) 05:05:49 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4255f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:05:49 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf42c5f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:05:50 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4795f0100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:05:50 executing program 5: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f00000004c0)=ANY=[], 0x208e24b) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r2 = syz_io_uring_setup(0x70c4, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000400000/0xc00000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000000)=0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000180)=@IORING_OP_LINK_TIMEOUT={0xf, 0xa89a1c1bd660819, 0x0, 0x0, 0x0, &(0x7f0000000140)}, 0x0) r5 = dup(r2) r6 = openat$vcsa(0xffffffffffffff9c, &(0x7f00000000c0), 0x608440, 0x0) preadv(r6, &(0x7f0000000580)=[{&(0x7f00000002c0)=""/232, 0xe8}, {&(0x7f00000003c0)=""/80, 0x50}, {&(0x7f0000000440)=""/107, 0x6b}, {&(0x7f00000004c0)=""/85, 0x55}, {&(0x7f0000000200)=""/8, 0x8}, {&(0x7f0000000540)=""/35, 0x23}], 0x6, 0x6, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000040)=@IORING_OP_CONNECT={0x10, 0x0, 0x0, r5, 0x0, 0x0}, 0x1) io_uring_enter(r5, 0x6700, 0x0, 0x0, 0x0, 0x0) openat$pidfd(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) recvmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000004c80)={0x77359400}) setresgid(0x0, 0x0, 0x0) r7 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_io_uring_submit(0x0, 0x0, &(0x7f00000000c0)=@IORING_OP_REMOVE_BUFFERS={0x1f, 0x0, 0x0, 0x8}, 0x0) r8 = syz_open_dev$tty1(0xc, 0x4, 0x1) r9 = syz_open_procfs(0x0, &(0x7f0000000240)='mountinfo\x00') sendfile(r8, r9, 0x0, 0x800000080004103) syz_io_uring_submit(0x0, r4, &(0x7f0000000600)=@IORING_OP_TEE={0x21, 0x4, 0x0, @fd_index=0x3, 0x0, 0x0, 0x1, 0x1, 0x1, {0x0, 0x0, r7}}, 0xffff8000) sendfile(r7, r1, 0x0, 0x100000002) 05:05:50 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0200ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:05:50 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0300ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:05:50 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0400ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:05:50 executing program 2: r0 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ftruncate(0xffffffffffffffff, 0x0) lseek(r0, 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000040)) getpgid(0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat2(0xffffffffffffffff, &(0x7f00000001c0)='./bus\x00', 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000100)={'syztnl0\x00', &(0x7f0000000240)={'syztnl1\x00', 0x0, 0x2f, 0x1, 0x5, 0x1, 0x0, @mcast2, @ipv4={'\x00', '\xff\xff', @local}, 0x40, 0x8, 0x1, 0x2}}) r1 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r1, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5, 0x8}, 0x0, 0x0, 0x9, 0x7, 0x7fffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f0000062c40)={0x8000000000, [], 0x0, "00001000"}) r2 = creat(&(0x7f0000000140)='./bus\x00', 0x0) io_setup(0x1, &(0x7f0000000180)=0x0) io_submit(r3, 0x45, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000000000, 0x0, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) fallocate(r0, 0x3, 0x0, 0x100000fe) [ 2922.114007][ C1] scsi_io_completion_action: 5 callbacks suppressed [ 2922.114050][ C1] sd 0:0:1:0: [sg0] tag#656 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2922.131719][ C1] sd 0:0:1:0: [sg0] tag#656 CDB: opcode=0xe5 (vendor) [ 2922.138478][ C1] sd 0:0:1:0: [sg0] tag#656 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2922.148152][ C1] sd 0:0:1:0: [sg0] tag#656 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2922.157712][ C1] sd 0:0:1:0: [sg0] tag#656 CDB[20]: ba 05:05:50 executing program 0: r0 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ftruncate(0xffffffffffffffff, 0x0) ioctl$FS_IOC_SETFLAGS(0xffffffffffffffff, 0x40086602, &(0x7f0000000040)) perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000100)={'syztnl0\x00', &(0x7f0000000240)={'syztnl1\x00', 0x0, 0x2f, 0x1, 0x5, 0x1, 0x48, @mcast2, @ipv4={'\x00', '\xff\xff', @local}, 0x40, 0x8, 0x1, 0x2}}) r1 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r1, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f0000062c40)={0x8000000000, [], 0x0, "00001000"}) r2 = creat(&(0x7f0000000140)='./bus\x00', 0x0) io_setup(0x1, &(0x7f0000000180)=0x0) io_submit(r3, 0x45, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000000000, 0x0, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) fallocate(r0, 0x3, 0x0, 0x100000fe) 05:05:50 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0500ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) [ 2922.291028][ C1] sd 0:0:1:0: [sg0] tag#693 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2922.301456][ C1] sd 0:0:1:0: [sg0] tag#693 CDB: opcode=0xe5 (vendor) [ 2922.308315][ C1] sd 0:0:1:0: [sg0] tag#693 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2922.317829][ C1] sd 0:0:1:0: [sg0] tag#693 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2922.327501][ C1] sd 0:0:1:0: [sg0] tag#693 CDB[20]: ba 05:05:51 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f00000004c0)=ANY=[], 0x208e24b) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r2 = syz_io_uring_setup(0x70c4, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000400000/0xc00000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000000)=0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000180)=@IORING_OP_LINK_TIMEOUT={0xf, 0xa89a1c1bd660819, 0x0, 0x0, 0x0, &(0x7f0000000140)}, 0x0) r5 = dup(r2) syz_io_uring_submit(r3, r4, &(0x7f0000000040)=@IORING_OP_CONNECT={0x10, 0x0, 0x0, r5, 0x0, 0x0}, 0x1) io_uring_enter(r5, 0x6700, 0x0, 0x0, 0x0, 0x0) setresgid(0x0, 0x0, 0x0) r6 = socket$nl_xfrm(0x10, 0x3, 0x6) sendfile(r6, r1, 0x0, 0x0) 05:05:51 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0600ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:05:51 executing program 4: r0 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ftruncate(0xffffffffffffffff, 0x0) lseek(r0, 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(0xffffffffffffffff, 0x40086602, &(0x7f0000000040)) perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000100)={'syztnl0\x00', &(0x7f0000000240)={'syztnl1\x00', 0x0, 0x2f, 0x1, 0x5, 0x1, 0x48, @mcast2, @ipv4={'\x00', '\xff\xff', @local}, 0x40, 0x8, 0x1, 0x2}}) r1 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r1, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f0000062c40)={0x8000000000, [], 0x0, "00001000"}) r2 = creat(&(0x7f0000000140)='./bus\x00', 0x0) io_setup(0x1, &(0x7f0000000180)=0x0) io_submit(r3, 0x45, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000000000, 0x0, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) fallocate(r0, 0x3, 0x0, 0x100000fe) 05:05:51 executing program 5: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f00000004c0)=ANY=[], 0x208e24b) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r2 = syz_io_uring_setup(0x70c4, &(0x7f0000000240), &(0x7f0000a3f000/0x4000)=nil, &(0x7f0000400000/0xc00000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000000)=0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000180)=@IORING_OP_LINK_TIMEOUT={0xf, 0xa89a1c1bd660819, 0x0, 0x0, 0x0, &(0x7f0000000140)}, 0x0) r5 = dup(r2) syz_io_uring_submit(r3, r4, &(0x7f0000000040)=@IORING_OP_CONNECT={0x10, 0x0, 0x0, r5, 0x0, 0x0}, 0x1) io_uring_enter(r5, 0x6700, 0x0, 0x0, 0x0, 0x0) r6 = syz_open_dev$tty1(0xc, 0x4, 0x1) r7 = syz_open_procfs(0x0, &(0x7f0000000240)='mountinfo\x00') sendfile(r6, r7, 0x0, 0x800000080004103) r8 = syz_open_dev$tty1(0xc, 0x4, 0x1) r9 = syz_open_procfs(0x0, &(0x7f0000000240)='mountinfo\x00') sendfile(r8, r9, 0x0, 0x800000080004103) copy_file_range(r7, &(0x7f00000000c0)=0xec, r9, &(0x7f0000000200)=0x1, 0x2, 0x0) openat$pidfd(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) recvmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000004c80)={0x77359400}) setresgid(0x0, 0x0, 0x0) r10 = socket$nl_xfrm(0x10, 0x3, 0x6) sendfile(r10, r1, 0x0, 0x100000002) [ 2922.459319][ C1] sd 0:0:1:0: [sg0] tag#644 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2922.469670][ C1] sd 0:0:1:0: [sg0] tag#644 CDB: opcode=0xe5 (vendor) [ 2922.476550][ C1] sd 0:0:1:0: [sg0] tag#644 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2922.486041][ C1] sd 0:0:1:0: [sg0] tag#644 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2922.495522][ C1] sd 0:0:1:0: [sg0] tag#644 CDB[20]: ba 05:05:51 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0700ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:05:51 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0800ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:05:51 executing program 2: r0 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ftruncate(0xffffffffffffffff, 0x0) lseek(r0, 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000040)) getpgid(0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat2(0xffffffffffffffff, &(0x7f00000001c0)='./bus\x00', 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000100)={'syztnl0\x00', &(0x7f0000000240)={'syztnl1\x00', 0x0, 0x2f, 0x1, 0x5, 0x1, 0x0, @mcast2, @ipv4={'\x00', '\xff\xff', @local}, 0x40, 0x8, 0x1, 0x2}}) r1 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r1, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5, 0x8}, 0x0, 0x0, 0x9, 0x7, 0x7fffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f0000062c40)={0x8000000000, [], 0x0, "00001000"}) r2 = creat(&(0x7f0000000140)='./bus\x00', 0x0) io_setup(0x1, &(0x7f0000000180)=0x0) io_submit(r3, 0x45, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000000000, 0x0, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) fallocate(r0, 0x3, 0x0, 0x100000fe) 05:05:51 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0900ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) [ 2922.730020][ C0] sd 0:0:1:0: [sg0] tag#652 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2922.740425][ C0] sd 0:0:1:0: [sg0] tag#652 CDB: opcode=0xe5 (vendor) [ 2922.747219][ C0] sd 0:0:1:0: [sg0] tag#652 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2922.756803][ C0] sd 0:0:1:0: [sg0] tag#652 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2922.766383][ C0] sd 0:0:1:0: [sg0] tag#652 CDB[20]: ba 05:05:51 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0a00ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:05:51 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0b00ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:05:51 executing program 0: r0 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ftruncate(0xffffffffffffffff, 0x0) ioctl$FS_IOC_SETFLAGS(0xffffffffffffffff, 0x40086602, &(0x7f0000000040)) perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000100)={'syztnl0\x00', &(0x7f0000000240)={'syztnl1\x00', 0x0, 0x2f, 0x1, 0x5, 0x1, 0x48, @mcast2, @ipv4={'\x00', '\xff\xff', @local}, 0x40, 0x8, 0x1, 0x2}}) r1 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r1, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f0000062c40)={0x8000000000, [], 0x0, "00001000"}) r2 = creat(&(0x7f0000000140)='./bus\x00', 0x0) io_setup(0x1, &(0x7f0000000180)=0x0) io_submit(r3, 0x45, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000000000, 0x0, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) fallocate(r0, 0x3, 0x0, 0x100000fe) 05:05:51 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0c00ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:05:51 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f00000004c0)=ANY=[], 0x208e24b) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r2 = syz_io_uring_setup(0x70c4, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000400000/0xc00000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000000)=0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000180)=@IORING_OP_LINK_TIMEOUT={0xf, 0xa89a1c1bd660819, 0x0, 0x0, 0x0, &(0x7f0000000140)}, 0x0) r5 = dup(r2) syz_io_uring_submit(r3, r4, &(0x7f0000000040)=@IORING_OP_CONNECT={0x10, 0x0, 0x0, r5, 0x0, 0x0}, 0x1) io_uring_enter(r5, 0x6700, 0x0, 0x0, 0x0, 0x0) setresgid(0x0, 0x0, 0x0) r6 = socket$nl_xfrm(0x10, 0x3, 0x6) sendfile(r6, r1, 0x0, 0x0) 05:05:51 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0d00ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) [ 2923.304961][ C0] sd 0:0:1:0: [sg0] tag#682 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2923.315261][ C0] sd 0:0:1:0: [sg0] tag#682 CDB: opcode=0xe5 (vendor) [ 2923.322032][ C0] sd 0:0:1:0: [sg0] tag#682 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2923.331606][ C0] sd 0:0:1:0: [sg0] tag#682 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2923.341104][ C0] sd 0:0:1:0: [sg0] tag#682 CDB[20]: ba 05:05:52 executing program 4: r0 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ftruncate(0xffffffffffffffff, 0x0) lseek(r0, 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(0xffffffffffffffff, 0x40086602, &(0x7f0000000040)) perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000100)={'syztnl0\x00', &(0x7f0000000240)={'syztnl1\x00', 0x0, 0x2f, 0x1, 0x5, 0x1, 0x48, @mcast2, @ipv4={'\x00', '\xff\xff', @local}, 0x40, 0x8, 0x1, 0x2}}) r1 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r1, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f0000062c40)={0x8000000000, [], 0x0, "00001000"}) r2 = creat(&(0x7f0000000140)='./bus\x00', 0x0) io_setup(0x1, &(0x7f0000000180)=0x0) io_submit(r3, 0x45, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000000000, 0x0, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) fallocate(r0, 0x3, 0x0, 0x100000fe) 05:05:52 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0e00ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:05:52 executing program 5: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f00000004c0)=ANY=[], 0x208e24b) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r2 = syz_io_uring_setup(0x70c4, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x1}, &(0x7f0000002000/0x2000)=nil, &(0x7f0000400000/0xc00000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000000)=0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000180)=@IORING_OP_LINK_TIMEOUT={0xf, 0xa89a1c1bd660819, 0x0, 0x0, 0x0, &(0x7f0000000140)}, 0x0) r5 = dup(r2) syz_io_uring_submit(r3, r4, &(0x7f0000000040)=@IORING_OP_CONNECT={0x10, 0x0, 0x0, r5, 0x0, 0x0}, 0x1) io_uring_enter(r5, 0x6700, 0x0, 0x0, 0x0, 0x0) openat$pidfd(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) recvmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000004c80)={0x77359400}) setresgid(0x0, 0x0, 0x0) r6 = socket$nl_xfrm(0x10, 0x3, 0x6) sendfile(r6, r1, 0x0, 0x100000002) [ 2923.620142][ C1] sd 0:0:1:0: [sg0] tag#685 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2923.630510][ C1] sd 0:0:1:0: [sg0] tag#685 CDB: opcode=0xe5 (vendor) [ 2923.637339][ C1] sd 0:0:1:0: [sg0] tag#685 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2923.646830][ C1] sd 0:0:1:0: [sg0] tag#685 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2923.656323][ C1] sd 0:0:1:0: [sg0] tag#685 CDB[20]: ba 05:05:52 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0f00ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:05:52 executing program 2: r0 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ftruncate(0xffffffffffffffff, 0x0) lseek(r0, 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000040)) getpgid(0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat2(0xffffffffffffffff, &(0x7f00000001c0)='./bus\x00', 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000100)={'syztnl0\x00', &(0x7f0000000240)={'syztnl1\x00', 0x0, 0x2f, 0x1, 0x5, 0x1, 0x48, @mcast2, @ipv4={'\x00', '\xff\xff', @local}, 0x0, 0x8, 0x1, 0x2}}) r1 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r1, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5, 0x8}, 0x0, 0x0, 0x9, 0x7, 0x7fffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f0000062c40)={0x8000000000, [], 0x0, "00001000"}) r2 = creat(&(0x7f0000000140)='./bus\x00', 0x0) io_setup(0x1, &(0x7f0000000180)=0x0) io_submit(r3, 0x45, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000000000, 0x0, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) fallocate(r0, 0x3, 0x0, 0x100000fe) 05:05:52 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f00000004c0)=ANY=[], 0x208e24b) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r2 = syz_io_uring_setup(0x70c4, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000400000/0xc00000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000000)=0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000180)=@IORING_OP_LINK_TIMEOUT={0xf, 0xa89a1c1bd660819, 0x0, 0x0, 0x0, &(0x7f0000000140)}, 0x0) r5 = dup(r2) syz_io_uring_submit(r3, r4, &(0x7f0000000040)=@IORING_OP_CONNECT={0x10, 0x0, 0x0, r5, 0x0, 0x0}, 0x1) io_uring_enter(r5, 0x6700, 0x0, 0x0, 0x0, 0x0) setresgid(0x0, 0x0, 0x0) r6 = socket$nl_xfrm(0x10, 0x3, 0x6) sendfile(r6, r1, 0x0, 0x0) 05:05:52 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f1000ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) [ 2923.796364][ C1] sd 0:0:1:0: [sg0] tag#693 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2923.806683][ C1] sd 0:0:1:0: [sg0] tag#693 CDB: opcode=0xe5 (vendor) [ 2923.813480][ C1] sd 0:0:1:0: [sg0] tag#693 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2923.823256][ C1] sd 0:0:1:0: [sg0] tag#693 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2923.833436][ C1] sd 0:0:1:0: [sg0] tag#693 CDB[20]: ba 05:05:52 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f1100ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:05:52 executing program 0: r0 = creat(&(0x7f0000000080)='./bus\x00', 0x0) lseek(r0, 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(0xffffffffffffffff, 0x40086602, &(0x7f0000000040)) perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000100)={'syztnl0\x00', &(0x7f0000000240)={'syztnl1\x00', 0x0, 0x2f, 0x1, 0x5, 0x1, 0x48, @mcast2, @ipv4={'\x00', '\xff\xff', @local}, 0x40, 0x8, 0x1, 0x2}}) r1 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r1, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f0000062c40)={0x8000000000, [], 0x0, "00001000"}) r2 = creat(&(0x7f0000000140)='./bus\x00', 0x0) io_setup(0x1, &(0x7f0000000180)=0x0) io_submit(r3, 0x45, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000000000, 0x0, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) fallocate(r0, 0x3, 0x0, 0x100000fe) 05:05:52 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f1400ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:05:52 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f2e00ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) [ 2924.321866][ C1] sd 0:0:1:0: [sg0] tag#657 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2924.332193][ C1] sd 0:0:1:0: [sg0] tag#657 CDB: opcode=0xe5 (vendor) [ 2924.339244][ C1] sd 0:0:1:0: [sg0] tag#657 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2924.349259][ C1] sd 0:0:1:0: [sg0] tag#657 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2924.358828][ C1] sd 0:0:1:0: [sg0] tag#657 CDB[20]: ba 05:05:53 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f3300ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:05:53 executing program 4: r0 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ftruncate(0xffffffffffffffff, 0x0) lseek(r0, 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(0xffffffffffffffff, 0x40086602, &(0x7f0000000040)) perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000100)={'syztnl0\x00', &(0x7f0000000240)={'syztnl1\x00', 0x0, 0x2f, 0x1, 0x5, 0x1, 0x48, @mcast2, @ipv4={'\x00', '\xff\xff', @local}, 0x40, 0x8, 0x1, 0x2}}) r1 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r1, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f0000062c40)={0x8000000000, [], 0x0, "00001000"}) r2 = creat(&(0x7f0000000140)='./bus\x00', 0x0) io_setup(0x1, &(0x7f0000000180)=0x0) io_submit(r3, 0x45, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000000000, 0x0, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) fallocate(r0, 0x3, 0x0, 0x100000fe) 05:05:53 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f4b00ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:05:53 executing program 1: r0 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ftruncate(0xffffffffffffffff, 0x0) lseek(r0, 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000040)) getpgid(0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat2(0xffffffffffffffff, &(0x7f00000001c0)='./bus\x00', 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000100)={'syztnl0\x00', &(0x7f0000000240)={'syztnl1\x00', 0x0, 0x2f, 0x1, 0x5, 0x1, 0x0, @mcast2, @ipv4={'\x00', '\xff\xff', @local}, 0x40, 0x8, 0x1, 0x2}}) r1 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r1, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5, 0x8}, 0x0, 0x0, 0x9, 0x7, 0x7fffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f0000062c40)={0x8000000000, [], 0x0, "00001000"}) r2 = creat(&(0x7f0000000140)='./bus\x00', 0x0) io_setup(0x1, &(0x7f0000000180)=0x0) io_submit(r3, 0x45, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000000000, 0x0, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) fallocate(r0, 0x3, 0x0, 0x100000fe) 05:05:53 executing program 5: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f00000004c0)=ANY=[], 0x208e24b) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r2 = syz_io_uring_setup(0x70c4, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000400000/0xc00000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000000)=0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000180)=@IORING_OP_LINK_TIMEOUT={0xf, 0xa89a1c1bd660819, 0x0, 0x0, 0x0, &(0x7f0000000140)}, 0x0) r5 = dup(r2) r6 = syz_open_dev$vcsa(&(0x7f00000000c0), 0x4, 0x400800) ioctl$sock_SIOCBRADDBR(r6, 0x89a0, &(0x7f0000000200)='ip6_vti0\x00') syz_io_uring_submit(r3, r4, &(0x7f0000000040)=@IORING_OP_CONNECT={0x10, 0x0, 0x0, r5, 0x0, 0x0}, 0x1) io_uring_enter(r5, 0x6700, 0x0, 0x0, 0x0, 0x0) openat$pidfd(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) recvmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000004c80)={0x77359400}) setresgid(0x0, 0x0, 0x0) r7 = socket$nl_xfrm(0x10, 0x3, 0x6) sendfile(r7, r1, 0x0, 0x100000002) r8 = io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) io_uring_register$IORING_UNREGISTER_PERSONALITY(0xffffffffffffffff, 0xa, 0x0, r8) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000340)=@IORING_OP_POLL_ADD={0x6, 0x4, 0x0, @fd, 0x0, 0x0, 0x0, {0x400}, 0x0, {0x0, r8}}, 0x900) r9 = signalfd(r5, &(0x7f00000002c0)={[0x6]}, 0x8) openat$cgroup_ro(r9, &(0x7f0000000300)='cpuacct.usage_sys\x00', 0x0, 0x0) [ 2924.719418][ C0] sd 0:0:1:0: [sg0] tag#702 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2924.729716][ C0] sd 0:0:1:0: [sg0] tag#702 CDB: opcode=0xe5 (vendor) [ 2924.736499][ C0] sd 0:0:1:0: [sg0] tag#702 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2924.746602][ C0] sd 0:0:1:0: [sg0] tag#702 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2924.756088][ C0] sd 0:0:1:0: [sg0] tag#702 CDB[20]: ba [ 2924.815225][ C0] sd 0:0:1:0: [sg0] tag#640 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2924.826315][ C0] sd 0:0:1:0: [sg0] tag#640 CDB: opcode=0xe5 (vendor) [ 2924.833181][ C0] sd 0:0:1:0: [sg0] tag#640 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2924.842691][ C0] sd 0:0:1:0: [sg0] tag#640 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2924.852172][ C0] sd 0:0:1:0: [sg0] tag#640 CDB[20]: ba 05:05:53 executing program 2: r0 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ftruncate(0xffffffffffffffff, 0x0) lseek(r0, 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000040)) getpgid(0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat2(0xffffffffffffffff, &(0x7f00000001c0)='./bus\x00', 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000100)={'syztnl0\x00', &(0x7f0000000240)={'syztnl1\x00', 0x0, 0x2f, 0x1, 0x5, 0x1, 0x48, @mcast2, @ipv4={'\x00', '\xff\xff', @local}, 0x0, 0x8, 0x1, 0x2}}) r1 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r1, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5, 0x8}, 0x0, 0x0, 0x9, 0x7, 0x7fffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f0000062c40)={0x8000000000, [], 0x0, "00001000"}) r2 = creat(&(0x7f0000000140)='./bus\x00', 0x0) io_setup(0x1, &(0x7f0000000180)=0x0) io_submit(r3, 0x45, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000000000, 0x0, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) fallocate(r0, 0x3, 0x0, 0x100000fe) 05:05:53 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f6400ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:05:53 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655ffe00ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:05:53 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f8403ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:05:53 executing program 0: r0 = creat(&(0x7f0000000080)='./bus\x00', 0x0) lseek(r0, 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(0xffffffffffffffff, 0x40086602, &(0x7f0000000040)) perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000100)={'syztnl0\x00', &(0x7f0000000240)={'syztnl1\x00', 0x0, 0x2f, 0x1, 0x5, 0x1, 0x48, @mcast2, @ipv4={'\x00', '\xff\xff', @local}, 0x40, 0x8, 0x1, 0x2}}) r1 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r1, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f0000062c40)={0x8000000000, [], 0x0, "00001000"}) r2 = creat(&(0x7f0000000140)='./bus\x00', 0x0) io_setup(0x1, &(0x7f0000000180)=0x0) io_submit(r3, 0x45, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000000000, 0x0, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) fallocate(r0, 0x3, 0x0, 0x100000fe) 05:05:53 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0304ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:05:54 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f1c04ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:05:54 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0005ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:05:54 executing program 4: r0 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ftruncate(0xffffffffffffffff, 0x0) lseek(r0, 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(0xffffffffffffffff, 0x40086602, &(0x7f0000000040)) r1 = getpgid(0x0) perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, r1, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat2(0xffffffffffffffff, &(0x7f00000001c0)='./bus\x00', 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000100)={'syztnl0\x00', &(0x7f0000000240)={'syztnl1\x00', 0x0, 0x2f, 0x1, 0x5, 0x1, 0x48, @mcast2, @ipv4={'\x00', '\xff\xff', @local}, 0x40, 0x8, 0x1, 0x2}}) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f0000062c40)={0x8000000000, [], 0x0, "00001000"}) r3 = creat(&(0x7f0000000140)='./bus\x00', 0x0) io_setup(0x1, &(0x7f0000000180)=0x0) io_submit(r4, 0x45, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000000000, 0x0, 0x1, 0x0, r3, &(0x7f0000000000), 0x377140be6b5ef4c7}]) fallocate(r0, 0x3, 0x0, 0x100000fe) 05:05:54 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0006ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:05:54 executing program 1: r0 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ftruncate(0xffffffffffffffff, 0x0) lseek(r0, 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000040)) getpgid(0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat2(0xffffffffffffffff, &(0x7f00000001c0)='./bus\x00', 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000100)={'syztnl0\x00', &(0x7f0000000240)={'syztnl1\x00', 0x0, 0x2f, 0x1, 0x5, 0x1, 0x0, @mcast2, @ipv4={'\x00', '\xff\xff', @local}, 0x40, 0x8, 0x1, 0x2}}) r1 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r1, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5, 0x8}, 0x0, 0x0, 0x9, 0x7, 0x7fffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f0000062c40)={0x8000000000, [], 0x0, "00001000"}) r2 = creat(&(0x7f0000000140)='./bus\x00', 0x0) io_setup(0x1, &(0x7f0000000180)=0x0) io_submit(r3, 0x45, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000000000, 0x0, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) fallocate(r0, 0x3, 0x0, 0x100000fe) 05:05:54 executing program 5: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f00000004c0)=ANY=[], 0x208e24b) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r2 = syz_io_uring_setup(0x70c4, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x1, 0x24f}, &(0x7f0000a1c000/0x4000)=nil, &(0x7f0000400000/0xc00000)=nil, &(0x7f00000000c0)=0x0, &(0x7f0000000000)=0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000180)=@IORING_OP_LINK_TIMEOUT={0xf, 0xa89a1c1bd660819, 0x0, 0x0, 0x0, &(0x7f0000000140)}, 0x0) r5 = dup(r2) r6 = syz_io_uring_setup(0x7bd6, &(0x7f0000000100), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000400000/0xc00000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) fsetxattr$security_capability(r2, &(0x7f0000000040), &(0x7f0000000300)=@v3={0x3000000, [{0x401, 0x80000000}, {0x7ff, 0x8}]}, 0x18, 0x0) io_uring_register$IORING_REGISTER_PERSONALITY(r6, 0x9, 0x0, 0x0) io_uring_register$IORING_UNREGISTER_PERSONALITY(r6, 0xa, 0x0, 0x0) r7 = syz_io_uring_setup(0x7bd6, &(0x7f0000000100), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000400000/0xc00000)=nil, &(0x7f00000002c0), &(0x7f00000001c0)) r8 = io_uring_register$IORING_REGISTER_PERSONALITY(r7, 0x9, 0x0, 0x0) io_uring_register$IORING_UNREGISTER_PERSONALITY(r6, 0xa, 0x0, r8) syz_io_uring_submit(r3, r4, &(0x7f0000000200)=@IORING_OP_CONNECT={0x10, 0x0, 0x0, r5, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, r8}}, 0x1) io_uring_enter(r5, 0x6700, 0x0, 0x0, 0x0, 0x0) openat$pidfd(0xffffffffffffff9c, &(0x7f0000000900), 0x105080, 0x0) recvmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000004c80)={0x77359400}) setresgid(0x0, 0x0, 0x0) r9 = socket$nl_xfrm(0x10, 0x3, 0x6) sendfile(r9, r1, 0x0, 0x100000002) 05:05:54 executing program 2: r0 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ftruncate(0xffffffffffffffff, 0x0) lseek(r0, 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000040)) getpgid(0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat2(0xffffffffffffffff, &(0x7f00000001c0)='./bus\x00', 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000100)={'syztnl0\x00', &(0x7f0000000240)={'syztnl1\x00', 0x0, 0x2f, 0x1, 0x5, 0x1, 0x48, @mcast2, @ipv4={'\x00', '\xff\xff', @local}, 0x0, 0x8, 0x1, 0x2}}) r1 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r1, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5, 0x8}, 0x0, 0x0, 0x9, 0x7, 0x7fffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f0000062c40)={0x8000000000, [], 0x0, "00001000"}) r2 = creat(&(0x7f0000000140)='./bus\x00', 0x0) io_setup(0x1, &(0x7f0000000180)=0x0) io_submit(r3, 0x45, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000000000, 0x0, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) fallocate(r0, 0x3, 0x0, 0x100000fe) 05:05:54 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0014ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:05:54 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655fff1fffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:05:54 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0020ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:05:54 executing program 0: r0 = creat(&(0x7f0000000080)='./bus\x00', 0x0) lseek(r0, 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(0xffffffffffffffff, 0x40086602, &(0x7f0000000040)) perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000100)={'syztnl0\x00', &(0x7f0000000240)={'syztnl1\x00', 0x0, 0x2f, 0x1, 0x5, 0x1, 0x48, @mcast2, @ipv4={'\x00', '\xff\xff', @local}, 0x40, 0x8, 0x1, 0x2}}) r1 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r1, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f0000062c40)={0x8000000000, [], 0x0, "00001000"}) r2 = creat(&(0x7f0000000140)='./bus\x00', 0x0) io_setup(0x1, &(0x7f0000000180)=0x0) io_submit(r3, 0x45, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000000000, 0x0, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) fallocate(r0, 0x3, 0x0, 0x100000fe) 05:05:54 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0081ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:05:55 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0482ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:05:55 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f009affff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:05:55 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f00b1ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:05:55 executing program 5: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f00000004c0)=ANY=[], 0x208e24b) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r2 = syz_io_uring_setup(0x70c4, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000400000/0xc00000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000000)=0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000180)=@IORING_OP_LINK_TIMEOUT={0xf, 0xa89a1c1bd660819, 0x0, 0x0, 0x0, &(0x7f0000000140)}, 0x0) openat$cgroup_ro(r1, &(0x7f00000000c0)='pids.events\x00', 0x0, 0x0) r5 = dup(r2) syz_io_uring_submit(r3, r4, &(0x7f0000000040)=@IORING_OP_CONNECT={0x10, 0x0, 0x0, r5, 0x0, 0x0}, 0x1) io_uring_enter(r5, 0x6700, 0x0, 0x0, 0x0, 0x0) openat$pidfd(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) r6 = syz_open_dev$tty1(0xc, 0x4, 0x1) r7 = syz_open_procfs(0x0, &(0x7f0000000240)='mountinfo\x00') syz_mount_image$vfat(&(0x7f0000000200), &(0x7f00000002c0)='./file0\x00', 0x4, 0x8, &(0x7f0000000940)=[{&(0x7f0000000300)="6a1e24a779aa6f9c3637c48584a01d2a4f7414ded32d4d5e01357588381d2bc425ab5d71dbce1985239c6b18cce41693c0a9379125a7637d3f2f7d431af13646e8626de5b4f163a3971bbea56fcdbe33ac2ec602282178b634fb4434e6bacfd251f38b6df8d3c8ab4744b522040a0eb73f4a79db649be0750a105cce7bcf84512888d41345782c7b037fecd7b3a240a014311bd6b32281a39d179f1382dbe0109e16d0a813c5", 0xa6, 0x20}, {&(0x7f00000003c0)="e59c345422daf6ec75bfd48f726f654f445fb4258c11a4fe3a4a4caf25d9badd4f41f32719c03811f85e2dacc7cdcf5e1bcf750a7956c183f00a572091f30e46", 0x40}, {&(0x7f0000000400)="ccacbc54081f9929ab8ac593071d2eb2da5750f8260b860c9044b7596fa0c18b01742b098f98382a36d3d228509d9eae10a8a504af1f98b7d29889d95b86c86f721b0c6572c9e9e201b00e23284af205435fa286fb13e3e43e08004ee547c3677ecb795511fe9fe6d8fdf16aef93366e21d142ffe23a843c293f62ffcc531d0d9e479520415bca26868f77a6b0da717f420e62d95c117e63eac1f687890468b7955e46ab18da28a57142dc0b28549bdd83257706fe39d91b5fed50d7537dc194d9eb955a9bc22097183d2d7057929fc27c9cfc2ac7", 0xd5, 0xfffffffffffff000}, {&(0x7f0000000500)="ae2abe144677a31993b969b9919306aef815a5d24f54526c36cfa925c35342c6ed73437c45ef00ba404b8365403c073a243d0315bba452ee501fbfe4712ff129642260d1e0cfe1b5406b51d82afd22a8e06601c9c6f8a4d03f06a2d47a055ad214dc8de56048936807c436c1b71dd47c017dab87aeae17a601d782ab0147e30b9106d20bc8e3b440ba8aa82725f65ef23304b5033eda969fbd1128710649c3c183cc2206b8881b58af004eeabf70a7213792c2e401390d40e1b94639af37d682d5fd813edf1d7603b5a9d224646d3df6cb5a2d7a055088a7e6", 0xd9, 0x2}, {&(0x7f0000000600)="1493b821bc3be4f3a8eeb0e0dc454b518a3f21304b7ca0cc2f4e5787a64bbb2e803886ac58f843a81a704c5d1c4c3a13052a2d3d011e2b455a33ce9ad56846282f9cb2bc7263d62e4c476ebff66c6608b46724216da01882fa26e8b8ba6317fe269afcd7a42d13b83e947e7309fd4196289f6cac81", 0x75, 0x8001}, {&(0x7f0000000680)="bd5bb9d8c42e768ec6742f5ad617dff45b1b5504e6e406f23ca1ae247724fb6d3fa949ae3a0090ce4840518c9d15b21f7596e5e956cb31d369c1d0ff420296c5b7e9f4a8", 0x44, 0x5}, {&(0x7f0000000700)="91e350c2a3e771d22c7127b6d720d22a488a284646391793539e2856cb23f04291c86962f92adbc6359f0839f3005b41beaa2109ac30a57597d4828b03f06e80e4ca885f3644bf96e5d6b804f6bf211de850b0ac2f6358efd1d54171a746c652bfc6fe3881bd3b708f9a60096977a693dc66d4e621b4f2a96470d956db46d0b69d10dac2290424ac5514b8bbab3df28e39974512742dfbe19ffd7ebd30c1af9a3854580f4d03da7bc396279f7dc332dc12dbb769a5d7efc0e6b4b32324203c55fc493ed806f2b6705fab1483c9fafd43d880996b22", 0xd5, 0x9}, {&(0x7f0000000800)="06ac7ded328ab86103a764e64cc3f5a5e2bc986010700e45a449dab845ba379a1289aa2d21d76cffb86d974ff571f6b737a752c778665e551c75fc4d5f11d26f49402897610942451ac23a953fda4cd76e7125c7c43ccab04504bbe2984068ebee33bbe6eae5cf17689e63aa2a9a125d22a2ad7fa856d0d223f8c88bb9ec8e411f4f6f216cd3102054519aeab2b5d77b7fe7278098f875360e039338f2cd7a7e806d2c506600ca412418804cd7de752ade822ca9d40db2e8139f18b76577d0f3a09fe6e03f1a748b5dc5b73b02cf48fb5dfdf1", 0xd3, 0x7}], 0x42000, &(0x7f0000000a00)=ANY=[@ANYBLOB="757466383d312c756e695f786c6174653d302c646566636f6e746578743d73746166665f752c6673757569643d66346632393538622d653862612d616439312d336564552d34306661633330632c6f626a5f726f6c653d0b2a2725247be04025407a097936736d616769633d3078303030303030303030303030303030372c666f776e65723e", @ANYRESDEC=0xee01, @ANYBLOB=',\x00']) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000ac0), 0x200, 0x0) socket$inet_udp(0x2, 0x2, 0x0) sendfile(0xffffffffffffffff, r7, 0x0, 0x800008080004103) fcntl$setlease(r6, 0x400, 0x1) recvmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000004c80)={0x77359400}) r8 = socket$nl_xfrm(0x10, 0x3, 0x6) sendfile(r8, r1, 0x0, 0x100000002) 05:05:55 executing program 1: r0 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ftruncate(0xffffffffffffffff, 0x0) lseek(r0, 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000040)) getpgid(0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat2(0xffffffffffffffff, &(0x7f00000001c0)='./bus\x00', 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000100)={'syztnl0\x00', &(0x7f0000000240)={'syztnl1\x00', 0x0, 0x2f, 0x1, 0x5, 0x1, 0x0, @mcast2, @ipv4={'\x00', '\xff\xff', @local}, 0x40, 0x8, 0x1, 0x2}}) r1 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r1, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5, 0x8}, 0x0, 0x0, 0x9, 0x7, 0x7fffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f0000062c40)={0x8000000000, [], 0x0, "00001000"}) r2 = creat(&(0x7f0000000140)='./bus\x00', 0x0) io_setup(0x1, &(0x7f0000000180)=0x0) io_submit(r3, 0x45, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000000000, 0x0, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) fallocate(r0, 0x3, 0x0, 0x100000fe) 05:05:55 executing program 4: r0 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ftruncate(0xffffffffffffffff, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000040)) r1 = getpgid(0x0) perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, r1, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat2(0xffffffffffffffff, &(0x7f00000001c0)='./bus\x00', 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000100)={'syztnl0\x00', &(0x7f0000000240)={'syztnl1\x00', 0x0, 0x2f, 0x1, 0x5, 0x1, 0x48, @mcast2, @ipv4={'\x00', '\xff\xff', @local}, 0x40, 0x8, 0x1, 0x2}}) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5, 0x8}, 0x0, 0x0, 0x9, 0x7, 0x7fffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f0000062c40)={0x8000000000, [], 0x0, "00001000"}) r3 = creat(&(0x7f0000000140)='./bus\x00', 0x0) io_setup(0x1, &(0x7f0000000180)=0x0) io_submit(r4, 0x45, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000000000, 0x0, 0x1, 0x0, r3, &(0x7f0000000000), 0x377140be6b5ef4c7}]) fallocate(r0, 0x3, 0x0, 0x100000fe) 05:05:55 executing program 2: r0 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ftruncate(0xffffffffffffffff, 0x0) lseek(r0, 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000040)) getpgid(0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat2(0xffffffffffffffff, &(0x7f00000001c0)='./bus\x00', 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000100)={'syztnl0\x00', &(0x7f0000000240)={'syztnl1\x00', 0x0, 0x2f, 0x1, 0x5, 0x1, 0x48, @mcast2, @ipv4={'\x00', '\xff\xff', @local}, 0x40, 0x0, 0x1, 0x2}}) r1 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r1, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5, 0x8}, 0x0, 0x0, 0x9, 0x7, 0x7fffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f0000062c40)={0x8000000000, [], 0x0, "00001000"}) r2 = creat(&(0x7f0000000140)='./bus\x00', 0x0) io_setup(0x1, &(0x7f0000000180)=0x0) io_submit(r3, 0x45, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000000000, 0x0, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) fallocate(r0, 0x3, 0x0, 0x100000fe) 05:05:55 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655ffeffffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:05:55 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0102ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:05:55 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0103ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:05:56 executing program 0: ftruncate(0xffffffffffffffff, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(0xffffffffffffffff, 0x40086602, &(0x7f0000000040)) perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000100)={'syztnl0\x00', &(0x7f0000000240)={'syztnl1\x00', 0x0, 0x2f, 0x1, 0x5, 0x1, 0x48, @mcast2, @ipv4={'\x00', '\xff\xff', @local}, 0x40, 0x8, 0x1, 0x2}}) r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f0000062c40)={0x8000000000, [], 0x0, "00001000"}) r1 = creat(&(0x7f0000000140)='./bus\x00', 0x0) io_setup(0x1, &(0x7f0000000180)=0x0) io_submit(r2, 0x45, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000000000, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x377140be6b5ef4c7}]) fallocate(0xffffffffffffffff, 0x3, 0x0, 0x100000fe) 05:05:56 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0104ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:05:56 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0105ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) [ 2927.463588][ C0] scsi_io_completion_action: 9 callbacks suppressed [ 2927.463622][ C0] sd 0:0:1:0: [sg0] tag#653 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2927.480511][ C0] sd 0:0:1:0: [sg0] tag#653 CDB: opcode=0xe5 (vendor) [ 2927.487294][ C0] sd 0:0:1:0: [sg0] tag#653 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2927.496768][ C0] sd 0:0:1:0: [sg0] tag#653 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2927.506246][ C0] sd 0:0:1:0: [sg0] tag#653 CDB[20]: ba 05:05:56 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0106ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:05:56 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0107ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:05:56 executing program 5: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f00000004c0)=ANY=[], 0x208e24b) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r2 = syz_io_uring_setup(0x70c4, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000400000/0xc00000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000000)=0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000180)=@IORING_OP_POLL_REMOVE={0x7, 0x0, 0x0, 0x0, 0x0, 0x23456, 0x0, 0x0, 0x1}, 0x0) r5 = dup(r2) syz_io_uring_submit(r3, r4, &(0x7f0000000040)=@IORING_OP_CONNECT={0x10, 0x0, 0x0, r5, 0x0, 0x0}, 0x1) io_uring_enter(r5, 0x6700, 0x0, 0x0, 0x0, 0x0) openat$pidfd(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) r6 = syz_open_dev$tty1(0xc, 0x4, 0x1) r7 = syz_open_procfs(0x0, &(0x7f0000000240)='mountinfo\x00') sendfile(r6, r7, 0x0, 0x800000080004103) r8 = fcntl$dupfd(r2, 0x406, r6) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140), 0x200000, &(0x7f0000000340)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r8}, 0x2c, {[{@cache_mmap}, {@version_9p2000}, {@cache_loose}], [{@func={'func', 0x3d, 'FIRMWARE_CHECK'}}, {@uid_gt={'uid>', 0xffffffffffffffff}}, {@func={'func', 0x3d, 'KEXEC_KERNEL_CHECK'}}, {@fowner_gt={'fowner>', 0xee00}}, {@euid_lt}, {@seclabel}, {@func={'func', 0x3d, 'KEXEC_INITRAMFS_CHECK'}}]}}) perf_event_open(&(0x7f00000002c0)={0x6, 0x80, 0x6, 0x81, 0x6, 0x1, 0x0, 0x36a9, 0x2800, 0x43790a15e8307612, 0x1, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1, 0x0, 0x0, 0x0, 0xde, 0x0, @perf_config_ext={0xffff, 0x1}, 0x42007, 0xfffffffffffffff7, 0x7fffffff, 0x6, 0xb097, 0x189, 0x2, 0x0, 0x1, 0x0, 0x7}, 0xffffffffffffffff, 0xffffffffffffffff, r7, 0x1) readv(0xffffffffffffffff, &(0x7f0000000640)=[{&(0x7f0000000940)=""/4096, 0x1000}, {&(0x7f0000001940)=""/4096, 0x1000}, {&(0x7f0000000480)=""/99, 0x63}, {&(0x7f0000000200)=""/9, 0x9}, {&(0x7f0000000500)=""/31, 0x1f}, {&(0x7f0000002940)=""/4096, 0x1000}, {&(0x7f0000000540)=""/197, 0xc5}], 0x7) recvmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000004c80)={0x77359400}) setresgid(0x0, 0x0, 0x0) r9 = socket$nl_xfrm(0x10, 0x3, 0x6) sendfile(r9, r1, 0x0, 0x100000002) 05:05:56 executing program 1: r0 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ftruncate(0xffffffffffffffff, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000040)) r1 = getpgid(0x0) perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, r1, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat2(0xffffffffffffffff, &(0x7f00000001c0)='./bus\x00', 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000100)={'syztnl0\x00', &(0x7f0000000240)={'syztnl1\x00', 0x0, 0x2f, 0x1, 0x5, 0x1, 0x48, @mcast2, @ipv4={'\x00', '\xff\xff', @local}, 0x40, 0x8, 0x1, 0x2}}) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5, 0x8}, 0x0, 0x0, 0x9, 0x7, 0x7fffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f0000062c40)={0x8000000000, [], 0x0, "00001000"}) r3 = creat(&(0x7f0000000140)='./bus\x00', 0x0) io_setup(0x1, &(0x7f0000000180)=0x0) io_submit(r4, 0x45, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000000000, 0x0, 0x1, 0x0, r3, &(0x7f0000000000), 0x377140be6b5ef4c7}]) fallocate(r0, 0x3, 0x0, 0x100000fe) [ 2928.007520][ C1] sd 0:0:1:0: [sg0] tag#661 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2928.017912][ C1] sd 0:0:1:0: [sg0] tag#661 CDB: opcode=0xe5 (vendor) [ 2928.024705][ C1] sd 0:0:1:0: [sg0] tag#661 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2928.034263][ C1] sd 0:0:1:0: [sg0] tag#661 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2928.043757][ C1] sd 0:0:1:0: [sg0] tag#661 CDB[20]: ba 05:05:56 executing program 4: r0 = creat(0x0, 0x0) ftruncate(0xffffffffffffffff, 0x0) lseek(r0, 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000040)) r1 = getpgid(0x0) perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, r1, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat2(0xffffffffffffffff, &(0x7f00000001c0)='./bus\x00', 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000100)={'syztnl0\x00', &(0x7f0000000240)={'syztnl1\x00', 0x0, 0x2f, 0x1, 0x5, 0x1, 0x48, @mcast2, @ipv4={'\x00', '\xff\xff', @local}, 0x40, 0x8, 0x1, 0x2}}) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5, 0x8}, 0x0, 0x0, 0x9, 0x7, 0x7fffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f0000062c40)={0x8000000000, [], 0x0, "00001000"}) r3 = creat(&(0x7f0000000140)='./bus\x00', 0x0) io_setup(0x1, &(0x7f0000000180)=0x0) io_submit(r4, 0x45, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000000000, 0x0, 0x1, 0x0, r3, &(0x7f0000000000), 0x377140be6b5ef4c7}]) fallocate(r0, 0x3, 0x0, 0x100000fe) 05:05:56 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0108ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:05:56 executing program 2: r0 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ftruncate(0xffffffffffffffff, 0x0) lseek(r0, 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000040)) getpgid(0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat2(0xffffffffffffffff, &(0x7f00000001c0)='./bus\x00', 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000100)={'syztnl0\x00', &(0x7f0000000240)={'syztnl1\x00', 0x0, 0x2f, 0x1, 0x5, 0x1, 0x48, @mcast2, @ipv4={'\x00', '\xff\xff', @local}, 0x40, 0x0, 0x1, 0x2}}) r1 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r1, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5, 0x8}, 0x0, 0x0, 0x9, 0x7, 0x7fffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f0000062c40)={0x8000000000, [], 0x0, "00001000"}) r2 = creat(&(0x7f0000000140)='./bus\x00', 0x0) io_setup(0x1, &(0x7f0000000180)=0x0) io_submit(r3, 0x45, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000000000, 0x0, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) fallocate(r0, 0x3, 0x0, 0x100000fe) [ 2928.232641][ C1] sd 0:0:1:0: [sg0] tag#652 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2928.243317][ C1] sd 0:0:1:0: [sg0] tag#652 CDB: opcode=0xe5 (vendor) [ 2928.250110][ C1] sd 0:0:1:0: [sg0] tag#652 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2928.259591][ C1] sd 0:0:1:0: [sg0] tag#652 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2928.269094][ C1] sd 0:0:1:0: [sg0] tag#652 CDB[20]: ba 05:05:56 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0109ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) [ 2928.275771][ C0] sd 0:0:1:0: [sg0] tag#653 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2928.286037][ C0] sd 0:0:1:0: [sg0] tag#653 CDB: opcode=0xe5 (vendor) [ 2928.292799][ C0] sd 0:0:1:0: [sg0] tag#653 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2928.302315][ C0] sd 0:0:1:0: [sg0] tag#653 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2928.311800][ C0] sd 0:0:1:0: [sg0] tag#653 CDB[20]: ba 05:05:57 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f010affff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:05:57 executing program 0: ftruncate(0xffffffffffffffff, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(0xffffffffffffffff, 0x40086602, &(0x7f0000000040)) perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000100)={'syztnl0\x00', &(0x7f0000000240)={'syztnl1\x00', 0x0, 0x2f, 0x1, 0x5, 0x1, 0x48, @mcast2, @ipv4={'\x00', '\xff\xff', @local}, 0x40, 0x8, 0x1, 0x2}}) r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f0000062c40)={0x8000000000, [], 0x0, "00001000"}) r1 = creat(&(0x7f0000000140)='./bus\x00', 0x0) io_setup(0x1, &(0x7f0000000180)=0x0) io_submit(r2, 0x45, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000000000, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x377140be6b5ef4c7}]) fallocate(0xffffffffffffffff, 0x3, 0x0, 0x100000fe) 05:05:57 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f010bffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:05:57 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f010cffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) [ 2928.558477][ C0] sd 0:0:1:0: [sg0] tag#670 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2928.568775][ C0] sd 0:0:1:0: [sg0] tag#670 CDB: opcode=0xe5 (vendor) [ 2928.575541][ C0] sd 0:0:1:0: [sg0] tag#670 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2928.585058][ C0] sd 0:0:1:0: [sg0] tag#670 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2928.594554][ C0] sd 0:0:1:0: [sg0] tag#670 CDB[20]: ba 05:05:57 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f010dffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:05:57 executing program 5: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f00000004c0)=ANY=[], 0x208e24b) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) syz_io_uring_setup(0x70c4, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000400000/0xc00000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000000)=0x0) syz_io_uring_submit(r2, r3, &(0x7f0000000180)=@IORING_OP_LINK_TIMEOUT={0xf, 0xa89a1c1bd660819, 0x0, 0x0, 0x0, &(0x7f0000000140)}, 0x0) syz_io_uring_submit(r2, r3, &(0x7f0000000040)=@IORING_OP_CONNECT={0x10, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}, 0x1) io_uring_enter(0xffffffffffffffff, 0x6700, 0x0, 0x0, 0x0, 0x0) openat$pidfd(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) recvmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000004c80)={0x77359400}) setresgid(0x0, 0x0, 0x0) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendfile(r4, r1, 0x0, 0x100000002) 05:05:57 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f010effff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:05:58 executing program 1: ftruncate(0xffffffffffffffff, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(0xffffffffffffffff, 0x40086602, &(0x7f0000000040)) r0 = getpgid(0x0) perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, r0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat2(0xffffffffffffffff, &(0x7f00000001c0)='./bus\x00', 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000100)={'syztnl0\x00', &(0x7f0000000240)={'syztnl1\x00', 0x0, 0x2f, 0x1, 0x5, 0x1, 0x48, @mcast2, @ipv4={'\x00', '\xff\xff', @local}, 0x40, 0x8, 0x1, 0x2}}) r1 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r1, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5, 0x8}, 0x0, 0x0, 0x9, 0x7, 0x7fffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f0000062c40)={0x8000000000, [], 0x0, "00001000"}) r2 = creat(&(0x7f0000000140)='./bus\x00', 0x0) io_setup(0x1, &(0x7f0000000180)=0x0) io_submit(r3, 0x45, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000000000, 0x0, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) fallocate(0xffffffffffffffff, 0x3, 0x0, 0x100000fe) [ 2929.429885][ C0] sd 0:0:1:0: [sg0] tag#697 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2929.440221][ C0] sd 0:0:1:0: [sg0] tag#697 CDB: opcode=0xe5 (vendor) [ 2929.446990][ C0] sd 0:0:1:0: [sg0] tag#697 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2929.456568][ C0] sd 0:0:1:0: [sg0] tag#697 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2929.466819][ C0] sd 0:0:1:0: [sg0] tag#697 CDB[20]: ba 05:05:58 executing program 4: r0 = creat(&(0x7f0000000080)='./bus\x00', 0x0) lseek(r0, 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000040)) r1 = getpgid(0x0) perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, r1, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat2(0xffffffffffffffff, &(0x7f00000001c0)='./bus\x00', 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000100)={'syztnl0\x00', &(0x7f0000000240)={'syztnl1\x00', 0x0, 0x2f, 0x1, 0x5, 0x1, 0x48, @mcast2, @ipv4={'\x00', '\xff\xff', @local}, 0x40, 0x8, 0x1, 0x2}}) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5, 0x8}, 0x0, 0x0, 0x9, 0x7, 0x7fffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f0000062c40)={0x8000000000, [], 0x0, "00001000"}) r3 = creat(&(0x7f0000000140)='./bus\x00', 0x0) io_setup(0x1, &(0x7f0000000180)=0x0) io_submit(r4, 0x45, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000000000, 0x0, 0x1, 0x0, r3, &(0x7f0000000000), 0x377140be6b5ef4c7}]) fallocate(r0, 0x3, 0x0, 0x100000fe) 05:05:58 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f010fffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:05:58 executing program 2: r0 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ftruncate(0xffffffffffffffff, 0x0) lseek(r0, 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000040)) getpgid(0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat2(0xffffffffffffffff, &(0x7f00000001c0)='./bus\x00', 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000100)={'syztnl0\x00', &(0x7f0000000240)={'syztnl1\x00', 0x0, 0x2f, 0x1, 0x5, 0x1, 0x48, @mcast2, @ipv4={'\x00', '\xff\xff', @local}, 0x40, 0x0, 0x1, 0x2}}) r1 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r1, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5, 0x8}, 0x0, 0x0, 0x9, 0x7, 0x7fffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f0000062c40)={0x8000000000, [], 0x0, "00001000"}) r2 = creat(&(0x7f0000000140)='./bus\x00', 0x0) io_setup(0x1, &(0x7f0000000180)=0x0) io_submit(r3, 0x45, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000000000, 0x0, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) fallocate(r0, 0x3, 0x0, 0x100000fe) 05:05:58 executing program 0: ftruncate(0xffffffffffffffff, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(0xffffffffffffffff, 0x40086602, &(0x7f0000000040)) perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000100)={'syztnl0\x00', &(0x7f0000000240)={'syztnl1\x00', 0x0, 0x2f, 0x1, 0x5, 0x1, 0x48, @mcast2, @ipv4={'\x00', '\xff\xff', @local}, 0x40, 0x8, 0x1, 0x2}}) r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f0000062c40)={0x8000000000, [], 0x0, "00001000"}) r1 = creat(&(0x7f0000000140)='./bus\x00', 0x0) io_setup(0x1, &(0x7f0000000180)=0x0) io_submit(r2, 0x45, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000000000, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x377140be6b5ef4c7}]) fallocate(0xffffffffffffffff, 0x3, 0x0, 0x100000fe) [ 2929.576207][ C0] sd 0:0:1:0: [sg0] tag#692 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2929.586537][ C0] sd 0:0:1:0: [sg0] tag#692 CDB: opcode=0xe5 (vendor) [ 2929.593335][ C0] sd 0:0:1:0: [sg0] tag#692 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2929.602800][ C0] sd 0:0:1:0: [sg0] tag#692 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2929.612281][ C0] sd 0:0:1:0: [sg0] tag#692 CDB[20]: ba 05:05:58 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0110ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) [ 2929.625223][ C1] sd 0:0:1:0: [sg0] tag#661 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2929.635526][ C1] sd 0:0:1:0: [sg0] tag#661 CDB: opcode=0xe5 (vendor) [ 2929.642326][ C1] sd 0:0:1:0: [sg0] tag#661 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2929.651817][ C1] sd 0:0:1:0: [sg0] tag#661 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2929.661400][ C1] sd 0:0:1:0: [sg0] tag#661 CDB[20]: ba 05:05:58 executing program 5: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f00000004c0)=ANY=[], 0x208e24b) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r2 = syz_io_uring_setup(0x70c4, &(0x7f0000000240)={0x0, 0x40000, 0x4, 0x0, 0x4}, &(0x7f0000002000/0x2000)=nil, &(0x7f0000b85000/0x2000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000300)=0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000180)=@IORING_OP_LINK_TIMEOUT={0xf, 0xa89a1c1bd660819, 0x0, 0x0, 0x0, &(0x7f0000000140)}, 0x0) r5 = dup(r2) syz_io_uring_submit(r3, r4, &(0x7f0000000040)=@IORING_OP_CONNECT={0x10, 0x0, 0x0, r5, 0x0, 0x0}, 0x1) r6 = mmap$IORING_OFF_SQES(&(0x7f000055e000/0x2000)=nil, 0x2000, 0x8, 0x4000010, r0, 0x10000000) r7 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ca5000/0x2000)=nil, 0x2000, 0xa, 0x100010, r2, 0x0) syz_io_uring_setup(0x70c4, &(0x7f00000023c0), &(0x7f0000501000/0x4000)=nil, &(0x7f0000935000/0x1000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000380)=0x0) syz_io_uring_submit(r8, r9, &(0x7f00000000c0)=@IORING_OP_REMOVE_BUFFERS={0x1f, 0x0, 0x0, 0x8}, 0x0) r10 = io_uring_register$IORING_REGISTER_PERSONALITY(r5, 0x9, 0x0, 0x0) syz_io_uring_submit(r7, r9, &(0x7f00000002c0)=@IORING_OP_LINK_TIMEOUT={0xf, 0x4, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x77359400}, 0x1, 0x1, 0x0, {0x0, r10}}, 0x355) syz_io_uring_submit(r3, r6, &(0x7f00000000c0)=@IORING_OP_TIMEOUT_REMOVE={0xc, 0x3, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1}, 0x0) io_uring_enter(r1, 0x26704, 0x0, 0x1, 0x0, 0x0) openat$pidfd(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) recvmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000004c80)={0x77359400}) setresgid(0x0, 0x0, 0x0) r11 = socket$nl_xfrm(0x10, 0x3, 0x6) sendfile(r11, r1, 0x0, 0x100000002) 05:05:58 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0111ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) [ 2929.749137][ C0] sd 0:0:1:0: [sg0] tag#662 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2929.759515][ C0] sd 0:0:1:0: [sg0] tag#662 CDB: opcode=0xe5 (vendor) [ 2929.766303][ C0] sd 0:0:1:0: [sg0] tag#662 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2929.775780][ C0] sd 0:0:1:0: [sg0] tag#662 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2929.785292][ C0] sd 0:0:1:0: [sg0] tag#662 CDB[20]: ba 05:05:58 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0112ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:05:58 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0118ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:05:58 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0119ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:05:58 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0122ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:05:59 executing program 1: r0 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ftruncate(0xffffffffffffffff, 0x0) lseek(r0, 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000040)) perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat2(0xffffffffffffffff, &(0x7f00000001c0)='./bus\x00', 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000100)={'syztnl0\x00', &(0x7f0000000240)={'syztnl1\x00', 0x0, 0x2f, 0x1, 0x5, 0x1, 0x48, @mcast2, @ipv4={'\x00', '\xff\xff', @local}, 0x40, 0x8, 0x1, 0x2}}) r1 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r1, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5, 0x8}, 0x0, 0x0, 0x9, 0x7, 0x7fffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f0000062c40)={0x8000000000, [], 0x0, "00001000"}) r2 = creat(&(0x7f0000000140)='./bus\x00', 0x0) io_setup(0x1, &(0x7f0000000180)=0x0) io_submit(r3, 0x45, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000000000, 0x0, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) fallocate(r0, 0x3, 0x0, 0x100000fe) [ 2930.769026][ C1] sd 0:0:1:0: [sg0] tag#669 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2930.779341][ C1] sd 0:0:1:0: [sg0] tag#669 CDB: opcode=0xe5 (vendor) [ 2930.786120][ C1] sd 0:0:1:0: [sg0] tag#669 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2930.795756][ C1] sd 0:0:1:0: [sg0] tag#669 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2930.805237][ C1] sd 0:0:1:0: [sg0] tag#669 CDB[20]: ba 05:05:59 executing program 4: r0 = creat(&(0x7f0000000080)='./bus\x00', 0x0) lseek(r0, 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000040)) r1 = getpgid(0x0) perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, r1, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat2(0xffffffffffffffff, &(0x7f00000001c0)='./bus\x00', 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000100)={'syztnl0\x00', &(0x7f0000000240)={'syztnl1\x00', 0x0, 0x2f, 0x1, 0x5, 0x1, 0x48, @mcast2, @ipv4={'\x00', '\xff\xff', @local}, 0x40, 0x8, 0x1, 0x2}}) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5, 0x8}, 0x0, 0x0, 0x9, 0x7, 0x7fffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f0000062c40)={0x8000000000, [], 0x0, "00001000"}) r3 = creat(&(0x7f0000000140)='./bus\x00', 0x0) io_setup(0x1, &(0x7f0000000180)=0x0) io_submit(r4, 0x45, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000000000, 0x0, 0x1, 0x0, r3, &(0x7f0000000000), 0x377140be6b5ef4c7}]) fallocate(r0, 0x3, 0x0, 0x100000fe) 05:05:59 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0125ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:05:59 executing program 0: r0 = creat(0x0, 0x0) ftruncate(0xffffffffffffffff, 0x0) lseek(r0, 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(0xffffffffffffffff, 0x40086602, &(0x7f0000000040)) perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000100)={'syztnl0\x00', &(0x7f0000000240)={'syztnl1\x00', 0x0, 0x2f, 0x1, 0x5, 0x1, 0x48, @mcast2, @ipv4={'\x00', '\xff\xff', @local}, 0x40, 0x8, 0x1, 0x2}}) r1 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r1, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f0000062c40)={0x8000000000, [], 0x0, "00001000"}) r2 = creat(&(0x7f0000000140)='./bus\x00', 0x0) io_setup(0x1, &(0x7f0000000180)=0x0) io_submit(r3, 0x45, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000000000, 0x0, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) fallocate(r0, 0x3, 0x0, 0x100000fe) 05:05:59 executing program 2: r0 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ftruncate(0xffffffffffffffff, 0x0) lseek(r0, 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000040)) getpgid(0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat2(0xffffffffffffffff, &(0x7f00000001c0)='./bus\x00', 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000100)={'syztnl0\x00', &(0x7f0000000240)={'syztnl1\x00', 0x0, 0x2f, 0x1, 0x5, 0x1, 0x48, @mcast2, @ipv4={'\x00', '\xff\xff', @local}, 0x40, 0x8, 0x0, 0x2}}) r1 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r1, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5, 0x8}, 0x0, 0x0, 0x9, 0x7, 0x7fffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f0000062c40)={0x8000000000, [], 0x0, "00001000"}) r2 = creat(&(0x7f0000000140)='./bus\x00', 0x0) io_setup(0x1, &(0x7f0000000180)=0x0) io_submit(r3, 0x45, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000000000, 0x0, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) fallocate(r0, 0x3, 0x0, 0x100000fe) 05:05:59 executing program 5: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f00000004c0)=ANY=[], 0x208e24b) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r2 = syz_io_uring_setup(0x70c4, &(0x7f0000000240)={0x0, 0x0, 0x20, 0x0, 0x34a}, &(0x7f0000002000/0x2000)=nil, &(0x7f0000400000/0xc00000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000000)=0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000180)=@IORING_OP_LINK_TIMEOUT={0xf, 0xa89a1c1bd660819, 0x0, 0x0, 0x0, &(0x7f0000000140)}, 0x0) r5 = dup(r2) r6 = syz_open_dev$tty1(0xc, 0x4, 0x1) r7 = syz_open_procfs(0x0, &(0x7f0000000240)='mountinfo\x00') sendfile(r6, r7, 0x0, 0x800000080004103) openat$cgroup_ro(r7, &(0x7f00000000c0)='cpuset.effective_mems\x00', 0x0, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000040)=@IORING_OP_CONNECT={0x10, 0x0, 0x0, r5, 0x0, 0x0}, 0x1) io_uring_enter(r5, 0x6700, 0x0, 0x0, 0x0, 0x0) openat$pidfd(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) recvmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000004c80)={0x77359400}) setresgid(0x0, 0x0, 0x0) r8 = socket$nl_xfrm(0x10, 0x3, 0x6) sendfile(r8, r1, 0x0, 0x100000002) 05:05:59 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f012effff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:05:59 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0132ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:05:59 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0148ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:05:59 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f014cffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:06:00 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0160ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:06:00 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0168ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:06:00 executing program 1: r0 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ftruncate(0xffffffffffffffff, 0x0) lseek(r0, 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000040)) perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat2(0xffffffffffffffff, &(0x7f00000001c0)='./bus\x00', 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000100)={'syztnl0\x00', &(0x7f0000000240)={'syztnl1\x00', 0x0, 0x2f, 0x1, 0x5, 0x1, 0x48, @mcast2, @ipv4={'\x00', '\xff\xff', @local}, 0x40, 0x8, 0x1, 0x2}}) r1 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r1, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5, 0x8}, 0x0, 0x0, 0x9, 0x7, 0x7fffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f0000062c40)={0x8000000000, [], 0x0, "00001000"}) r2 = creat(&(0x7f0000000140)='./bus\x00', 0x0) io_setup(0x1, &(0x7f0000000180)=0x0) io_submit(r3, 0x45, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000000000, 0x0, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) fallocate(r0, 0x3, 0x0, 0x100000fe) 05:06:01 executing program 4: r0 = creat(&(0x7f0000000080)='./bus\x00', 0x0) lseek(r0, 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000040)) r1 = getpgid(0x0) perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, r1, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat2(0xffffffffffffffff, &(0x7f00000001c0)='./bus\x00', 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000100)={'syztnl0\x00', &(0x7f0000000240)={'syztnl1\x00', 0x0, 0x2f, 0x1, 0x5, 0x1, 0x48, @mcast2, @ipv4={'\x00', '\xff\xff', @local}, 0x40, 0x8, 0x1, 0x2}}) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5, 0x8}, 0x0, 0x0, 0x9, 0x7, 0x7fffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f0000062c40)={0x8000000000, [], 0x0, "00001000"}) r3 = creat(&(0x7f0000000140)='./bus\x00', 0x0) io_setup(0x1, &(0x7f0000000180)=0x0) io_submit(r4, 0x45, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000000000, 0x0, 0x1, 0x0, r3, &(0x7f0000000000), 0x377140be6b5ef4c7}]) fallocate(r0, 0x3, 0x0, 0x100000fe) 05:06:01 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f016cffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:06:01 executing program 0: r0 = creat(0x0, 0x0) ftruncate(0xffffffffffffffff, 0x0) lseek(r0, 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(0xffffffffffffffff, 0x40086602, &(0x7f0000000040)) perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000100)={'syztnl0\x00', &(0x7f0000000240)={'syztnl1\x00', 0x0, 0x2f, 0x1, 0x5, 0x1, 0x48, @mcast2, @ipv4={'\x00', '\xff\xff', @local}, 0x40, 0x8, 0x1, 0x2}}) r1 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r1, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f0000062c40)={0x8000000000, [], 0x0, "00001000"}) r2 = creat(&(0x7f0000000140)='./bus\x00', 0x0) io_setup(0x1, &(0x7f0000000180)=0x0) io_submit(r3, 0x45, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000000000, 0x0, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) fallocate(r0, 0x3, 0x0, 0x100000fe) 05:06:01 executing program 2: r0 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ftruncate(0xffffffffffffffff, 0x0) lseek(r0, 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000040)) getpgid(0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat2(0xffffffffffffffff, &(0x7f00000001c0)='./bus\x00', 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000100)={'syztnl0\x00', &(0x7f0000000240)={'syztnl1\x00', 0x0, 0x2f, 0x1, 0x5, 0x1, 0x48, @mcast2, @ipv4={'\x00', '\xff\xff', @local}, 0x40, 0x8, 0x0, 0x2}}) r1 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r1, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5, 0x8}, 0x0, 0x0, 0x9, 0x7, 0x7fffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f0000062c40)={0x8000000000, [], 0x0, "00001000"}) r2 = creat(&(0x7f0000000140)='./bus\x00', 0x0) io_setup(0x1, &(0x7f0000000180)=0x0) io_submit(r3, 0x45, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000000000, 0x0, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) fallocate(r0, 0x3, 0x0, 0x100000fe) 05:06:01 executing program 5: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f00000004c0)=ANY=[], 0x208e24b) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r2 = syz_io_uring_setup(0x70c4, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000400000/0xc00000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000000)=0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000180)=@IORING_OP_LINK_TIMEOUT={0xf, 0xa89a1c1bd660819, 0x0, 0x0, 0x0, &(0x7f0000000140)}, 0x0) r5 = dup(r2) syz_io_uring_submit(r3, r4, &(0x7f0000000040)=@IORING_OP_CONNECT={0x10, 0x0, 0x0, r5, 0x0, 0x0}, 0x1) r6 = syz_open_dev$tty1(0xc, 0x4, 0x1) r7 = syz_open_procfs(0x0, &(0x7f0000000240)='mountinfo\x00') sendfile(r6, r7, 0x0, 0x800000080004103) sendfile(r1, r5, 0x0, 0x7) pwritev(r6, &(0x7f00000000c0)=[{&(0x7f00000002c0)="1cc75680c1c7cfc4b5e580e849c35b2a8417d4bfe2894428a5f39fbc8d27fe57de0440e6e6feb718395b2966e81c517706b4670ef499f12b7ab24878afd68ddb61333df07e245b08758c94bbb17d2a4690f20797eeb7d3d9ad1f24e1b263697b03651ba05622fbef2137596339e619b7961f", 0x72}, {&(0x7f0000000340)="cacdfab22d7a9b46ca85e74754d0960d990dfdedb10b85d7f199be2c688c63e4a0b48b6282f1c7163643bceb1ea4609006395e43ce93a1925beb1d7f9d7032a3faa4524e94840ef8c064968571121906775c7227d55a9fda3679203d40d93e5bd98a9de0ee44806591f9cfe582a9e810c49d91e7111e9153f429eab7ff9d1f050422b5", 0x83}], 0x2, 0x81, 0x1) io_uring_enter(r5, 0x6700, 0x0, 0x0, 0x0, 0x0) openat$pidfd(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000200)) openat$zero(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) recvmmsg$unix(r0, 0x0, 0x0, 0x2000, &(0x7f0000004c80)={0x77359400}) setresgid(0x0, 0x0, 0x0) r8 = socket$nl_xfrm(0x10, 0x3, 0x6) sendfile(r8, r1, 0x0, 0x100000002) 05:06:01 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0174ffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) [ 2932.510969][ C0] scsi_io_completion_action: 6 callbacks suppressed [ 2932.511007][ C0] sd 0:0:1:0: [sg0] tag#667 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2932.528166][ C0] sd 0:0:1:0: [sg0] tag#667 CDB: opcode=0xe5 (vendor) [ 2932.534979][ C0] sd 0:0:1:0: [sg0] tag#667 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2932.544590][ C0] sd 0:0:1:0: [sg0] tag#667 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2932.554148][ C0] sd 0:0:1:0: [sg0] tag#667 CDB[20]: ba 05:06:01 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f017affff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:06:01 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f01feffff53ef010001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:06:01 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef020001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:06:01 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef030001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:06:01 executing program 1: r0 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ftruncate(0xffffffffffffffff, 0x0) lseek(r0, 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000040)) r1 = getpgid(0x0) perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, r1, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$RTC_WKALM_SET(r0, 0x4028700f, &(0x7f0000000000)={0x1, 0x0, {0x10, 0x3b, 0x1, 0x1a, 0x9, 0x3, 0x0, 0xcc, 0x1}}) socket$inet6_udp(0xa, 0x2, 0x0) r2 = fsmount(r0, 0x0, 0x71) openat2(0xffffffffffffffff, &(0x7f00000001c0)='./bus\x00', 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r2, 0x89f2, &(0x7f0000000100)={'syztnl0\x00', &(0x7f0000000240)={'syztnl1\x00', 0x0, 0x2f, 0x1, 0x5, 0x1, 0x48, @mcast2, @ipv4={'\x00', '\xff\xff', @local}, 0x40, 0x8, 0x1, 0x2}}) r3 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r3, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5, 0x8}, 0x0, 0x0, 0x9, 0x7, 0x7fffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f0000062c40)={0x8000000000, [], 0x0, "00001000"}) r4 = creat(&(0x7f0000000140)='./bus\x00', 0x0) io_setup(0x1, &(0x7f0000000180)=0x0) io_submit(r5, 0x45, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000000000, 0x0, 0x1, 0x0, r4, &(0x7f0000000000), 0x377140be6b5ef4c7}]) fallocate(r0, 0x3, 0x0, 0x100000fe) 05:06:01 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef040001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) [ 2932.960125][ C0] sd 0:0:1:0: [sg0] tag#657 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2932.970689][ C0] sd 0:0:1:0: [sg0] tag#657 CDB: opcode=0xe5 (vendor) [ 2932.977498][ C0] sd 0:0:1:0: [sg0] tag#657 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2932.987149][ C0] sd 0:0:1:0: [sg0] tag#657 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2932.996627][ C0] sd 0:0:1:0: [sg0] tag#657 CDB[20]: ba 05:06:02 executing program 4: r0 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ftruncate(0xffffffffffffffff, 0x0) lseek(r0, 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000040)) r1 = getpgid(0x0) perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, r1, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$RTC_WKALM_SET(r0, 0x4028700f, &(0x7f0000000000)={0x1, 0x0, {0x10, 0x3b, 0x1, 0x1a, 0x9, 0x3, 0x0, 0xcc, 0x1}}) socket$inet6_udp(0xa, 0x2, 0x0) r2 = fsmount(r0, 0x0, 0x71) openat2(0xffffffffffffffff, &(0x7f00000001c0)='./bus\x00', 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r2, 0x89f2, &(0x7f0000000100)={'syztnl0\x00', &(0x7f0000000240)={'syztnl1\x00', 0x0, 0x2f, 0x1, 0x5, 0x1, 0x48, @mcast2, @ipv4={'\x00', '\xff\xff', @local}, 0x40, 0x8, 0x1, 0x2}}) r3 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r3, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5, 0x8}, 0x0, 0x0, 0x9, 0x7, 0x7fffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f0000062c40)={0x8000000000, [], 0x0, "00001000"}) r4 = creat(&(0x7f0000000140)='./bus\x00', 0x0) io_setup(0x1, &(0x7f0000000180)=0x0) io_submit(r5, 0x45, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000000000, 0x0, 0x1, 0x0, r4, &(0x7f0000000000), 0x377140be6b5ef4c7}]) fallocate(r0, 0x3, 0x0, 0x100000fe) 05:06:02 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef050001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:06:02 executing program 5: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f00000004c0)=ANY=[], 0x208e24b) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r2 = syz_io_uring_setup(0x70c1, &(0x7f0000000240)={0x0, 0xd13d}, &(0x7f00008af000/0x4000)=nil, &(0x7f0000400000/0xc00000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000000)=0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000180)=@IORING_OP_LINK_TIMEOUT={0xf, 0xa89a1c1bd660819, 0x0, 0x0, 0x0, &(0x7f0000000140)}, 0x0) r5 = dup(r2) syz_io_uring_submit(r3, r4, &(0x7f0000000040)=@IORING_OP_CONNECT={0x10, 0x0, 0x0, r5, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x1) io_uring_enter(r5, 0x6700, 0x0, 0x0, 0x0, 0x0) openat$pidfd(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) recvmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000004c80)={0x77359400}) setresgid(0x0, 0x0, 0x0) r6 = socket$nl_xfrm(0x10, 0x3, 0x6) r7 = syz_open_dev$tty1(0xc, 0x4, 0x1) r8 = syz_open_procfs(0x0, &(0x7f0000000240)='mountinfo\x00') sendfile(r7, r8, 0x0, 0x800000080004103) signalfd(r8, &(0x7f0000000200)={[0x1]}, 0x8) sendfile(r6, r1, 0x0, 0x100000002) r9 = openat$vcsu(0xffffffffffffff9c, &(0x7f00000000c0), 0x10080, 0x0) pidfd_send_signal(r9, 0x24, &(0x7f00000002c0)={0x40, 0xc, 0x2}, 0x0) shmctl$IPC_SET(0x0, 0x1, &(0x7f00000005c0)={{0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x81, 0x4, 0x2, 0x200, 0x0, 0xffffffffffffffff, 0x1}) 05:06:02 executing program 2: r0 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ftruncate(0xffffffffffffffff, 0x0) lseek(r0, 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000040)) getpgid(0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat2(0xffffffffffffffff, &(0x7f00000001c0)='./bus\x00', 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000100)={'syztnl0\x00', &(0x7f0000000240)={'syztnl1\x00', 0x0, 0x2f, 0x1, 0x5, 0x1, 0x48, @mcast2, @ipv4={'\x00', '\xff\xff', @local}, 0x40, 0x8, 0x0, 0x2}}) r1 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r1, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5, 0x8}, 0x0, 0x0, 0x9, 0x7, 0x7fffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f0000062c40)={0x8000000000, [], 0x0, "00001000"}) r2 = creat(&(0x7f0000000140)='./bus\x00', 0x0) io_setup(0x1, &(0x7f0000000180)=0x0) io_submit(r3, 0x45, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000000000, 0x0, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) fallocate(r0, 0x3, 0x0, 0x100000fe) 05:06:02 executing program 0: r0 = creat(0x0, 0x0) ftruncate(0xffffffffffffffff, 0x0) lseek(r0, 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(0xffffffffffffffff, 0x40086602, &(0x7f0000000040)) perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000100)={'syztnl0\x00', &(0x7f0000000240)={'syztnl1\x00', 0x0, 0x2f, 0x1, 0x5, 0x1, 0x48, @mcast2, @ipv4={'\x00', '\xff\xff', @local}, 0x40, 0x8, 0x1, 0x2}}) r1 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r1, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f0000062c40)={0x8000000000, [], 0x0, "00001000"}) r2 = creat(&(0x7f0000000140)='./bus\x00', 0x0) io_setup(0x1, &(0x7f0000000180)=0x0) io_submit(r3, 0x45, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000000000, 0x0, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) fallocate(r0, 0x3, 0x0, 0x100000fe) 05:06:02 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef060001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) [ 2933.765649][ C0] sd 0:0:1:0: [sg0] tag#658 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2933.776072][ C0] sd 0:0:1:0: [sg0] tag#658 CDB: opcode=0xe5 (vendor) [ 2933.783120][ C0] sd 0:0:1:0: [sg0] tag#658 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2933.792594][ C0] sd 0:0:1:0: [sg0] tag#658 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2933.802333][ C0] sd 0:0:1:0: [sg0] tag#658 CDB[20]: ba [ 2933.853657][ C0] sd 0:0:1:0: [sg0] tag#659 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2933.864032][ C0] sd 0:0:1:0: [sg0] tag#659 CDB: opcode=0xe5 (vendor) [ 2933.871113][ C0] sd 0:0:1:0: [sg0] tag#659 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2933.880638][ C0] sd 0:0:1:0: [sg0] tag#659 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2933.890177][ C0] sd 0:0:1:0: [sg0] tag#659 CDB[20]: ba 05:06:02 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef070001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) [ 2933.895751][ C0] sd 0:0:1:0: [sg0] tag#660 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2933.906023][ C0] sd 0:0:1:0: [sg0] tag#660 CDB: opcode=0xe5 (vendor) [ 2933.912799][ C0] sd 0:0:1:0: [sg0] tag#660 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2933.922275][ C0] sd 0:0:1:0: [sg0] tag#660 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2933.931774][ C0] sd 0:0:1:0: [sg0] tag#660 CDB[20]: ba 05:06:02 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef080001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:06:02 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef090001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:06:02 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef0a0001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:06:02 executing program 1: r0 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ftruncate(0xffffffffffffffff, 0x0) lseek(r0, 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000040)) r1 = getpgid(0x0) perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, r1, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$RTC_WKALM_SET(r0, 0x4028700f, &(0x7f0000000000)={0x1, 0x0, {0x10, 0x3b, 0x1, 0x1a, 0x9, 0x3, 0x0, 0xcc, 0x1}}) socket$inet6_udp(0xa, 0x2, 0x0) r2 = fsmount(r0, 0x0, 0x71) openat2(0xffffffffffffffff, &(0x7f00000001c0)='./bus\x00', 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r2, 0x89f2, &(0x7f0000000100)={'syztnl0\x00', &(0x7f0000000240)={'syztnl1\x00', 0x0, 0x2f, 0x1, 0x5, 0x1, 0x48, @mcast2, @ipv4={'\x00', '\xff\xff', @local}, 0x40, 0x8, 0x1, 0x2}}) r3 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r3, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5, 0x8}, 0x0, 0x0, 0x9, 0x7, 0x7fffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f0000062c40)={0x8000000000, [], 0x0, "00001000"}) r4 = creat(&(0x7f0000000140)='./bus\x00', 0x0) io_setup(0x1, &(0x7f0000000180)=0x0) io_submit(r5, 0x45, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000000000, 0x0, 0x1, 0x0, r4, &(0x7f0000000000), 0x377140be6b5ef4c7}]) fallocate(r0, 0x3, 0x0, 0x100000fe) 05:06:02 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef0b0001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) [ 2934.344854][ C0] sd 0:0:1:0: [sg0] tag#672 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2934.355148][ C0] sd 0:0:1:0: [sg0] tag#672 CDB: opcode=0xe5 (vendor) [ 2934.362174][ C0] sd 0:0:1:0: [sg0] tag#672 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2934.371657][ C0] sd 0:0:1:0: [sg0] tag#672 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2934.381162][ C0] sd 0:0:1:0: [sg0] tag#672 CDB[20]: ba 05:06:03 executing program 4: r0 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ftruncate(0xffffffffffffffff, 0x0) lseek(r0, 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000040)) r1 = getpgid(0x0) perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, r1, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$RTC_WKALM_SET(r0, 0x4028700f, &(0x7f0000000000)={0x1, 0x0, {0x10, 0x3b, 0x1, 0x1a, 0x9, 0x3, 0x0, 0xcc, 0x1}}) socket$inet6_udp(0xa, 0x2, 0x0) fsmount(r0, 0x0, 0x71) r2 = openat2(0xffffffffffffffff, &(0x7f00000001c0)='./bus\x00', 0x0, 0x0) sendto$inet6(r2, &(0x7f0000000300), 0x0, 0x0, 0x0, 0x0) r3 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r3, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5, 0x8}, 0x0, 0x0, 0x9, 0x7, 0x7fffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f0000062c40)={0x8000000000, [], 0x0, "00001000"}) r4 = creat(&(0x7f0000000140)='./bus\x00', 0x0) io_setup(0x1, &(0x7f0000000180)=0x0) io_submit(r5, 0x45, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000000000, 0x0, 0x1, 0x0, r4, &(0x7f0000000000), 0x377140be6b5ef4c7}]) fallocate(r0, 0x3, 0x0, 0x100000fe) 05:06:03 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef0c0001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:06:03 executing program 5: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f00000004c0)=ANY=[], 0x208e24b) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r2 = syz_io_uring_setup(0x70c4, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000400000/0xc00000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000000)=0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000180)=@IORING_OP_LINK_TIMEOUT={0xf, 0xa89a1c1bd660819, 0x0, 0x0, 0x0, &(0x7f0000000140)}, 0x0) r5 = dup(r2) syz_io_uring_submit(r3, r4, &(0x7f0000000040)=@IORING_OP_CONNECT={0x10, 0x0, 0x0, r5, 0x0, 0x0}, 0x1) io_uring_enter(r5, 0x6700, 0x0, 0x0, 0x0, 0x0) openat$pidfd(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) recvmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000004c80)={0x77359400}) setresgid(0x0, 0x0, 0x0) r6 = socket$nl_xfrm(0x10, 0x3, 0x6) sendfile(r6, r1, 0x0, 0x100000002) r7 = syz_open_procfs(0x0, &(0x7f0000000240)='mountinfo\x00') sendfile(0xffffffffffffffff, r7, 0x0, 0x800000080004103) r8 = socket$inet_udp(0x2, 0x2, 0x0) r9 = syz_genetlink_get_family_id$gtp(&(0x7f0000000040), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r8, 0x8933, &(0x7f0000000080)={'batadv0\x00', 0x0}) sendmsg$GTP_CMD_GETPDP(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x5c, r9, 0x100, 0x70bd2a, 0x25dfdbfc, {}, [@GTPA_PEER_ADDRESS={0x8, 0x4, @dev={0xac, 0x14, 0x14, 0x2c}}, @GTPA_LINK={0x8}, @GTPA_FLOW={0x6, 0x6, 0x4}, @GTPA_MS_ADDRESS={0x8, 0x5, @broadcast}, @GTPA_LINK={0x8, 0x1, r10}, @GTPA_LINK={0x8}, @GTPA_FLOW={0x6, 0x6, 0x3}, @GTPA_PEER_ADDRESS={0x8, 0x4, @remote}, @GTPA_I_TEI={0x8}]}, 0x5c}, 0x1, 0x0, 0x0, 0x8000}, 0x10) sendmsg$nl_xfrm(r7, &(0x7f0000000680)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000200)={&(0x7f00000002c0)=@newsa={0x3b4, 0x10, 0x0, 0x70bd26, 0x25dfdbfe, {{@in=@broadcast, @in=@rand_addr=0x64010101, 0x4e21, 0xfe00, 0x4e23, 0x4, 0xa, 0x80, 0x180, 0x2c, r10, 0xee00}, {@in6=@empty, 0x4d3, 0x2b}, @in6=@private0={0xfc, 0x0, '\x00', 0x1}, {0x7, 0x400, 0xbbe, 0x4, 0xbbf, 0xd9a2, 0x9, 0x6}, {0x0, 0x100, 0xcc, 0x2}, {0x9, 0x8000}, 0x70bd2a, 0x3504, 0x2, 0x4, 0x10, 0x80}, [@address_filter={0x28, 0x1a, {@in=@private=0xa010100, @in=@dev={0xac, 0x14, 0x14, 0x3e}, 0xa, 0x5, 0x9}}, @address_filter={0x28, 0x1a, {@in=@broadcast, @in=@broadcast, 0x2, 0x9, 0xff}}, @replay_val={0x10, 0xa, {0x70bd2c, 0x70bd2a, 0x7}}, @tmpl={0x84, 0x5, [{{@in6=@private2, 0x4d3, 0xff}, 0x2, @in6=@mcast2, 0x0, 0x1, 0xdff5ae395c38f828, 0xff, 0x5, 0x0, 0xc390}, {{@in=@multicast1, 0x4d2, 0x33}, 0x2, @in=@dev={0xac, 0x14, 0x14, 0x3a}, 0x3505, 0x2, 0x0, 0x6, 0x1, 0x45, 0x1}]}, @algo_comp={0x104, 0x3, {{'deflate\x00'}, 0x5e0, "39d98c9090b652678e2e72e561d7cc7b1543d5b5efe98ccd987841e15f01667e92a4338a247f91552b81cf11956412bee39c78734e68ae28dae79d4001c48fe9ccd846a230a2b49565cbae6ea773a3df117edc32d2f8ac63b0a96e3cc9374e30eacfaf66e67c1317c556c4797a217ab5753c2f99f11f786e70de004feac9da41503cbdbd6d7784434ff34ede77af99e23ae713e58aa00ec37bb1c40c4597a6ab359410fb83c0adf182b45aae0c7a402ef5072ebd1ab5719b2040f01b"}}, @algo_auth={0xdc, 0x1, {{'wp256-generic\x00'}, 0x4a0, "58cd63e312a6b03fef7e3265232fb6e63d04c6e8c41005f10a41d117ad9b7d1ae8a17e609a33a78f0296f9cdedc8665145c9a3851c5f91ea7bca11ef1613ecfa54bd22813ee73f6aed4f04b85e1abf0d8d86a42b323d701a48ddfd5b6cbfc21afec324c0da7695ab3db86cb0601a6a384762b62faee319670c44b09d646dd1d3eef91932d9e450fed9ae38307cbee6c1834fa5dd"}}]}, 0x3b4}, 0x1, 0x0, 0x0, 0x8011}, 0x8000) 05:06:03 executing program 0: r0 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ftruncate(0xffffffffffffffff, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(0xffffffffffffffff, 0x40086602, &(0x7f0000000040)) perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000100)={'syztnl0\x00', &(0x7f0000000240)={'syztnl1\x00', 0x0, 0x2f, 0x1, 0x5, 0x1, 0x48, @mcast2, @ipv4={'\x00', '\xff\xff', @local}, 0x40, 0x8, 0x1, 0x2}}) r1 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r1, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f0000062c40)={0x8000000000, [], 0x0, "00001000"}) r2 = creat(&(0x7f0000000140)='./bus\x00', 0x0) io_setup(0x1, &(0x7f0000000180)=0x0) io_submit(r3, 0x45, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000000000, 0x0, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) fallocate(r0, 0x3, 0x0, 0x100000fe) 05:06:03 executing program 2: r0 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ftruncate(0xffffffffffffffff, 0x0) lseek(r0, 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000040)) getpgid(0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat2(0xffffffffffffffff, &(0x7f00000001c0)='./bus\x00', 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000100)={'syztnl0\x00', &(0x7f0000000240)={'syztnl1\x00', 0x0, 0x2f, 0x1, 0x5, 0x1, 0x48, @mcast2, @ipv4={'\x00', '\xff\xff', @local}, 0x40, 0x8, 0x1}}) r1 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r1, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5, 0x8}, 0x0, 0x0, 0x9, 0x7, 0x7fffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f0000062c40)={0x8000000000, [], 0x0, "00001000"}) r2 = creat(&(0x7f0000000140)='./bus\x00', 0x0) io_setup(0x1, &(0x7f0000000180)=0x0) io_submit(r3, 0x45, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000000000, 0x0, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) fallocate(r0, 0x3, 0x0, 0x100000fe) [ 2935.103252][ C1] sd 0:0:1:0: [sg0] tag#647 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2935.113659][ C1] sd 0:0:1:0: [sg0] tag#647 CDB: opcode=0xe5 (vendor) [ 2935.120447][ C1] sd 0:0:1:0: [sg0] tag#647 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2935.129928][ C1] sd 0:0:1:0: [sg0] tag#647 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2935.139552][ C1] sd 0:0:1:0: [sg0] tag#647 CDB[20]: ba [ 2935.147390][ C0] sd 0:0:1:0: [sg0] tag#648 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2935.157770][ C0] sd 0:0:1:0: [sg0] tag#648 CDB: opcode=0xe5 (vendor) [ 2935.164551][ C0] sd 0:0:1:0: [sg0] tag#648 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2935.174210][ C0] sd 0:0:1:0: [sg0] tag#648 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2935.183963][ C0] sd 0:0:1:0: [sg0] tag#648 CDB[20]: ba 05:06:03 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef0d0001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) [ 2935.240949][ C0] sd 0:0:1:0: [sg0] tag#649 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2935.251242][ C0] sd 0:0:1:0: [sg0] tag#649 CDB: opcode=0xe5 (vendor) [ 2935.258015][ C0] sd 0:0:1:0: [sg0] tag#649 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2935.267512][ C0] sd 0:0:1:0: [sg0] tag#649 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2935.276994][ C0] sd 0:0:1:0: [sg0] tag#649 CDB[20]: ba 05:06:03 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef0e0001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:06:04 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef0f0001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:06:04 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef100001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:06:04 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef110001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:06:04 executing program 1: r0 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ftruncate(0xffffffffffffffff, 0x0) lseek(r0, 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000040)) r1 = getpgid(0x0) perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, r1, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$RTC_WKALM_SET(r0, 0x4028700f, &(0x7f0000000000)={0x1, 0x0, {0x10, 0x3b, 0x1, 0x1a, 0x9, 0x3, 0x0, 0xcc, 0x1}}) socket$inet6_udp(0xa, 0x2, 0x0) r2 = fsmount(r0, 0x0, 0x71) r3 = openat2(0xffffffffffffffff, &(0x7f00000001c0)='./bus\x00', 0x0, 0x0) sendto$inet6(r3, &(0x7f0000000300), 0x0, 0x0, 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r2, 0x89f2, &(0x7f0000000100)={'syztnl0\x00', &(0x7f0000000240)={'syztnl1\x00', 0x0, 0x2f, 0x1, 0x5, 0x1, 0x48, @mcast2, @ipv4={'\x00', '\xff\xff', @local}, 0x40, 0x8, 0x1, 0x2}}) r4 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r4, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f0000062c40)={0x8000000000, [], 0x0, "00001000"}) r5 = creat(&(0x7f0000000140)='./bus\x00', 0x0) io_setup(0x1, &(0x7f0000000180)=0x0) io_submit(r6, 0x45, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000000000, 0x0, 0x1, 0x0, r5, &(0x7f0000000000), 0x377140be6b5ef4c7}]) fallocate(r0, 0x3, 0x0, 0x100000fe) 05:06:04 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef140001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) [ 2935.936597][ C1] sd 0:0:1:0: [sg0] tag#653 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2935.947280][ C1] sd 0:0:1:0: [sg0] tag#653 CDB: opcode=0xe5 (vendor) [ 2935.954071][ C1] sd 0:0:1:0: [sg0] tag#653 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2935.963554][ C1] sd 0:0:1:0: [sg0] tag#653 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2935.973047][ C1] sd 0:0:1:0: [sg0] tag#653 CDB[20]: ba 05:06:05 executing program 4: r0 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ftruncate(0xffffffffffffffff, 0x0) lseek(r0, 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000040)) r1 = getpgid(0x0) perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, r1, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$RTC_WKALM_SET(r0, 0x4028700f, &(0x7f0000000000)={0x1, 0x0, {0x10, 0x3b, 0x1, 0x1a, 0x9, 0x3, 0x0, 0xcc, 0x1}}) socket$inet6_udp(0xa, 0x2, 0x0) fsmount(r0, 0x0, 0x71) r2 = openat2(0xffffffffffffffff, &(0x7f00000001c0)='./bus\x00', 0x0, 0x0) sendto$inet6(r2, &(0x7f0000000300), 0x0, 0x0, 0x0, 0x0) r3 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r3, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5, 0x8}, 0x0, 0x0, 0x9, 0x7, 0x7fffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f0000062c40)={0x8000000000, [], 0x0, "00001000"}) r4 = creat(&(0x7f0000000140)='./bus\x00', 0x0) io_setup(0x1, &(0x7f0000000180)=0x0) io_submit(r5, 0x45, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000000000, 0x0, 0x1, 0x0, r4, &(0x7f0000000000), 0x377140be6b5ef4c7}]) fallocate(r0, 0x3, 0x0, 0x100000fe) 05:06:05 executing program 2: r0 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ftruncate(0xffffffffffffffff, 0x0) lseek(r0, 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000040)) getpgid(0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat2(0xffffffffffffffff, &(0x7f00000001c0)='./bus\x00', 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000100)={'syztnl0\x00', &(0x7f0000000240)={'syztnl1\x00', 0x0, 0x2f, 0x1, 0x5, 0x1, 0x48, @mcast2, @ipv4={'\x00', '\xff\xff', @local}, 0x40, 0x8, 0x1}}) r1 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r1, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5, 0x8}, 0x0, 0x0, 0x9, 0x7, 0x7fffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f0000062c40)={0x8000000000, [], 0x0, "00001000"}) r2 = creat(&(0x7f0000000140)='./bus\x00', 0x0) io_setup(0x1, &(0x7f0000000180)=0x0) io_submit(r3, 0x45, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000000000, 0x0, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) fallocate(r0, 0x3, 0x0, 0x100000fe) 05:06:05 executing program 5: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f00000004c0)=ANY=[], 0x208e24b) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r2 = syz_io_uring_setup(0x70c4, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000400000/0xc00000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000000)=0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000180)=@IORING_OP_LINK_TIMEOUT={0xf, 0xa89a1c1bd660819, 0x0, 0x0, 0x0, &(0x7f0000000140)}, 0x0) r5 = dup(r2) syz_io_uring_submit(r3, r4, &(0x7f0000000040)=@IORING_OP_CONNECT={0x10, 0x0, 0x0, r5, 0x0, 0x0}, 0x1) io_uring_enter(r5, 0x6700, 0x0, 0x0, 0x0, 0x0) openat$pidfd(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) recvmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000004c80)={0x77359400}) r6 = syz_open_dev$tty1(0xc, 0x4, 0x1) r7 = syz_open_procfs(0x0, &(0x7f0000000240)='mountinfo\x00') sendfile(r6, r7, 0x0, 0x800000080004103) pidfd_send_signal(r1, 0xa, &(0x7f00000006c0)={0x2f, 0x8, 0x20}, 0x0) ioctl$BTRFS_IOC_FS_INFO(r6, 0x8400941f, &(0x7f00000002c0)) setresgid(0x0, 0x0, 0x0) r8 = syz_open_dev$loop(&(0x7f00000000c0), 0x1000, 0x84000) ioctl$EXT4_IOC_MIGRATE(r8, 0x6609) r9 = socket$nl_xfrm(0x10, 0x3, 0x6) sendfile(r9, r1, 0x0, 0x100000002) 05:06:05 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef2e0001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:06:05 executing program 0: r0 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ftruncate(0xffffffffffffffff, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(0xffffffffffffffff, 0x40086602, &(0x7f0000000040)) perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000100)={'syztnl0\x00', &(0x7f0000000240)={'syztnl1\x00', 0x0, 0x2f, 0x1, 0x5, 0x1, 0x48, @mcast2, @ipv4={'\x00', '\xff\xff', @local}, 0x40, 0x8, 0x1, 0x2}}) r1 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r1, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f0000062c40)={0x8000000000, [], 0x0, "00001000"}) r2 = creat(&(0x7f0000000140)='./bus\x00', 0x0) io_setup(0x1, &(0x7f0000000180)=0x0) io_submit(r3, 0x45, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000000000, 0x0, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) fallocate(r0, 0x3, 0x0, 0x100000fe) 05:06:05 executing program 1: r0 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ftruncate(0xffffffffffffffff, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(0xffffffffffffffff, 0x40086602, &(0x7f0000000040)) perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000100)={'syztnl0\x00', &(0x7f0000000240)={'syztnl1\x00', 0x0, 0x2f, 0x1, 0x5, 0x1, 0x48, @mcast2, @ipv4={'\x00', '\xff\xff', @local}, 0x40, 0x8, 0x1, 0x2}}) r1 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r1, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f0000062c40)={0x8000000000, [], 0x0, "00001000"}) r2 = creat(&(0x7f0000000140)='./bus\x00', 0x0) io_setup(0x1, &(0x7f0000000180)=0x0) io_submit(r3, 0x45, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000000000, 0x0, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) fallocate(r0, 0x3, 0x0, 0x100000fe) 05:06:05 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef330001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:06:05 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef4b0001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:06:05 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef640001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:06:05 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53effe0001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:06:05 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef840301000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:06:05 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef030401000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:06:06 executing program 0: r0 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ftruncate(0xffffffffffffffff, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(0xffffffffffffffff, 0x40086602, &(0x7f0000000040)) perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000100)={'syztnl0\x00', &(0x7f0000000240)={'syztnl1\x00', 0x0, 0x2f, 0x1, 0x5, 0x1, 0x48, @mcast2, @ipv4={'\x00', '\xff\xff', @local}, 0x40, 0x8, 0x1, 0x2}}) r1 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r1, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f0000062c40)={0x8000000000, [], 0x0, "00001000"}) r2 = creat(&(0x7f0000000140)='./bus\x00', 0x0) io_setup(0x1, &(0x7f0000000180)=0x0) io_submit(r3, 0x45, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000000000, 0x0, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) fallocate(r0, 0x3, 0x0, 0x100000fe) 05:06:06 executing program 1: r0 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ftruncate(0xffffffffffffffff, 0x0) lseek(0xffffffffffffffff, 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(0xffffffffffffffff, 0x40086602, &(0x7f0000000040)) perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000100)={'syztnl0\x00', &(0x7f0000000240)={'syztnl1\x00', 0x0, 0x2f, 0x1, 0x5, 0x1, 0x48, @mcast2, @ipv4={'\x00', '\xff\xff', @local}, 0x40, 0x8, 0x1, 0x2}}) r1 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r1, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f0000062c40)={0x8000000000, [], 0x0, "00001000"}) r2 = creat(&(0x7f0000000140)='./bus\x00', 0x0) io_setup(0x1, &(0x7f0000000180)=0x0) io_submit(r3, 0x45, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000000000, 0x0, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) fallocate(r0, 0x3, 0x0, 0x100000fe) 05:06:06 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef1c0401000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:06:06 executing program 5: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f00000004c0)=ANY=[], 0x208e24b) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r2 = syz_io_uring_setup(0x70c4, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000400000/0xc00000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000000)=0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000180)=@IORING_OP_WRITEV={0x2, 0x5, 0x4007, @fd=r2, 0x5, &(0x7f0000000640)=[{&(0x7f0000000940)="2d203c7264a564634a25e1b01260189176530e46841e87a1dee4039047acb038b4b2639986e97adc5a13f03a4c312a5ea68a4992dc4f154321251b2d267f97ae12a63753e5b83db8ad431acec37138c0311c34dd7a8d9fc353f0dd82efd8d5890af64d46c555bc81e8da12a79a7e2104cfcccd02b5b57db0e2d0ad6ef7cd2109dc73dbe9e12e13035b1202663b385dd10ddff308ae7bf2b82503dcc89d6f6ba70c79f916c25c99a6f0c862e8f3e16a4a433646ebd981ecb03e7d735e25e4a085f99322c5ea7290848489687aa438c18779d8fe4d9d4865b3c11119b26cffead5cab3ce024cabfc493f5419e56513135ee0e10fe7f933741ddf1ab0a9e4e8b861f80061e67e3117c8cc0b4143a008cea04bed6f19fbbf91f0fe436c9b5cce0d07c36b117b0a6e42e8d7039217511b8183746ddc1af5dd346158ce61feaab8a153a25ac4248328c02ec1030129aaf44e7d6385a4fcac6b53da55099bca99f0bff3ca64dd7aaec256d6a1c83d004c424c5f9109ece5561ac6b1952685567615945c13d966d757adb43dbb9c59b2006546c9440db1fd784b54f49c437d0b0c02bcb209bab66c8c51ba64f90bc1e8662be86f3eee981c9220a8cd03684699dbe1c1729570e1ba95e1b4429c2cd39b45811cd5346bd1bad024ae5938f37f6b1ab36fb97b79a35655a535e338989ff9e93a7cdbaa389abce0f9c6330d27ca914a84e0887efbc5c591fd29ffb7df4934e766fde9881c62a87bb91e3f864fca6dc5ad61ea008e6ffa0d728f862f1487a063e6f43513dc82870616a2fa63f730c1bb6c619b0a39f86934e9f2d5ff9b7ffabb6f863700944c418a7e3f2ef86b5155e35f707c9e9ff708a210cf9d0037baad2ab2823647d9ab6299366335bba45985acfc7a0012f5a272cfd1f620c48561d288a0733be75c6c43266cf0d662d7c97f329813586f7c6097b5b6040138b711417d44c3edcf3e9830f92b150d54d68db1c03cb4f2668b345d714fa290a8160fe118fce6903f62729670139297124a9bcb69668bf8480f54b2e8e3270a6b3b5abba477857d996e8152d1485e5ae715613c6854e28954a34f5d19799fb7fb7010be72b4ce24bfc4e69f477dad677d2b3e6f1887ebf77caae14d1a0b3ea3c9eeca6ea68735dac3fedc0c437226519848c6f49f4ebcbfe8e2decf33035fe14f7cdd96d4cfcb417c1a20f19da807d1f0af4463e373d07f38627bcb72a1460b3939aff25eb200bc6a0db9f3c83301cee16dd2167c38b945a25855b5d0dc1e3b394dbbaaa02e7fef6eef0f985003334fef26840c8a29f41595ac81ef6be69bb2da63007474811677de13790d030990590bd481ab313d378d52acb946f25002b6d692d6d9f40c9b46fc52718b77370137b72e6d86f6ad58f96aa539ca4424504d336bfd9b30b02fd005fa0dcdfe3cd8c44de84766bd612a8e374fdb0da38cac5766a8fdc86751c42077ecc0e27ec147a220420aeb9f33266394a17f7b80fbc04a9450c783f0345d1f624d64b271c9647796495ae4211640b054675432b278565ee93742af2f1c2a67f7839fbfc8fa366d09190d271ab5584a3c42dfb2efc6a7beb13ae42bc9e05d589b9a0af68590e1cd5b03a774a0bf9d004ad908c76557ba30e2690d36fd706dcd2225e05bcc73d68133690e771701c98a286658438243d932ea6e203f7b1061f5aae2ed0c6dab14931e2bb9e4d3e4fdb517d61c1b1dd2a69191c582ab5eb3747f66fd0f537d5686bd5b2f1883d66f0dae3b9fc5415c6d58c6bd1800f52669e83f55d6e9603734fbb224fdeb2f3444099e4c6692c283023e117b5f2ac5aa814ff9cdcf80d439b899012ef35abe041c442aacac4a31322051efb9302322e885c466c60738ef8e1292d2942f1b31ea7b2da52fb7004d9698d3d0b3f004fe5ca693d91fd5b9267a10d33d744b74ab0411a57f0a47e1b83968b232dd1ad77fdce9d9170e23e1272f9d2e25eaefa9fcb3b5d8d9037de72502c333aabb25714efbd59a61ff27e64b3a8ba85279a95dad84ba3055b001f4135e2c5425fe10ffe246e34246a44958f5ec8915cae22fd204b34b8f995725ad5fadb4b74ecdce1d1797d4a167c2d0c9e44f1ea087fe63dcfee318f916d8bbb3e02f9b91bf0a17dab8b2565e7b9d4a3716448fbc48ec41248a1e1b7f7eecd6c65446d2e7d516257160b04abbe7b2c67395cb145c49e6fd0b5c03e20ea1a6861672253c6f6f9404cd4eca9f62407d1e37c1693357081d26b61ad0417e2f0cffd17c14df60c63e91cb4ce1194b33a03c84fe896f5c20b9fa56c25f8735ca29fae35db2276839e67213dbfcc9321d6bca295f79800bd274e80677b3034c6eb98e9e6222f0e7c275b1739a3110d43a27682f58ee673bc9f3150a93643c85eec8545998c490ea928abb588ccaae2127d84fc0bd0e95995e3f0b381a989e2d7f8884fb47bb9447c604c65b9ce510a42b33621c32f08f8112527542bdd735d5eb40cb972f3b094f83f00c99d96f51e51b3bb8167f53051dc529198ef2b97ce187e1f58eba591ec2a7b60d80a09b7f102960d9e333005b660601d00a4545ad00d2bdcfe1916772a6ed0f68a969107761749eb5d993c9abf9ca9fac88a4bdd74e9ee0435f932fc2f915211d1bdd83b981d406f55f08b1109285c32ac1ff90eab8989933ff0801c880d880e3bf0043ae800299a9cf1d154c29962d403017f841f3dec9b5fc5b80ca6fc402980aeefd78691275f17e2d75b5c27cf291e25d165eb603f128b5c6f1c137eeb9f814673af716a5c4827ad3a897ce5fddfe675d9e6f2d2c6fba07f925c0c77779178b140371b63ca269ab2be4e9b931b6adc20f51bdeaa7a81b871ef623393d38c4c43e937196d4122717d1bbe45cc82c4eb91e949fa6961c30cc75aba82b1bd529fcd5d5fcc285d039ea7a436ee8a4d7881133eb2b18684e0e3990e8b7aa34d41fe8a219e615c2a287b331af08faa550ec678d81098d3a305295092e5b6b03e179653afb1c52ebe91759a423eb0ae55646a839f802376dabcc49a6db98e5a8ab348a714a4bd26b5e0dc8cb1d5d1266d68b3fc2e251502789b01cf45984bcbe9bfb8ffab75a8171fc0177668fd8d38ceab9b2db2f7ca77512476d920dd57b010dbdddc3776192574076263f354ee2f0e910ba73ee70c23f9fa8df2dfb10d0b4d1f1da6326d08d99f79919807930933c5f7f8f3f1750df6fca41cbce1bccac2fe32a47f42025f7120fd874768631ed2c534357287b19605f286cbfdb62a676e78484db84cdb5c77fe5dcedda0a45066a270e439474037c4b0acb81a60e8b35ec6a3224f6448f564cca6b4029206acafca917ddc0d7eed2558e3ab7ef3bff8bebb1eac5d6de6724c9f247d1e80e4b20941d706b1fb6dca334e177d2b3c2e593c1f2d7e644b9092c98468eff4902419ee779b579d01f4a1e903a409e303dc34b21cf7ff44f3a44c6eedc6343e5a0534e5b6b239f4cd105f961b45c95a62988edf4aa06963694b051ad6a72501fa29f5b3f2ccebd6dae30fa2b8a3f7f2707b62763d4a910fe226f725ce96ec6f47a25a7fef40108d2a41aaf574ff3f59a4be9f596d56a6e8db781625560486f4183de489ec0c6875d53d729e93ac49e6638be20a72467aa922091be24e1a33f6873300554e5ebe279f4fae13739edd6129bd2bd7f81b22346052a3f1fb4b6f66690c8bdec9a2d4275b32e37ff685289364d59a802c16d5570316ec3e57da50c73d398c8b7396b08597685fd41f9bfbd7d913a67f5bd1946411b7962746ecbf21522ab8a6a4a030ad270d1717ba67f1fe801ad757306625893b6340dc017ee724e3837689b0d360d7559c87ef741726c72400b5730d5d05e9a6824f1e2790e00b892336e433a533f8f39cb1dfc79b4192bb888480673b64007b9809b5939520a9c85191dfdee146cf3507296fc0c0563207936e342f984fbc02d268bac58c75a84721e76df4f87459d0a5ff6759ccedb7c16ffdf565b9e8affbfe52e69606103d3b51baf09b7dfdb9802e2d15dcdc0d03b7843e4d745c04f084a8194d8d0536e50432e0e1dff11f13b97e5990960808412323cf7a016e222629bab4046d7dcc810683b86fb451996d18992cdeb513c816e194a7f4c3c14efd60f3d04e31ee799c7c397a48e0401adba4498c46d3fef7201a05798f49d6ffa4f61c61e3ce6e6a93f53cbaa1f8ae3222f82888a9cfbcfdead4dc4231a86d30debdd7d91713e125b7bbe60a074a140ef15770c58d2594bc1c39e26f5601a2197f8986564648a79fd1c6c576fc1bced875f52d710d69ad7834860d03bec7de364a6381761725f50ea0373c8924f6699d0cdc526884008ed6d830d5f1320e5e6bed94e5b0c60e8ecee7e1b723e0c25190b382fba11b8a8e0880a89dc7e83b3c8ddfd07753fbacc93b54a601f42d9d84e92f423f9d8e4ccc5edb93938c4e3876d9ea9bcf93bfa52d0c108f07bdbb7679e407539c5957a0a754300ce89e2ab63efabb76248b7ae8f91a4f49e1f9e65381e8ee3d1f0743ed0f4f9349a801726402748b3e483b77923365603c95e443222e0e4ad7d99c6868f701df798fbcd6b8ce054549e456d07410742b145157c5c868f2d8470dabf8b30fb90ecb525565d8de7820b8ed980c69e4b61e36e29903f6425f307ca0ae10ae4aa62ffc9e1ca762314803d94609828c50c26bc80c96c49238a59bd6eb60ea2e5cbc22b0fcaf96820c43439f2b708024e08a600b77ba34e732575f7a56c5786150118a6066379b2c36521c5b9cb134a0bb37c0e24a6da6d981fbb2e709d714bc02fb32f8144623b5dd40ec01baea531ab274a60d8af18146bcd0ba808b26fd7c92d4cd808d0d13755f19dff5b672ef5db0e48f81c7d939a8a3f88ae9934a5846f5fcc1d3882f6e3258827d86565c945913f443d63a89e17373262df987e8d17faa849883fc0ff5a1544428059bedf9d63578086321ef7138423b1dee66b31bf44c3755cfcc562b87175653cc275bddd72cac3538459b35a5e3aa1c6a35346c0b6104d023b071d2eae5e7455cee947c7f18ee9b5ca7401545a454402c61efc93f7a3b97480a3e4f31c3176363b00284cb54146808baf3e9aa810daab454a89624e10cb4526acdcbe6f0b1e0e5d09d0e2ff131d84fd7625359f4ac5739dc9a1ae228efbddde5f935750fcc5f345d110d19bab3326f71493c8d42ea2d4e6a3efae1e19aa58bfebd0fefa29a75a03151357c4b7ab684b47dcf6506129ccba6d20d7d56419d2d59a014662683d9023d8ef711725aa2c3d7a5ccf32b87c4ad23d4a950b7ff87d76288c2684d5dc1ed9d479dfe7bbb13a041b7866f855ba7c45ee39ea12a7584f1014ca5b0330da14269d1ac050e8b7137b9a2a9bd7ff59362d37b38ed16cff5dd49c80f482a6ee86495bcc6af70c1316607f393f0e930cf2ee9470d6380f8581b197df8d34af9ae24834263e9b3a55ff8afdff6a824ab5e711fa8b5847452dfca6e20dcc822b1b6985c61127aeaff43a6eb7eb41e36212e9193e14b58c6112e766c7ed494a208759d435f266ba494b7ba74ba9b7e2aab934aa5374f69c5ed642f0f07cb38c0867948befa63eb7c51962d3633a43246f214dc65b9b2859dd5db2ccc4f99f5c7127e398ceb82c8b52733d79af0799651d96ad2e9524afa1ca542c719fb5b9a3407897f9786ef5bd55dfd12d8f3cf7f3907ee4d148ac420c3494b90ad552ce57955515e474e415f85b9f74cda3ae559a8bde7448cb2189201c06ef96727e5023ffd7be9cf67c44cd16a9620573b3b727e4858704d672c6", 0x1000}, {&(0x7f0000000380)="53d75fd94e84511365b0cd31d32eb996b7a0a9ab64b1e68d804d79f36a01109651c4ecb570e0e886775ccfd7fe230a99b2555a3d6c0624f1bfbccc86c838fbb22f418ce69a9f58b8e1d2610605437617dc5b671c478f8e224e78d0c9e90a74bdcb1f8b3ec6e858e0f534d39f2937e3de62f22f8b25c367b4adde1451f44e820a3f0eb021a94f427e7f56973e9a3b77625b28f1f999", 0x95}, {&(0x7f0000000440)="c4ac3a7cdbbb8630529d0d0758962b11db7f3e66c05ad4f14b4104678ae845155f3be9268d0f67ad9ebdfd8d36219bea82f9e5a071fab89cdf00e7cca23081620f83044cb979112e740fcfe911bdd81b024d373d38afcb49446af241b008a049aafce68c87c3c694208a9299388d04035e5b7eb65a82c47a996e4fc6d2a43ecd5953e9b7447a8708a6cc6b04ae948bfab31e683a4353b82411ecef888d70391eb4ae0f5da96a22686e4ed64fbf12f5ab3b1b89367ed44b1113af7bccf42dac4aa67542373e14c8f8c8733bf551f629706b829f0e64235f7447c81ef5c0109d40f1f0c02c", 0xe4}, {&(0x7f0000000540)="df854400fb0e50dfd03974f03cffa442bd79f7faf1050c622c98bd6b4ccbfc4d5ec923163b43b9717bb9fa9ea036240602d79d46c4ea02505fbc2ef435031e3017e13cbdb8f4934fdaa14fe127dd5228c98102f741b2a643e8b0dd940ef94e586a69a4fa87", 0x65}, {&(0x7f00000005c0)="64fadd3b30d70ced4fa72416694e2e54864a9771e7de0303f8bae320ace4f1813843226bdc49dda297c1afc68a8dc80ce9d4a707c0c38f177d856fc11d1e68f954b1ce38feb09f1afbd6497bc09f397300437f3ff25a60", 0x57}], 0x5, 0x0, 0x1}, 0x0) r5 = syz_io_uring_setup(0x7bd6, &(0x7f0000000100), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000400000/0xc00000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) io_uring_register$IORING_REGISTER_PERSONALITY(r5, 0x9, 0x0, 0x0) io_uring_register$IORING_UNREGISTER_PERSONALITY(r5, 0xa, 0x0, 0x0) r6 = syz_io_uring_setup(0x7bd6, &(0x7f0000000100), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000400000/0xc00000)=nil, &(0x7f00000002c0), &(0x7f00000001c0)) r7 = io_uring_register$IORING_REGISTER_PERSONALITY(r6, 0x9, 0x0, 0x0) io_uring_register$IORING_UNREGISTER_PERSONALITY(r5, 0xa, 0x0, r7) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000340)=@IORING_OP_FSYNC={0x3, 0x3, 0x0, @fd, 0x0, 0x0, 0x0, 0x1, 0x0, {0x0, r7}}, 0x401) r8 = dup(r2) syz_io_uring_submit(r3, r4, &(0x7f0000000040)=@IORING_OP_CONNECT={0x10, 0x0, 0x0, r8, 0x0, 0x0}, 0x1) io_uring_enter(r8, 0x6700, 0x0, 0x0, 0x0, 0x0) openat$pidfd(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) recvmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000004c80)={0x77359400}) setresgid(0x0, 0x0, 0x0) r9 = socket$nl_xfrm(0x10, 0x3, 0x6) sendfile(r9, r1, 0x0, 0x100000002) 05:06:06 executing program 2: r0 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ftruncate(0xffffffffffffffff, 0x0) lseek(r0, 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000040)) getpgid(0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat2(0xffffffffffffffff, &(0x7f00000001c0)='./bus\x00', 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000100)={'syztnl0\x00', &(0x7f0000000240)={'syztnl1\x00', 0x0, 0x2f, 0x1, 0x5, 0x1, 0x48, @mcast2, @ipv4={'\x00', '\xff\xff', @local}, 0x40, 0x8, 0x1}}) r1 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r1, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5, 0x8}, 0x0, 0x0, 0x9, 0x7, 0x7fffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f0000062c40)={0x8000000000, [], 0x0, "00001000"}) r2 = creat(&(0x7f0000000140)='./bus\x00', 0x0) io_setup(0x1, &(0x7f0000000180)=0x0) io_submit(r3, 0x45, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000000000, 0x0, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) fallocate(r0, 0x3, 0x0, 0x100000fe) 05:06:06 executing program 4: r0 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ftruncate(0xffffffffffffffff, 0x0) lseek(r0, 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000040)) r1 = getpgid(0x0) perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, r1, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$RTC_WKALM_SET(r0, 0x4028700f, &(0x7f0000000000)={0x1, 0x0, {0x10, 0x3b, 0x1, 0x1a, 0x9, 0x3, 0x0, 0xcc, 0x1}}) socket$inet6_udp(0xa, 0x2, 0x0) fsmount(r0, 0x0, 0x71) r2 = openat2(0xffffffffffffffff, &(0x7f00000001c0)='./bus\x00', 0x0, 0x0) sendto$inet6(r2, &(0x7f0000000300), 0x0, 0x0, 0x0, 0x0) r3 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r3, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5, 0x8}, 0x0, 0x0, 0x9, 0x7, 0x7fffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f0000062c40)={0x8000000000, [], 0x0, "00001000"}) r4 = creat(&(0x7f0000000140)='./bus\x00', 0x0) io_setup(0x1, &(0x7f0000000180)=0x0) io_submit(r5, 0x45, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000000000, 0x0, 0x1, 0x0, r4, &(0x7f0000000000), 0x377140be6b5ef4c7}]) fallocate(r0, 0x3, 0x0, 0x100000fe) [ 2937.725080][ C0] scsi_io_completion_action: 4 callbacks suppressed [ 2937.725108][ C0] sd 0:0:1:0: [sg0] tag#653 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2937.741378][ C1] sd 0:0:1:0: [sg0] tag#654 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2937.742396][ C0] sd 0:0:1:0: [sg0] tag#653 CDB: opcode=0xe5 (vendor) [ 2937.752793][ C1] sd 0:0:1:0: [sg0] tag#654 CDB: opcode=0xe5 (vendor) [ 2937.759631][ C0] sd 0:0:1:0: [sg0] tag#653 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2937.766476][ C1] sd 0:0:1:0: [sg0] tag#654 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2937.776110][ C0] sd 0:0:1:0: [sg0] tag#653 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2937.785536][ C1] sd 0:0:1:0: [sg0] tag#654 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2937.794970][ C0] sd 0:0:1:0: [sg0] tag#653 CDB[20]: ba [ 2937.810093][ C1] sd 0:0:1:0: [sg0] tag#654 CDB[20]: ba 05:06:06 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef000501000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) [ 2937.975077][ C1] sd 0:0:1:0: [sg0] tag#655 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2937.985422][ C1] sd 0:0:1:0: [sg0] tag#655 CDB: opcode=0xe5 (vendor) [ 2937.992208][ C1] sd 0:0:1:0: [sg0] tag#655 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2938.001791][ C1] sd 0:0:1:0: [sg0] tag#655 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2938.011309][ C1] sd 0:0:1:0: [sg0] tag#655 CDB[20]: ba 05:06:06 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef000601000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) [ 2938.073614][ C0] sd 0:0:1:0: [sg0] tag#656 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2938.083920][ C0] sd 0:0:1:0: [sg0] tag#656 CDB: opcode=0xe5 (vendor) [ 2938.090735][ C0] sd 0:0:1:0: [sg0] tag#656 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2938.100210][ C0] sd 0:0:1:0: [sg0] tag#656 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2938.109852][ C0] sd 0:0:1:0: [sg0] tag#656 CDB[20]: ba 05:06:06 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef001401000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:06:06 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53efff1f01000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:06:06 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef002001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:06:06 executing program 2: r0 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ftruncate(0xffffffffffffffff, 0x0) lseek(r0, 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000040)) getpgid(0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat2(0xffffffffffffffff, &(0x7f00000001c0)='./bus\x00', 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000100)={'syztnl0\x00', &(0x7f0000000240)={'syztnl1\x00', 0x0, 0x2f, 0x1, 0x5, 0x1, 0x48, @mcast2, @ipv4={'\x00', '\xff\xff', @local}, 0x40, 0x8, 0x1, 0x2}}) r1 = syz_open_dev$sg(0x0, 0x0, 0x0) ioctl$SG_IO(r1, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5, 0x8}, 0x0, 0x0, 0x9, 0x7, 0x7fffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f0000062c40)={0x8000000000, [], 0x0, "00001000"}) r2 = creat(&(0x7f0000000140)='./bus\x00', 0x0) io_setup(0x1, &(0x7f0000000180)=0x0) io_submit(r3, 0x45, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000000000, 0x0, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) fallocate(r0, 0x3, 0x0, 0x100000fe) 05:06:07 executing program 4: r0 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ftruncate(0xffffffffffffffff, 0x0) lseek(r0, 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000040)) r1 = getpgid(0x0) perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, r1, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$RTC_WKALM_SET(r0, 0x4028700f, &(0x7f0000000000)={0x1, 0x0, {0x10, 0x3b, 0x1, 0x1a, 0x9, 0x3, 0x0, 0xcc, 0x1}}) socket$inet6_udp(0xa, 0x2, 0x0) fsmount(r0, 0x0, 0x71) r2 = openat2(0xffffffffffffffff, &(0x7f00000001c0)='./bus\x00', 0x0, 0x0) sendto$inet6(r2, &(0x7f0000000300), 0x0, 0x0, 0x0, 0x0) r3 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r3, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5, 0x8}, 0x0, 0x0, 0x9, 0x7, 0x7fffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f0000062c40)={0x8000000000, [], 0x0, "00001000"}) r4 = creat(&(0x7f0000000140)='./bus\x00', 0x0) io_setup(0x1, &(0x7f0000000180)=0x0) io_submit(r5, 0x45, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000000000, 0x0, 0x1, 0x0, r4, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:06:07 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef008101000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:06:07 executing program 0: r0 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ftruncate(0xffffffffffffffff, 0x0) lseek(r0, 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(0xffffffffffffffff, 0x40086602, 0x0) perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000100)={'syztnl0\x00', &(0x7f0000000240)={'syztnl1\x00', 0x0, 0x2f, 0x1, 0x5, 0x1, 0x48, @mcast2, @ipv4={'\x00', '\xff\xff', @local}, 0x40, 0x8, 0x1, 0x2}}) r1 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r1, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f0000062c40)={0x8000000000, [], 0x0, "00001000"}) r2 = creat(&(0x7f0000000140)='./bus\x00', 0x0) io_setup(0x1, &(0x7f0000000180)=0x0) io_submit(r3, 0x45, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000000000, 0x0, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) fallocate(r0, 0x3, 0x0, 0x100000fe) 05:06:07 executing program 1: r0 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ftruncate(0xffffffffffffffff, 0x0) lseek(r0, 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000040)) r1 = getpgid(0x0) perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, r1, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$RTC_WKALM_SET(r0, 0x4028700f, &(0x7f0000000000)={0x1, 0x0, {0x10, 0x3b, 0x1, 0x1a, 0x9, 0x3, 0x0, 0xcc, 0x1}}) socket$inet6_udp(0xa, 0x2, 0x0) r2 = fsmount(r0, 0x0, 0x71) r3 = openat2(0xffffffffffffffff, &(0x7f00000001c0)='./bus\x00', 0x0, 0x0) sendto$inet6(r3, &(0x7f0000000300), 0x0, 0x0, 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(r2, 0x89f2, &(0x7f0000000100)={'syztnl0\x00', &(0x7f0000000240)={'syztnl1\x00', 0x0, 0x2f, 0x1, 0x5, 0x1, 0x48, @mcast2, @ipv4={'\x00', '\xff\xff', @local}, 0x40, 0x8, 0x1, 0x2}}) r4 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r4, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f0000062c40)={0x8000000000, [], 0x0, "00001000"}) r5 = creat(&(0x7f0000000140)='./bus\x00', 0x0) io_setup(0x1, &(0x7f0000000180)=0x0) io_submit(r6, 0x45, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000000000, 0x0, 0x1, 0x0, r5, &(0x7f0000000000), 0x377140be6b5ef4c7}]) fallocate(r0, 0x3, 0x0, 0x100000fe) 05:06:07 executing program 5: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f00000004c0)=ANY=[], 0x208e24b) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) openat$cgroup_ro(r1, &(0x7f00000000c0)='cpuset.effective_mems\x00', 0x0, 0x0) r2 = syz_io_uring_setup(0x10070c4, &(0x7f0000000240), &(0x7f000041d000/0x3000)=nil, &(0x7f0000400000/0xc00000)=nil, &(0x7f0000000200)=0x0, &(0x7f0000000000)=0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000180)=@IORING_OP_LINK_TIMEOUT={0xf, 0xa89a1c1bd660819, 0x0, 0x0, 0x0, &(0x7f0000000140)}, 0x0) r5 = dup(r2) syz_io_uring_submit(r3, r4, &(0x7f0000000040)=@IORING_OP_CONNECT={0x10, 0x0, 0x0, r5, 0x0, 0x0}, 0x1) io_uring_enter(r5, 0x6700, 0x0, 0x0, 0x0, 0x0) openat$pidfd(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) recvmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000004c80)={0x77359400}) setresgid(0x0, 0x0, 0x0) r6 = socket$nl_xfrm(0x10, 0x3, 0x6) sendfile(r6, r1, 0x0, 0x100000002) 05:06:07 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef048201000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) [ 2938.819861][ C1] sd 0:0:1:0: [sg0] tag#713 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2938.830220][ C1] sd 0:0:1:0: [sg0] tag#713 CDB: opcode=0xe5 (vendor) [ 2938.837144][ C1] sd 0:0:1:0: [sg0] tag#713 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2938.846820][ C1] sd 0:0:1:0: [sg0] tag#713 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2938.856296][ C1] sd 0:0:1:0: [sg0] tag#713 CDB[20]: ba [ 2938.864703][ C0] sd 0:0:1:0: [sg0] tag#682 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2938.875067][ C0] sd 0:0:1:0: [sg0] tag#682 CDB: opcode=0xe5 (vendor) [ 2938.881933][ C0] sd 0:0:1:0: [sg0] tag#682 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2938.891797][ C0] sd 0:0:1:0: [sg0] tag#682 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2938.901288][ C0] sd 0:0:1:0: [sg0] tag#682 CDB[20]: ba [ 2938.940208][ C1] sd 0:0:1:0: [sg0] tag#719 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2938.950596][ C1] sd 0:0:1:0: [sg0] tag#719 CDB: opcode=0xe5 (vendor) [ 2938.957383][ C1] sd 0:0:1:0: [sg0] tag#719 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2938.966890][ C1] sd 0:0:1:0: [sg0] tag#719 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2938.976377][ C1] sd 0:0:1:0: [sg0] tag#719 CDB[20]: ba 05:06:07 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef009a01000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:06:07 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef00b101000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:06:07 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53effeff01000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:06:07 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef010200000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:06:07 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef010400000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:06:07 executing program 2: r0 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ftruncate(0xffffffffffffffff, 0x0) lseek(r0, 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000040)) getpgid(0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat2(0xffffffffffffffff, &(0x7f00000001c0)='./bus\x00', 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000100)={'syztnl0\x00', &(0x7f0000000240)={'syztnl1\x00', 0x0, 0x2f, 0x1, 0x5, 0x1, 0x48, @mcast2, @ipv4={'\x00', '\xff\xff', @local}, 0x40, 0x8, 0x1, 0x2}}) r1 = syz_open_dev$sg(0x0, 0x0, 0x0) ioctl$SG_IO(r1, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5, 0x8}, 0x0, 0x0, 0x9, 0x7, 0x7fffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f0000062c40)={0x8000000000, [], 0x0, "00001000"}) r2 = creat(&(0x7f0000000140)='./bus\x00', 0x0) io_setup(0x1, &(0x7f0000000180)=0x0) io_submit(r3, 0x45, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000000000, 0x0, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) fallocate(r0, 0x3, 0x0, 0x100000fe) 05:06:08 executing program 4: r0 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ftruncate(0xffffffffffffffff, 0x0) lseek(r0, 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000040)) r1 = getpgid(0x0) perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, r1, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$RTC_WKALM_SET(r0, 0x4028700f, &(0x7f0000000000)={0x1, 0x0, {0x10, 0x3b, 0x1, 0x1a, 0x9, 0x3, 0x0, 0xcc, 0x1}}) socket$inet6_udp(0xa, 0x2, 0x0) fsmount(r0, 0x0, 0x71) r2 = openat2(0xffffffffffffffff, &(0x7f00000001c0)='./bus\x00', 0x0, 0x0) sendto$inet6(r2, &(0x7f0000000300), 0x0, 0x0, 0x0, 0x0) r3 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r3, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5, 0x8}, 0x0, 0x0, 0x9, 0x7, 0x7fffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f0000062c40)={0x8000000000, [], 0x0, "00001000"}) r4 = creat(&(0x7f0000000140)='./bus\x00', 0x0) io_setup(0x1, &(0x7f0000000180)=0x0) io_submit(r5, 0x45, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000000000, 0x0, 0x1, 0x0, r4, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:06:08 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef010500000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:06:08 executing program 5: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f00000004c0)=ANY=[], 0x208e24b) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r2 = syz_io_uring_setup(0x70c4, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000400000/0xc00000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000000)=0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000180)=@IORING_OP_LINK_TIMEOUT={0xf, 0xa89a1c1bd660819, 0x0, 0x0, 0x0, &(0x7f0000000140)}, 0x0) r5 = dup(r2) syz_io_uring_submit(r3, r4, &(0x7f0000000040)=@IORING_OP_CONNECT={0x10, 0x0, 0x0, r5, 0x0, 0x0}, 0x1) io_uring_enter(r5, 0x6700, 0x0, 0x0, 0x0, 0x0) openat$pidfd(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) recvmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000004c80)={0x77359400}) r6 = openat$random(0xffffffffffffff9c, &(0x7f00000000c0), 0x100, 0x0) preadv(r6, &(0x7f0000000200)=[{&(0x7f00000002c0)=""/176, 0xb0}, {&(0x7f0000000380)=""/79, 0x4f}], 0x2, 0x1, 0x1) setresgid(0x0, 0x0, 0x0) r7 = socket$nl_xfrm(0x10, 0x3, 0x6) sendfile(r7, r1, 0x0, 0x100000002) 05:06:08 executing program 1: r0 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ftruncate(0xffffffffffffffff, 0x0) lseek(r0, 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000040)) r1 = getpgid(0x0) perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, r1, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$RTC_WKALM_SET(r0, 0x4028700f, &(0x7f0000000000)={0x1, 0x0, {0x10, 0x3b, 0x1, 0x1a, 0x9, 0x3, 0x0, 0xcc, 0x1}}) socket$inet6_udp(0xa, 0x2, 0x0) fsmount(r0, 0x0, 0x71) r2 = openat2(0xffffffffffffffff, &(0x7f00000001c0)='./bus\x00', 0x0, 0x0) sendto$inet6(r2, &(0x7f0000000300), 0x0, 0x0, 0x0, 0x0) r3 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r3, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5, 0x8}, 0x0, 0x0, 0x9, 0x7, 0x7fffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f0000062c40)={0x8000000000, [], 0x0, "00001000"}) r4 = creat(&(0x7f0000000140)='./bus\x00', 0x0) io_setup(0x1, &(0x7f0000000180)=0x0) io_submit(r5, 0x45, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000000000, 0x0, 0x1, 0x0, r4, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:06:08 executing program 0: r0 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ftruncate(0xffffffffffffffff, 0x0) lseek(r0, 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(0xffffffffffffffff, 0x40086602, 0x0) perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000100)={'syztnl0\x00', &(0x7f0000000240)={'syztnl1\x00', 0x0, 0x2f, 0x1, 0x5, 0x1, 0x48, @mcast2, @ipv4={'\x00', '\xff\xff', @local}, 0x40, 0x8, 0x1, 0x2}}) r1 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r1, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f0000062c40)={0x8000000000, [], 0x0, "00001000"}) r2 = creat(&(0x7f0000000140)='./bus\x00', 0x0) io_setup(0x1, &(0x7f0000000180)=0x0) io_submit(r3, 0x45, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000000000, 0x0, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) fallocate(r0, 0x3, 0x0, 0x100000fe) 05:06:08 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef010600000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) [ 2940.071198][ C0] sd 0:0:1:0: [sg0] tag#676 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2940.081582][ C0] sd 0:0:1:0: [sg0] tag#676 CDB: opcode=0xe5 (vendor) [ 2940.088375][ C0] sd 0:0:1:0: [sg0] tag#676 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2940.098161][ C0] sd 0:0:1:0: [sg0] tag#676 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2940.107648][ C0] sd 0:0:1:0: [sg0] tag#676 CDB[20]: ba [ 2940.146696][ C1] sd 0:0:1:0: [sg0] tag#757 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2940.157076][ C1] sd 0:0:1:0: [sg0] tag#757 CDB: opcode=0xe5 (vendor) [ 2940.163945][ C1] sd 0:0:1:0: [sg0] tag#757 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2940.167879][ C0] sd 0:0:1:0: [sg0] tag#677 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2940.173412][ C1] sd 0:0:1:0: [sg0] tag#757 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d 05:06:08 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef010800000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) [ 2940.183636][ C0] sd 0:0:1:0: [sg0] tag#677 CDB: opcode=0xe5 (vendor) [ 2940.193075][ C1] sd 0:0:1:0: [sg0] tag#757 CDB[20]: ba [ 2940.199820][ C0] sd 0:0:1:0: [sg0] tag#677 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2940.214839][ C0] sd 0:0:1:0: [sg0] tag#677 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2940.224318][ C0] sd 0:0:1:0: [sg0] tag#677 CDB[20]: ba 05:06:08 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef011400000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:06:08 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef019a00000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:06:08 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef01b100000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:06:08 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef010201000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:06:09 executing program 2: r0 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ftruncate(0xffffffffffffffff, 0x0) lseek(r0, 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000040)) getpgid(0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat2(0xffffffffffffffff, &(0x7f00000001c0)='./bus\x00', 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000100)={'syztnl0\x00', &(0x7f0000000240)={'syztnl1\x00', 0x0, 0x2f, 0x1, 0x5, 0x1, 0x48, @mcast2, @ipv4={'\x00', '\xff\xff', @local}, 0x40, 0x8, 0x1, 0x2}}) r1 = syz_open_dev$sg(0x0, 0x0, 0x0) ioctl$SG_IO(r1, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5, 0x8}, 0x0, 0x0, 0x9, 0x7, 0x7fffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f0000062c40)={0x8000000000, [], 0x0, "00001000"}) r2 = creat(&(0x7f0000000140)='./bus\x00', 0x0) io_setup(0x1, &(0x7f0000000180)=0x0) io_submit(r3, 0x45, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000000000, 0x0, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) fallocate(r0, 0x3, 0x0, 0x100000fe) 05:06:09 executing program 4: r0 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ftruncate(0xffffffffffffffff, 0x0) lseek(r0, 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000040)) r1 = getpgid(0x0) perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, r1, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$RTC_WKALM_SET(r0, 0x4028700f, &(0x7f0000000000)={0x1, 0x0, {0x10, 0x3b, 0x1, 0x1a, 0x9, 0x3, 0x0, 0xcc, 0x1}}) socket$inet6_udp(0xa, 0x2, 0x0) fsmount(r0, 0x0, 0x71) r2 = openat2(0xffffffffffffffff, &(0x7f00000001c0)='./bus\x00', 0x0, 0x0) sendto$inet6(r2, &(0x7f0000000300), 0x0, 0x0, 0x0, 0x0) r3 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r3, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5, 0x8}, 0x0, 0x0, 0x9, 0x7, 0x7fffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f0000062c40)={0x8000000000, [], 0x0, "00001000"}) r4 = creat(&(0x7f0000000140)='./bus\x00', 0x0) io_setup(0x1, &(0x7f0000000180)=0x0) io_submit(r5, 0x45, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000000000, 0x0, 0x1, 0x0, r4, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:06:09 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef010301000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:06:09 executing program 5: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f00000004c0)=ANY=[], 0x208e24b) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r2 = syz_io_uring_setup(0x356, &(0x7f0000000240)={0x0, 0x3760, 0x21, 0xffffffff, 0x1ffff}, &(0x7f00008f9000/0x1000)=nil, &(0x7f0000400000/0xc00000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000000)=0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000180)=@IORING_OP_LINK_TIMEOUT={0xf, 0xa89a1c1bd660819, 0x0, 0x0, 0x0, &(0x7f0000000140)}, 0x0) r5 = dup(r2) syz_io_uring_submit(r3, r4, &(0x7f0000000040)=@IORING_OP_CONNECT={0x10, 0x0, 0x0, r5, 0x0, 0x0}, 0x1) io_uring_enter(r5, 0x6700, 0x0, 0x0, 0x0, 0x0) openat$pidfd(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) recvmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000004c80)={0x77359400}) setresgid(0x0, 0x0, 0x0) r6 = socket$nl_xfrm(0x10, 0x3, 0x6) sendfile(r6, r1, 0x0, 0x100000002) 05:06:10 executing program 1: r0 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ftruncate(0xffffffffffffffff, 0x0) lseek(r0, 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000040)) r1 = getpgid(0x0) perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, r1, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$RTC_WKALM_SET(r0, 0x4028700f, &(0x7f0000000000)={0x1, 0x0, {0x10, 0x3b, 0x1, 0x1a, 0x9, 0x3, 0x0, 0xcc, 0x1}}) socket$inet6_udp(0xa, 0x2, 0x0) fsmount(r0, 0x0, 0x71) r2 = openat2(0xffffffffffffffff, &(0x7f00000001c0)='./bus\x00', 0x0, 0x0) sendto$inet6(r2, &(0x7f0000000300), 0x0, 0x0, 0x0, 0x0) r3 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r3, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5, 0x8}, 0x0, 0x0, 0x9, 0x7, 0x7fffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f0000062c40)={0x8000000000, [], 0x0, "00001000"}) r4 = creat(&(0x7f0000000140)='./bus\x00', 0x0) io_setup(0x1, &(0x7f0000000180)=0x0) io_submit(r5, 0x45, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000000000, 0x0, 0x1, 0x0, r4, &(0x7f0000000000), 0x377140be6b5ef4c7}]) 05:06:10 executing program 0: r0 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ftruncate(0xffffffffffffffff, 0x0) lseek(r0, 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(0xffffffffffffffff, 0x40086602, 0x0) perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000100)={'syztnl0\x00', &(0x7f0000000240)={'syztnl1\x00', 0x0, 0x2f, 0x1, 0x5, 0x1, 0x48, @mcast2, @ipv4={'\x00', '\xff\xff', @local}, 0x40, 0x8, 0x1, 0x2}}) r1 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r1, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f0000062c40)={0x8000000000, [], 0x0, "00001000"}) r2 = creat(&(0x7f0000000140)='./bus\x00', 0x0) io_setup(0x1, &(0x7f0000000180)=0x0) io_submit(r3, 0x45, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000000000, 0x0, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) fallocate(r0, 0x3, 0x0, 0x100000fe) 05:06:10 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef010401000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:06:10 executing program 2: r0 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ftruncate(0xffffffffffffffff, 0x0) lseek(r0, 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000040)) getpgid(0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat2(0xffffffffffffffff, &(0x7f00000001c0)='./bus\x00', 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000100)={'syztnl0\x00', &(0x7f0000000240)={'syztnl1\x00', 0x0, 0x2f, 0x1, 0x5, 0x1, 0x48, @mcast2, @ipv4={'\x00', '\xff\xff', @local}, 0x40, 0x8, 0x1, 0x2}}) syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5, 0x8}, 0x0, 0x0, 0x9, 0x7, 0x7fffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f0000062c40)={0x8000000000, [], 0x0, "00001000"}) r1 = creat(&(0x7f0000000140)='./bus\x00', 0x0) io_setup(0x1, &(0x7f0000000180)=0x0) io_submit(r2, 0x45, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000000000, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x377140be6b5ef4c7}]) fallocate(r0, 0x3, 0x0, 0x100000fe) 05:06:10 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef010501000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:06:10 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef010601000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:06:10 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef010701000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:06:10 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef010801000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:06:10 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef010901000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:06:11 executing program 4: r0 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ftruncate(0xffffffffffffffff, 0x0) lseek(r0, 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000040)) r1 = getpgid(0x0) perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, r1, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$RTC_WKALM_SET(r0, 0x4028700f, &(0x7f0000000000)={0x1, 0x0, {0x10, 0x3b, 0x1, 0x1a, 0x9, 0x3, 0x0, 0xcc, 0x1}}) socket$inet6_udp(0xa, 0x2, 0x0) fsmount(r0, 0x0, 0x71) r2 = openat2(0xffffffffffffffff, &(0x7f00000001c0)='./bus\x00', 0x0, 0x0) sendto$inet6(r2, &(0x7f0000000300), 0x0, 0x0, 0x0, 0x0) r3 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r3, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5, 0x8}, 0x0, 0x0, 0x9, 0x7, 0x7fffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f0000062c40)={0x8000000000, [], 0x0, "00001000"}) r4 = creat(&(0x7f0000000140)='./bus\x00', 0x0) io_submit(0x0, 0x45, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000000000, 0x0, 0x1, 0x0, r4, &(0x7f0000000000), 0x377140be6b5ef4c7}]) fallocate(r0, 0x3, 0x0, 0x100000fe) 05:06:11 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef010a01000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:06:11 executing program 5: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f00000004c0)=ANY=[], 0x208e24b) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r2 = syz_io_uring_setup(0x70c4, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000400000/0xc00000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000000)=0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000180)=@IORING_OP_LINK_TIMEOUT={0xf, 0xa89a1c1bd660819, 0x0, 0x0, 0x0, &(0x7f0000000140)}, 0x0) r5 = dup(r2) syz_io_uring_submit(r3, r4, &(0x7f0000000040)=@IORING_OP_CONNECT={0x10, 0x0, 0x0, r5, 0x0, 0x0}, 0x1) io_uring_enter(r5, 0x6700, 0x0, 0x0, 0x0, 0x0) openat$pidfd(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) recvmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000004c80)={0x77359400}) r6 = syz_open_dev$tty1(0xc, 0x4, 0x1) r7 = syz_open_procfs(0x0, &(0x7f0000000240)='mountinfo\x00') sendfile(r6, r7, 0x0, 0x800000080004103) fdatasync(r6) setresgid(0x0, 0x0, 0x0) r8 = socket$nl_xfrm(0x10, 0x3, 0x6) sendfile(r8, r1, 0x0, 0x100000002) [ 2942.770515][ C0] scsi_io_completion_action: 3 callbacks suppressed [ 2942.770576][ C0] sd 0:0:1:0: [sg0] tag#658 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2942.787461][ C0] sd 0:0:1:0: [sg0] tag#658 CDB: opcode=0xe5 (vendor) [ 2942.794219][ C0] sd 0:0:1:0: [sg0] tag#658 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2942.803698][ C0] sd 0:0:1:0: [sg0] tag#658 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2942.813355][ C0] sd 0:0:1:0: [sg0] tag#658 CDB[20]: ba 05:06:11 executing program 2: r0 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ftruncate(0xffffffffffffffff, 0x0) lseek(r0, 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000040)) getpgid(0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat2(0xffffffffffffffff, &(0x7f00000001c0)='./bus\x00', 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000100)={'syztnl0\x00', &(0x7f0000000240)={'syztnl1\x00', 0x0, 0x2f, 0x1, 0x5, 0x1, 0x48, @mcast2, @ipv4={'\x00', '\xff\xff', @local}, 0x40, 0x8, 0x1, 0x2}}) syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5, 0x8}, 0x0, 0x0, 0x9, 0x7, 0x7fffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f0000062c40)={0x8000000000, [], 0x0, "00001000"}) r1 = creat(&(0x7f0000000140)='./bus\x00', 0x0) io_setup(0x1, &(0x7f0000000180)=0x0) io_submit(r2, 0x45, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000000000, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x377140be6b5ef4c7}]) fallocate(r0, 0x3, 0x0, 0x100000fe) 05:06:11 executing program 1: r0 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ftruncate(0xffffffffffffffff, 0x0) lseek(r0, 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(0xffffffffffffffff, 0x40086602, 0x0) perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000100)={'syztnl0\x00', &(0x7f0000000240)={'syztnl1\x00', 0x0, 0x2f, 0x1, 0x5, 0x1, 0x48, @mcast2, @ipv4={'\x00', '\xff\xff', @local}, 0x40, 0x8, 0x1, 0x2}}) r1 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r1, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f0000062c40)={0x8000000000, [], 0x0, "00001000"}) r2 = creat(&(0x7f0000000140)='./bus\x00', 0x0) io_setup(0x1, &(0x7f0000000180)=0x0) io_submit(r3, 0x45, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000000000, 0x0, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) fallocate(r0, 0x3, 0x0, 0x100000fe) 05:06:11 executing program 0: r0 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ftruncate(0xffffffffffffffff, 0x0) lseek(r0, 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(0xffffffffffffffff, 0x40086602, &(0x7f0000000040)) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000100)={'syztnl0\x00', &(0x7f0000000240)={'syztnl1\x00', 0x0, 0x2f, 0x1, 0x5, 0x1, 0x48, @mcast2, @ipv4={'\x00', '\xff\xff', @local}, 0x40, 0x8, 0x1, 0x2}}) r1 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r1, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f0000062c40)={0x8000000000, [], 0x0, "00001000"}) r2 = creat(&(0x7f0000000140)='./bus\x00', 0x0) io_setup(0x1, &(0x7f0000000180)=0x0) io_submit(r3, 0x45, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000000000, 0x0, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) fallocate(r0, 0x3, 0x0, 0x100000fe) 05:06:11 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef010b01000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:06:11 executing program 4: r0 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ftruncate(0xffffffffffffffff, 0x0) lseek(r0, 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000040)) r1 = getpgid(0x0) perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, r1, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$RTC_WKALM_SET(r0, 0x4028700f, &(0x7f0000000000)={0x1, 0x0, {0x10, 0x3b, 0x1, 0x1a, 0x9, 0x3, 0x0, 0xcc, 0x1}}) socket$inet6_udp(0xa, 0x2, 0x0) fsmount(r0, 0x0, 0x71) r2 = openat2(0xffffffffffffffff, &(0x7f00000001c0)='./bus\x00', 0x0, 0x0) sendto$inet6(r2, &(0x7f0000000300), 0x0, 0x0, 0x0, 0x0) r3 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r3, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5, 0x8}, 0x0, 0x0, 0x9, 0x7, 0x7fffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f0000062c40)={0x8000000000, [], 0x0, "00001000"}) r4 = creat(&(0x7f0000000140)='./bus\x00', 0x0) io_submit(0x0, 0x45, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000000000, 0x0, 0x1, 0x0, r4, &(0x7f0000000000), 0x377140be6b5ef4c7}]) fallocate(r0, 0x3, 0x0, 0x100000fe) [ 2943.010931][ C1] sd 0:0:1:0: [sg0] tag#731 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2943.021284][ C1] sd 0:0:1:0: [sg0] tag#731 CDB: opcode=0xe5 (vendor) [ 2943.028101][ C1] sd 0:0:1:0: [sg0] tag#731 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2943.037609][ C1] sd 0:0:1:0: [sg0] tag#731 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2943.040064][ C0] sd 0:0:1:0: [sg0] tag#659 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2943.047077][ C1] sd 0:0:1:0: [sg0] tag#731 CDB[20]: ba [ 2943.057330][ C0] sd 0:0:1:0: [sg0] tag#659 CDB: opcode=0xe5 (vendor) [ 2943.069607][ C0] sd 0:0:1:0: [sg0] tag#659 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2943.079566][ C0] sd 0:0:1:0: [sg0] tag#659 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2943.089247][ C0] sd 0:0:1:0: [sg0] tag#659 CDB[20]: ba [ 2943.097310][ C0] sd 0:0:1:0: [sg0] tag#661 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s 05:06:11 executing program 4: r0 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ftruncate(0xffffffffffffffff, 0x0) lseek(r0, 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000040)) r1 = getpgid(0x0) perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, r1, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$RTC_WKALM_SET(r0, 0x4028700f, &(0x7f0000000000)={0x1, 0x0, {0x10, 0x3b, 0x1, 0x1a, 0x9, 0x3, 0x0, 0xcc, 0x1}}) socket$inet6_udp(0xa, 0x2, 0x0) fsmount(r0, 0x0, 0x71) r2 = openat2(0xffffffffffffffff, &(0x7f00000001c0)='./bus\x00', 0x0, 0x0) sendto$inet6(r2, &(0x7f0000000300), 0x0, 0x0, 0x0, 0x0) r3 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r3, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5, 0x8}, 0x0, 0x0, 0x9, 0x7, 0x7fffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f0000062c40)={0x8000000000, [], 0x0, "00001000"}) r4 = creat(&(0x7f0000000140)='./bus\x00', 0x0) io_submit(0x0, 0x45, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000000000, 0x0, 0x1, 0x0, r4, &(0x7f0000000000), 0x377140be6b5ef4c7}]) fallocate(r0, 0x3, 0x0, 0x100000fe) [ 2943.107619][ C0] sd 0:0:1:0: [sg0] tag#661 CDB: opcode=0xe5 (vendor) [ 2943.114410][ C0] sd 0:0:1:0: [sg0] tag#661 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2943.123892][ C0] sd 0:0:1:0: [sg0] tag#661 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2943.133488][ C0] sd 0:0:1:0: [sg0] tag#661 CDB[20]: ba 05:06:11 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef010c01000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:06:11 executing program 4: r0 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ftruncate(0xffffffffffffffff, 0x0) lseek(r0, 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000040)) r1 = getpgid(0x0) perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, r1, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$RTC_WKALM_SET(r0, 0x4028700f, &(0x7f0000000000)={0x1, 0x0, {0x10, 0x3b, 0x1, 0x1a, 0x9, 0x3, 0x0, 0xcc, 0x1}}) socket$inet6_udp(0xa, 0x2, 0x0) fsmount(r0, 0x0, 0x71) r2 = openat2(0xffffffffffffffff, &(0x7f00000001c0)='./bus\x00', 0x0, 0x0) sendto$inet6(r2, &(0x7f0000000300), 0x0, 0x0, 0x0, 0x0) r3 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r3, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5, 0x8}, 0x0, 0x0, 0x9, 0x7, 0x7fffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f0000062c40)={0x8000000000, [], 0x0, "00001000"}) io_setup(0x1, &(0x7f0000000180)=0x0) io_submit(r4, 0x45, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000000000, 0x0, 0x1, 0x0, 0xffffffffffffffff, &(0x7f0000000000), 0x377140be6b5ef4c7}]) fallocate(r0, 0x3, 0x0, 0x100000fe) [ 2943.169666][ C0] sd 0:0:1:0: [sg0] tag#671 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2943.180087][ C0] sd 0:0:1:0: [sg0] tag#671 CDB: opcode=0xe5 (vendor) [ 2943.187115][ C0] sd 0:0:1:0: [sg0] tag#671 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2943.196599][ C0] sd 0:0:1:0: [sg0] tag#671 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2943.206089][ C0] sd 0:0:1:0: [sg0] tag#671 CDB[20]: ba [ 2943.236962][ C0] sd 0:0:1:0: [sg0] tag#672 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2943.247310][ C0] sd 0:0:1:0: [sg0] tag#672 CDB: opcode=0xe5 (vendor) [ 2943.254068][ C0] sd 0:0:1:0: [sg0] tag#672 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2943.263667][ C0] sd 0:0:1:0: [sg0] tag#672 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2943.273148][ C0] sd 0:0:1:0: [sg0] tag#672 CDB[20]: ba 05:06:11 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef010d01000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:06:11 executing program 4: r0 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ftruncate(0xffffffffffffffff, 0x0) lseek(r0, 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000040)) r1 = getpgid(0x0) perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, r1, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$RTC_WKALM_SET(r0, 0x4028700f, &(0x7f0000000000)={0x1, 0x0, {0x10, 0x3b, 0x1, 0x1a, 0x9, 0x3, 0x0, 0xcc, 0x1}}) socket$inet6_udp(0xa, 0x2, 0x0) fsmount(r0, 0x0, 0x71) r2 = openat2(0xffffffffffffffff, &(0x7f00000001c0)='./bus\x00', 0x0, 0x0) sendto$inet6(r2, &(0x7f0000000300), 0x0, 0x0, 0x0, 0x0) r3 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r3, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5, 0x8}, 0x0, 0x0, 0x9, 0x7, 0x7fffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f0000062c40)={0x8000000000, [], 0x0, "00001000"}) io_setup(0x1, &(0x7f0000000180)=0x0) io_submit(r4, 0x45, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000000000, 0x0, 0x1, 0x0, 0xffffffffffffffff, &(0x7f0000000000), 0x377140be6b5ef4c7}]) fallocate(r0, 0x3, 0x0, 0x100000fe) 05:06:12 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef010e01000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) [ 2943.404861][ C0] sd 0:0:1:0: [sg0] tag#673 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2943.420232][ C0] sd 0:0:1:0: [sg0] tag#673 CDB: opcode=0xe5 (vendor) [ 2943.427045][ C0] sd 0:0:1:0: [sg0] tag#673 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2943.436706][ C0] sd 0:0:1:0: [sg0] tag#673 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2943.446480][ C0] sd 0:0:1:0: [sg0] tag#673 CDB[20]: ba 05:06:12 executing program 5: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f00000004c0)=ANY=[], 0x208e24b) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r2 = syz_io_uring_setup(0x70c4, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000400000/0xc00000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000000)=0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000180)=@IORING_OP_LINK_TIMEOUT={0xf, 0xa89a1c1bd660819, 0x0, 0x0, 0x0, &(0x7f0000000140)}, 0x0) r5 = dup(r2) syz_io_uring_submit(r3, r4, &(0x7f0000000040)=@IORING_OP_CONNECT={0x10, 0x0, 0x0, r5, 0x0, 0x0}, 0x1) io_uring_enter(r5, 0x6700, 0x0, 0x0, 0x0, 0x0) openat$pidfd(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) recvmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000004c80)={0x77359400}) setresgid(0x0, 0x0, 0x0) r6 = socket$nl_xfrm(0x10, 0x3, 0x6) sendfile(r6, r1, 0x0, 0x100000002) 05:06:12 executing program 2: r0 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ftruncate(0xffffffffffffffff, 0x0) lseek(r0, 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000040)) getpgid(0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat2(0xffffffffffffffff, &(0x7f00000001c0)='./bus\x00', 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000100)={'syztnl0\x00', &(0x7f0000000240)={'syztnl1\x00', 0x0, 0x2f, 0x1, 0x5, 0x1, 0x48, @mcast2, @ipv4={'\x00', '\xff\xff', @local}, 0x40, 0x8, 0x1, 0x2}}) syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5, 0x8}, 0x0, 0x0, 0x9, 0x7, 0x7fffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f0000062c40)={0x8000000000, [], 0x0, "00001000"}) r1 = creat(&(0x7f0000000140)='./bus\x00', 0x0) io_setup(0x1, &(0x7f0000000180)=0x0) io_submit(r2, 0x45, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000000000, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x377140be6b5ef4c7}]) fallocate(r0, 0x3, 0x0, 0x100000fe) 05:06:12 executing program 1: r0 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ftruncate(0xffffffffffffffff, 0x0) lseek(r0, 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(0xffffffffffffffff, 0x40086602, 0x0) perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000100)={'syztnl0\x00', &(0x7f0000000240)={'syztnl1\x00', 0x0, 0x2f, 0x1, 0x5, 0x1, 0x48, @mcast2, @ipv4={'\x00', '\xff\xff', @local}, 0x40, 0x8, 0x1, 0x2}}) r1 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r1, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f0000062c40)={0x8000000000, [], 0x0, "00001000"}) r2 = creat(&(0x7f0000000140)='./bus\x00', 0x0) io_setup(0x1, &(0x7f0000000180)=0x0) io_submit(r3, 0x45, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000000000, 0x0, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) fallocate(r0, 0x3, 0x0, 0x100000fe) 05:06:12 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef010f01000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:06:12 executing program 4: r0 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ftruncate(0xffffffffffffffff, 0x0) lseek(r0, 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000040)) r1 = getpgid(0x0) perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, r1, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$RTC_WKALM_SET(r0, 0x4028700f, &(0x7f0000000000)={0x1, 0x0, {0x10, 0x3b, 0x1, 0x1a, 0x9, 0x3, 0x0, 0xcc, 0x1}}) socket$inet6_udp(0xa, 0x2, 0x0) fsmount(r0, 0x0, 0x71) r2 = openat2(0xffffffffffffffff, &(0x7f00000001c0)='./bus\x00', 0x0, 0x0) sendto$inet6(r2, &(0x7f0000000300), 0x0, 0x0, 0x0, 0x0) r3 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r3, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5, 0x8}, 0x0, 0x0, 0x9, 0x7, 0x7fffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f0000062c40)={0x8000000000, [], 0x0, "00001000"}) io_setup(0x1, &(0x7f0000000180)=0x0) io_submit(r4, 0x45, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000000000, 0x0, 0x1, 0x0, 0xffffffffffffffff, &(0x7f0000000000), 0x377140be6b5ef4c7}]) fallocate(r0, 0x3, 0x0, 0x100000fe) 05:06:12 executing program 0: r0 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ftruncate(0xffffffffffffffff, 0x0) lseek(r0, 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(0xffffffffffffffff, 0x40086602, &(0x7f0000000040)) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000100)={'syztnl0\x00', &(0x7f0000000240)={'syztnl1\x00', 0x0, 0x2f, 0x1, 0x5, 0x1, 0x48, @mcast2, @ipv4={'\x00', '\xff\xff', @local}, 0x40, 0x8, 0x1, 0x2}}) r1 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r1, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f0000062c40)={0x8000000000, [], 0x0, "00001000"}) r2 = creat(&(0x7f0000000140)='./bus\x00', 0x0) io_setup(0x1, &(0x7f0000000180)=0x0) io_submit(r3, 0x45, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000000000, 0x0, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) fallocate(r0, 0x3, 0x0, 0x100000fe) [ 2944.086408][ C1] sd 0:0:1:0: [sg0] tag#767 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2944.094744][ C0] sd 0:0:1:0: [sg0] tag#640 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2944.096711][ C1] sd 0:0:1:0: [sg0] tag#767 CDB: opcode=0xe5 (vendor) [ 2944.106903][ C0] sd 0:0:1:0: [sg0] tag#640 CDB: opcode=0xe5 (vendor) [ 2944.113752][ C1] sd 0:0:1:0: [sg0] tag#767 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c 05:06:12 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef011001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) [ 2944.121110][ C0] sd 0:0:1:0: [sg0] tag#640 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2944.130635][ C1] sd 0:0:1:0: [sg0] tag#767 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2944.140099][ C0] sd 0:0:1:0: [sg0] tag#640 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2944.149653][ C1] sd 0:0:1:0: [sg0] tag#767 CDB[20]: ba [ 2944.159191][ C0] sd 0:0:1:0: [sg0] tag#640 CDB[20]: ba 05:06:12 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef011101000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) [ 2944.326042][ C0] sd 0:0:1:0: [sg0] tag#641 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2944.336366][ C0] sd 0:0:1:0: [sg0] tag#641 CDB: opcode=0xe5 (vendor) [ 2944.343174][ C0] sd 0:0:1:0: [sg0] tag#641 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2944.352661][ C0] sd 0:0:1:0: [sg0] tag#641 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2944.362155][ C0] sd 0:0:1:0: [sg0] tag#641 CDB[20]: ba 05:06:12 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef011201000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:06:13 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef011801000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:06:13 executing program 4: r0 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ftruncate(0xffffffffffffffff, 0x0) lseek(r0, 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000040)) r1 = getpgid(0x0) perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, r1, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$RTC_WKALM_SET(r0, 0x4028700f, &(0x7f0000000000)={0x1, 0x0, {0x10, 0x3b, 0x1, 0x1a, 0x9, 0x3, 0x0, 0xcc, 0x1}}) socket$inet6_udp(0xa, 0x2, 0x0) fsmount(r0, 0x0, 0x71) r2 = openat2(0xffffffffffffffff, &(0x7f00000001c0)='./bus\x00', 0x0, 0x0) sendto$inet6(r2, &(0x7f0000000300), 0x0, 0x0, 0x0, 0x0) r3 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r3, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5, 0x8}, 0x0, 0x0, 0x9, 0x7, 0x7fffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = creat(&(0x7f0000000140)='./bus\x00', 0x0) io_setup(0x1, &(0x7f0000000180)=0x0) io_submit(r5, 0x45, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000000000, 0x0, 0x1, 0x0, r4, &(0x7f0000000000), 0x377140be6b5ef4c7}]) fallocate(r0, 0x3, 0x0, 0x100000fe) 05:06:13 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef011901000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:06:13 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef012201000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:06:13 executing program 2: r0 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ftruncate(0xffffffffffffffff, 0x0) lseek(r0, 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000040)) getpgid(0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat2(0xffffffffffffffff, &(0x7f00000001c0)='./bus\x00', 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000100)={'syztnl0\x00', &(0x7f0000000240)={'syztnl1\x00', 0x0, 0x2f, 0x1, 0x5, 0x1, 0x48, @mcast2, @ipv4={'\x00', '\xff\xff', @local}, 0x40, 0x8, 0x1, 0x2}}) r1 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r1, 0x2285, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5, 0x8}, 0x0, 0x0, 0x9, 0x7, 0x7fffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f0000062c40)={0x8000000000, [], 0x0, "00001000"}) r2 = creat(&(0x7f0000000140)='./bus\x00', 0x0) io_setup(0x1, &(0x7f0000000180)=0x0) io_submit(r3, 0x45, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000000000, 0x0, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) fallocate(r0, 0x3, 0x0, 0x100000fe) 05:06:13 executing program 1: r0 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ftruncate(0xffffffffffffffff, 0x0) lseek(r0, 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(0xffffffffffffffff, 0x40086602, 0x0) perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000100)={'syztnl0\x00', &(0x7f0000000240)={'syztnl1\x00', 0x0, 0x2f, 0x1, 0x5, 0x1, 0x48, @mcast2, @ipv4={'\x00', '\xff\xff', @local}, 0x40, 0x8, 0x1, 0x2}}) r1 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r1, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f0000062c40)={0x8000000000, [], 0x0, "00001000"}) r2 = creat(&(0x7f0000000140)='./bus\x00', 0x0) io_setup(0x1, &(0x7f0000000180)=0x0) io_submit(r3, 0x45, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000000000, 0x0, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) fallocate(r0, 0x3, 0x0, 0x100000fe) 05:06:13 executing program 0: r0 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ftruncate(0xffffffffffffffff, 0x0) lseek(r0, 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(0xffffffffffffffff, 0x40086602, &(0x7f0000000040)) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000100)={'syztnl0\x00', &(0x7f0000000240)={'syztnl1\x00', 0x0, 0x2f, 0x1, 0x5, 0x1, 0x48, @mcast2, @ipv4={'\x00', '\xff\xff', @local}, 0x40, 0x8, 0x1, 0x2}}) r1 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r1, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f0000062c40)={0x8000000000, [], 0x0, "00001000"}) r2 = creat(&(0x7f0000000140)='./bus\x00', 0x0) io_setup(0x1, &(0x7f0000000180)=0x0) io_submit(r3, 0x45, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000000000, 0x0, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) fallocate(r0, 0x3, 0x0, 0x100000fe) 05:06:13 executing program 5: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f00000004c0)=ANY=[], 0x208e24b) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r2 = syz_io_uring_setup(0x70c4, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000400000/0xc00000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000000)=0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000180)=@IORING_OP_LINK_TIMEOUT={0xf, 0xa89a1c1bd660819, 0x0, 0x0, 0x0, &(0x7f0000000140)}, 0x0) r5 = dup(r2) syz_io_uring_submit(r3, r4, &(0x7f0000000040)=@IORING_OP_CONNECT={0x10, 0x0, 0x0, r5, 0x0, 0x0}, 0x1) recvmmsg$unix(r0, &(0x7f00000040c0)=[{{0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f00000002c0)=""/191, 0xbf}], 0x1}}, {{&(0x7f0000000380), 0x6e, &(0x7f0000000200)=[{&(0x7f0000000400)=""/161, 0xa1}, {&(0x7f00000004c0)=""/181, 0xb5}, {&(0x7f0000000940)=""/4096, 0x1000}, {&(0x7f0000000580)=""/248, 0xf8}], 0x4, &(0x7f0000000680)=[@rights={{0x20, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}], 0x80}}, {{0x0, 0x0, &(0x7f00000008c0)=[{&(0x7f0000000700)=""/190, 0xbe}, {&(0x7f00000007c0)=""/253, 0xfd}, {&(0x7f0000001940)=""/247, 0xf7}], 0x3, &(0x7f0000001a40)=[@cred={{0x1c}}, @cred={{0x1c}}], 0x40}}, {{&(0x7f0000001a80)=@abs, 0x6e, &(0x7f0000001c80)=[{&(0x7f0000001b00)=""/163, 0xa3}, {&(0x7f0000001bc0)=""/157, 0x9d}], 0x2}}, {{0xffffffffffffffff, 0x0, &(0x7f0000002cc0)=[{&(0x7f0000001cc0)=""/4096, 0x1000}], 0x1, &(0x7f0000003f80)=ANY=[@ANYBLOB="1c00000000000000010000000900000065d58c6a949ad2cc46fd6f60acbd06545609395db0876d6e7d1c75e6af69535e29ae676325760aecbb380dbb1048a3162c5b116f721ba7d8ec2d4c36c092c556a5f03baad050019a8e3e097b69207d1a5afbaf46099b88385f1b475f34032eeb29700c4e622a1c96d3b29c3c13414ec1685b637d9e8fcd0758091c77a589f7b25f257758fc2651", @ANYRES32, @ANYRES32, @ANYRES32, @ANYBLOB="0000000018000000000000000100000001000000", @ANYRES32, @ANYRES32], 0x38}}, {{0x0, 0x0, &(0x7f0000003e40)=[{&(0x7f0000002d40)=""/74, 0x4a}, {&(0x7f0000003e80)=""/109, 0x6d}, {&(0x7f0000002e40)=""/4096, 0x1000}], 0x3}}, {{&(0x7f0000003f00)=@abs, 0x6e, &(0x7f0000004080)}}], 0x7, 0x2002, 0x0) fchmod(r7, 0x100) syz_io_uring_setup(0xd9d, &(0x7f0000002dc0)={0x0, 0x860c, 0x8, 0x3, 0x295, 0x0, r6}, &(0x7f00005ef000/0x1000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000002d00), &(0x7f0000004040)) io_uring_enter(r5, 0x6700, 0x0, 0x0, 0x0, 0x0) openat$pidfd(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) recvmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000004c80)={0x77359400}) setresgid(0x0, 0x0, 0x0) r8 = socket$nl_xfrm(0x10, 0x3, 0x6) sendfile(r8, r1, 0x0, 0x100000002) 05:06:13 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef012501000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:06:13 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef012e01000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:06:13 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef013201000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:06:13 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef014801000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:06:14 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef014c01000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:06:14 executing program 4: r0 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ftruncate(0xffffffffffffffff, 0x0) lseek(r0, 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000040)) r1 = getpgid(0x0) perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, r1, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$RTC_WKALM_SET(r0, 0x4028700f, &(0x7f0000000000)={0x1, 0x0, {0x10, 0x3b, 0x1, 0x1a, 0x9, 0x3, 0x0, 0xcc, 0x1}}) socket$inet6_udp(0xa, 0x2, 0x0) fsmount(r0, 0x0, 0x71) r2 = openat2(0xffffffffffffffff, &(0x7f00000001c0)='./bus\x00', 0x0, 0x0) sendto$inet6(r2, &(0x7f0000000300), 0x0, 0x0, 0x0, 0x0) r3 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r3, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5, 0x8}, 0x0, 0x0, 0x9, 0x7, 0x7fffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = creat(&(0x7f0000000140)='./bus\x00', 0x0) io_setup(0x1, &(0x7f0000000180)=0x0) io_submit(r5, 0x45, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000000000, 0x0, 0x1, 0x0, r4, &(0x7f0000000000), 0x377140be6b5ef4c7}]) fallocate(r0, 0x3, 0x0, 0x100000fe) 05:06:14 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef016001000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:06:14 executing program 0: r0 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ftruncate(0xffffffffffffffff, 0x0) lseek(r0, 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(0xffffffffffffffff, 0x40086602, &(0x7f0000000040)) perf_event_open(&(0x7f0000000700)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000100)={'syztnl0\x00', &(0x7f0000000240)={'syztnl1\x00', 0x0, 0x2f, 0x1, 0x5, 0x1, 0x48, @mcast2, @ipv4={'\x00', '\xff\xff', @local}, 0x40, 0x8, 0x1, 0x2}}) r1 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r1, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f0000062c40)={0x8000000000, [], 0x0, "00001000"}) r2 = creat(&(0x7f0000000140)='./bus\x00', 0x0) io_setup(0x1, &(0x7f0000000180)=0x0) io_submit(r3, 0x45, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000000000, 0x0, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) fallocate(r0, 0x3, 0x0, 0x100000fe) 05:06:14 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef016801000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:06:14 executing program 1: r0 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ftruncate(0xffffffffffffffff, 0x0) lseek(r0, 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000040)) r1 = getpgid(0x0) perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, r1, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$RTC_WKALM_SET(r0, 0x4028700f, &(0x7f0000000000)={0x1, 0x0, {0x10, 0x3b, 0x1, 0x1a, 0x9, 0x3, 0x0, 0xcc, 0x1}}) socket$inet6_udp(0xa, 0x2, 0x0) fsmount(r0, 0x0, 0x71) r2 = openat2(0xffffffffffffffff, &(0x7f00000001c0)='./bus\x00', 0x0, 0x0) sendto$inet6(r2, &(0x7f0000000300), 0x0, 0x0, 0x0, 0x0) r3 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r3, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5, 0x8}, 0x0, 0x0, 0x9, 0x7, 0x7fffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f0000062c40)={0x8000000000, [], 0x0, "00001000"}) io_setup(0x1, &(0x7f0000000180)=0x0) io_submit(r4, 0x45, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000000000, 0x0, 0x1, 0x0, 0xffffffffffffffff, &(0x7f0000000000), 0x377140be6b5ef4c7}]) fallocate(r0, 0x3, 0x0, 0x100000fe) 05:06:14 executing program 2: r0 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ftruncate(0xffffffffffffffff, 0x0) lseek(r0, 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000040)) getpgid(0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat2(0xffffffffffffffff, &(0x7f00000001c0)='./bus\x00', 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000100)={'syztnl0\x00', &(0x7f0000000240)={'syztnl1\x00', 0x0, 0x2f, 0x1, 0x5, 0x1, 0x48, @mcast2, @ipv4={'\x00', '\xff\xff', @local}, 0x40, 0x8, 0x1, 0x2}}) r1 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r1, 0x2285, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5, 0x8}, 0x0, 0x0, 0x9, 0x7, 0x7fffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f0000062c40)={0x8000000000, [], 0x0, "00001000"}) r2 = creat(&(0x7f0000000140)='./bus\x00', 0x0) io_setup(0x1, &(0x7f0000000180)=0x0) io_submit(r3, 0x45, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000000000, 0x0, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) fallocate(r0, 0x3, 0x0, 0x100000fe) 05:06:14 executing program 5: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = syz_open_dev$tty1(0xc, 0x4, 0x1) r2 = syz_open_procfs(0x0, &(0x7f0000000240)='mountinfo\x00') sendfile(r1, r2, 0x0, 0x800000080004103) sendmsg$NL80211_CMD_FRAME(r2, &(0x7f0000000380)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000200)={&(0x7f00000002c0)={0xb8, 0x0, 0x2, 0x70bd2d, 0x25dfdbfc, {{}, {@void, @void}}, [@chandef_params=[@NL80211_ATTR_CHANNEL_WIDTH={0x8, 0x9f, 0x6}, @NL80211_ATTR_CENTER_FREQ1={0x8, 0xa0, 0xd0}, @NL80211_ATTR_CHANNEL_WIDTH={0x8, 0x9f, 0x1}, @NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8, 0x27, 0x1}, @NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8}, @NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8}, @NL80211_ATTR_WIPHY_EDMG_BW_CONFIG={0x5, 0x119, 0x4}, @NL80211_ATTR_WIPHY_EDMG_BW_CONFIG={0x5, 0x119, 0x9}], @NL80211_ATTR_DONT_WAIT_FOR_ACK={0x4}, @chandef_params=[@NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8, 0x27, 0x2}, @NL80211_ATTR_WIPHY_EDMG_BW_CONFIG={0x5, 0x119, 0xc}, @NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8, 0x27, 0x3}, @NL80211_ATTR_CHANNEL_WIDTH={0x8, 0x9f, 0x3}, @NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0x21}, @NL80211_ATTR_WIPHY_FREQ_OFFSET={0x8, 0x122, 0xa7}, @NL80211_ATTR_WIPHY_FREQ={0x8, 0x26, @random=0x16e9}, @NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8}], @NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_DONT_WAIT_FOR_ACK={0x4}, @NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_DURATION={0x8, 0x57, 0x1f2}, @NL80211_ATTR_TX_NO_CCK_RATE={0x4}, @NL80211_ATTR_TX_NO_CCK_RATE={0x4}]}, 0xb8}, 0x1, 0x0, 0x0, 0x24000010}, 0x1) write$binfmt_script(r0, &(0x7f00000003c0)=ANY=[@ANYRESDEC], 0x208e24b) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r4 = syz_io_uring_setup(0x70c4, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000400000/0xc00000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000000)=0x0) syz_io_uring_submit(r5, r6, &(0x7f0000000180)=@IORING_OP_LINK_TIMEOUT={0xf, 0xa89a1c1bd660819, 0x0, 0x0, 0x0, &(0x7f0000000140)}, 0x0) r7 = dup(r4) syz_io_uring_submit(r5, r6, &(0x7f0000000040)=@IORING_OP_CONNECT={0x10, 0x0, 0x0, r7, 0x0, 0x0}, 0x1) io_uring_enter(r7, 0x6700, 0x0, 0x0, 0x0, 0x0) openat$pidfd(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) recvmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000004c80)={0x77359400}) setresgid(0x0, 0x0, 0x0) r8 = socket$nl_xfrm(0x10, 0x3, 0x6) sendfile(r8, r3, 0x0, 0x100000002) r9 = io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) io_uring_register$IORING_UNREGISTER_PERSONALITY(0xffffffffffffffff, 0xa, 0x0, r9) syz_io_uring_submit(r5, r6, &(0x7f0000000400)=@IORING_OP_FADVISE={0x18, 0x2, 0x0, @fd, 0x7da, 0x0, 0x7fffffff, 0x5, 0x1, {0x0, r9}}, 0x3) 05:06:14 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef016c01000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:06:14 executing program 0: r0 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ftruncate(0xffffffffffffffff, 0x0) lseek(r0, 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(0xffffffffffffffff, 0x40086602, &(0x7f0000000040)) perf_event_open(&(0x7f0000000700)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000100)={'syztnl0\x00', &(0x7f0000000240)={'syztnl1\x00', 0x0, 0x2f, 0x1, 0x5, 0x1, 0x48, @mcast2, @ipv4={'\x00', '\xff\xff', @local}, 0x40, 0x8, 0x1, 0x2}}) r1 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r1, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f0000062c40)={0x8000000000, [], 0x0, "00001000"}) r2 = creat(&(0x7f0000000140)='./bus\x00', 0x0) io_setup(0x1, &(0x7f0000000180)=0x0) io_submit(r3, 0x45, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000000000, 0x0, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) fallocate(r0, 0x3, 0x0, 0x100000fe) 05:06:14 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef017401000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:06:14 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef017a01000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:06:14 executing program 1: r0 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ftruncate(0xffffffffffffffff, 0x0) lseek(r0, 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000040)) r1 = getpgid(0x0) perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, r1, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$RTC_WKALM_SET(r0, 0x4028700f, &(0x7f0000000000)={0x1, 0x0, {0x10, 0x3b, 0x1, 0x1a, 0x9, 0x3, 0x0, 0xcc, 0x1}}) socket$inet6_udp(0xa, 0x2, 0x0) fsmount(r0, 0x0, 0x71) r2 = openat2(0xffffffffffffffff, &(0x7f00000001c0)='./bus\x00', 0x0, 0x0) sendto$inet6(r2, &(0x7f0000000300), 0x0, 0x0, 0x0, 0x0) r3 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r3, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5, 0x8}, 0x0, 0x0, 0x9, 0x7, 0x7fffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f0000062c40)={0x8000000000, [], 0x0, "00001000"}) io_setup(0x1, &(0x7f0000000180)=0x0) io_submit(r4, 0x45, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000000000, 0x0, 0x1, 0x0, 0xffffffffffffffff, &(0x7f0000000000), 0x377140be6b5ef4c7}]) fallocate(r0, 0x3, 0x0, 0x100000fe) 05:06:15 executing program 4: r0 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ftruncate(0xffffffffffffffff, 0x0) lseek(r0, 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000040)) r1 = getpgid(0x0) perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, r1, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$RTC_WKALM_SET(r0, 0x4028700f, &(0x7f0000000000)={0x1, 0x0, {0x10, 0x3b, 0x1, 0x1a, 0x9, 0x3, 0x0, 0xcc, 0x1}}) socket$inet6_udp(0xa, 0x2, 0x0) fsmount(r0, 0x0, 0x71) r2 = openat2(0xffffffffffffffff, &(0x7f00000001c0)='./bus\x00', 0x0, 0x0) sendto$inet6(r2, &(0x7f0000000300), 0x0, 0x0, 0x0, 0x0) r3 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r3, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5, 0x8}, 0x0, 0x0, 0x9, 0x7, 0x7fffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = creat(&(0x7f0000000140)='./bus\x00', 0x0) io_setup(0x1, &(0x7f0000000180)=0x0) io_submit(r5, 0x45, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000000000, 0x0, 0x1, 0x0, r4, &(0x7f0000000000), 0x377140be6b5ef4c7}]) fallocate(r0, 0x3, 0x0, 0x100000fe) 05:06:15 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef01fe01000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:06:15 executing program 1: r0 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ftruncate(0xffffffffffffffff, 0x0) lseek(r0, 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000040)) r1 = getpgid(0x0) perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, r1, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$RTC_WKALM_SET(r0, 0x4028700f, &(0x7f0000000000)={0x1, 0x0, {0x10, 0x3b, 0x1, 0x1a, 0x9, 0x3, 0x0, 0xcc, 0x1}}) socket$inet6_udp(0xa, 0x2, 0x0) fsmount(r0, 0x0, 0x71) r2 = openat2(0xffffffffffffffff, &(0x7f00000001c0)='./bus\x00', 0x0, 0x0) sendto$inet6(r2, &(0x7f0000000300), 0x0, 0x0, 0x0, 0x0) r3 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r3, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5, 0x8}, 0x0, 0x0, 0x9, 0x7, 0x7fffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f0000062c40)={0x8000000000, [], 0x0, "00001000"}) io_setup(0x1, &(0x7f0000000180)=0x0) io_submit(r4, 0x45, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000000000, 0x0, 0x1, 0x0, 0xffffffffffffffff, &(0x7f0000000000), 0x377140be6b5ef4c7}]) fallocate(r0, 0x3, 0x0, 0x100000fe) 05:06:15 executing program 0: r0 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ftruncate(0xffffffffffffffff, 0x0) lseek(r0, 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(0xffffffffffffffff, 0x40086602, &(0x7f0000000040)) perf_event_open(&(0x7f0000000700)={0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000100)={'syztnl0\x00', &(0x7f0000000240)={'syztnl1\x00', 0x0, 0x2f, 0x1, 0x5, 0x1, 0x48, @mcast2, @ipv4={'\x00', '\xff\xff', @local}, 0x40, 0x8, 0x1, 0x2}}) r1 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r1, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f0000062c40)={0x8000000000, [], 0x0, "00001000"}) r2 = creat(&(0x7f0000000140)='./bus\x00', 0x0) io_setup(0x1, &(0x7f0000000180)=0x0) io_submit(r3, 0x45, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000000000, 0x0, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) fallocate(r0, 0x3, 0x0, 0x100000fe) 05:06:15 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef010003000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:06:15 executing program 2: r0 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ftruncate(0xffffffffffffffff, 0x0) lseek(r0, 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000040)) getpgid(0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat2(0xffffffffffffffff, &(0x7f00000001c0)='./bus\x00', 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000100)={'syztnl0\x00', &(0x7f0000000240)={'syztnl1\x00', 0x0, 0x2f, 0x1, 0x5, 0x1, 0x48, @mcast2, @ipv4={'\x00', '\xff\xff', @local}, 0x40, 0x8, 0x1, 0x2}}) r1 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r1, 0x2285, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5, 0x8}, 0x0, 0x0, 0x9, 0x7, 0x7fffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f0000062c40)={0x8000000000, [], 0x0, "00001000"}) r2 = creat(&(0x7f0000000140)='./bus\x00', 0x0) io_setup(0x1, &(0x7f0000000180)=0x0) io_submit(r3, 0x45, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000000000, 0x0, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) fallocate(r0, 0x3, 0x0, 0x100000fe) 05:06:15 executing program 1: r0 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ftruncate(0xffffffffffffffff, 0x0) lseek(r0, 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000040)) r1 = getpgid(0x0) perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, r1, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$RTC_WKALM_SET(r0, 0x4028700f, &(0x7f0000000000)={0x1, 0x0, {0x10, 0x3b, 0x1, 0x1a, 0x9, 0x3, 0x0, 0xcc, 0x1}}) socket$inet6_udp(0xa, 0x2, 0x0) fsmount(r0, 0x0, 0x71) r2 = openat2(0xffffffffffffffff, &(0x7f00000001c0)='./bus\x00', 0x0, 0x0) sendto$inet6(r2, &(0x7f0000000300), 0x0, 0x0, 0x0, 0x0) r3 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r3, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5, 0x8}, 0x0, 0x0, 0x9, 0x7, 0x7fffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f0000062c40)={0x8000000000, [], 0x0, "00001000"}) r4 = creat(&(0x7f0000000140)='./bus\x00', 0x0) io_submit(0x0, 0x45, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000000000, 0x0, 0x1, 0x0, r4, &(0x7f0000000000), 0x377140be6b5ef4c7}]) fallocate(r0, 0x3, 0x0, 0x100000fe) 05:06:15 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef010403000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:06:15 executing program 5: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f00000004c0)=ANY=[], 0x208e24b) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r2 = syz_io_uring_setup(0x70c4, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x4}, &(0x7f0000002000/0x2000)=nil, &(0x7f0000400000/0xc00000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000000)=0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000180)=@IORING_OP_LINK_TIMEOUT={0xf, 0xa89a1c1bd660819, 0x0, 0x0, 0x0, &(0x7f0000000140)}, 0x0) r5 = dup(r2) syz_io_uring_submit(r3, r4, &(0x7f0000000040)=@IORING_OP_CONNECT={0x10, 0x0, 0x0, r5, 0x0, 0x0}, 0x1) io_uring_enter(r5, 0x6700, 0x0, 0x0, 0x0, 0x0) openat$pidfd(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) setresgid(0x0, 0x0, 0x0) r6 = syz_open_dev$tty1(0xc, 0x4, 0x1) r7 = syz_open_procfs(0x0, &(0x7f0000000240)='mountinfo\x00') sendfile(r6, r7, 0x0, 0x800000080004103) r8 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r8, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0xc) setresgid(r9, 0x0, 0x0) fchown(r7, 0xffffffffffffffff, r9) r10 = socket$nl_xfrm(0x10, 0x3, 0x6) sendfile(r10, r1, 0x0, 0x100000002) 05:06:15 executing program 0: r0 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ftruncate(0xffffffffffffffff, 0x0) lseek(r0, 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(0xffffffffffffffff, 0x40086602, &(0x7f0000000040)) perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000100)={'syztnl0\x00', &(0x7f0000000240)={'syztnl1\x00', 0x0, 0x2f, 0x1, 0x5, 0x1, 0x48, @mcast2, @ipv4={'\x00', '\xff\xff', @local}, 0x40, 0x8, 0x1, 0x2}}) r1 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r1, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f0000062c40)={0x8000000000, [], 0x0, "00001000"}) r2 = creat(&(0x7f0000000140)='./bus\x00', 0x0) io_setup(0x1, &(0x7f0000000180)=0x0) io_submit(r3, 0x45, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000000000, 0x0, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) fallocate(r0, 0x3, 0x0, 0x100000fe) 05:06:15 executing program 1 (fault-call:10 fault-nth:0): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f00000004c0)=ANY=[], 0x208e24b) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r2 = syz_io_uring_setup(0x70c4, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000400000/0xc00000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000000)=0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000180)=@IORING_OP_LINK_TIMEOUT={0xf, 0xa89a1c1bd660819, 0x0, 0x0, 0x0, &(0x7f0000000140)}, 0x0) r5 = dup(r2) syz_io_uring_submit(r3, r4, &(0x7f0000000040)=@IORING_OP_CONNECT={0x10, 0x0, 0x0, r5, 0x0, 0x0}, 0x1) io_uring_enter(r5, 0x6700, 0x0, 0x0, 0x0, 0x0) setresgid(0x0, 0x0, 0x0) r6 = socket$nl_xfrm(0x10, 0x3, 0x6) sendfile(r6, r1, 0x0, 0x100000002) 05:06:15 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef018204000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) [ 2947.423938][T14012] FAULT_INJECTION: forcing a failure. [ 2947.423938][T14012] name failslab, interval 1, probability 0, space 0, times 0 [ 2947.436573][T14012] CPU: 0 PID: 14012 Comm: syz-executor.1 Tainted: G W 5.14.0-rc7-syzkaller #0 [ 2947.446726][T14012] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2947.456865][T14012] Call Trace: [ 2947.460229][T14012] dump_stack_lvl+0xb7/0x103 [ 2947.464855][T14012] dump_stack+0x11/0x1a [ 2947.469010][T14012] should_fail+0x23c/0x250 [ 2947.473454][T14012] __should_failslab+0x81/0x90 [ 2947.478218][T14012] ? alloc_pipe_info+0xac/0x350 [ 2947.483072][T14012] should_failslab+0x5/0x20 [ 2947.487573][T14012] kmem_cache_alloc_trace+0x49/0x310 [ 2947.492953][T14012] alloc_pipe_info+0xac/0x350 [ 2947.497733][T14012] splice_direct_to_actor+0x5f7/0x650 [ 2947.503186][T14012] ? avc_has_perm+0xc8/0x150 [ 2947.507820][T14012] ? do_splice_direct+0x170/0x170 [ 2947.512846][T14012] ? security_file_permission+0x87/0xa0 [ 2947.518399][T14012] ? rw_verify_area+0x136/0x250 [ 2947.523264][T14012] do_splice_direct+0xf5/0x170 [ 2947.528035][T14012] do_sendfile+0x773/0xda0 [ 2947.532537][T14012] __x64_sys_sendfile64+0xf2/0x130 [ 2947.537740][T14012] do_syscall_64+0x3d/0x90 [ 2947.542192][T14012] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 2947.548092][T14012] RIP: 0033:0x4665f9 [ 2947.551980][T14012] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 2947.571583][T14012] RSP: 002b:00007fb493b07188 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 [ 2947.579997][T14012] RAX: ffffffffffffffda RBX: 000000000056c038 RCX: 00000000004665f9 [ 2947.587972][T14012] RDX: 0000000000000000 RSI: 0000000000000004 RDI: 0000000000000007 [ 2947.595943][T14012] RBP: 00007fb493b071d0 R08: 0000000000000000 R09: 0000000000000000 [ 2947.603911][T14012] R10: 0000000100000002 R11: 0000000000000246 R12: 0000000000000001 [ 2947.611906][T14012] R13: 00007ffccf4067cf R14: 00007fb493b07300 R15: 0000000000022000 05:06:16 executing program 4: r0 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ftruncate(0xffffffffffffffff, 0x0) lseek(r0, 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000040)) r1 = getpgid(0x0) perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, r1, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$RTC_WKALM_SET(r0, 0x4028700f, &(0x7f0000000000)={0x1, 0x0, {0x10, 0x3b, 0x1, 0x1a, 0x9, 0x3, 0x0, 0xcc, 0x1}}) socket$inet6_udp(0xa, 0x2, 0x0) fsmount(r0, 0x0, 0x71) r2 = openat2(0xffffffffffffffff, &(0x7f00000001c0)='./bus\x00', 0x0, 0x0) sendto$inet6(r2, &(0x7f0000000300), 0x0, 0x0, 0x0, 0x0) r3 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r3, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f0000062c40)={0x8000000000, [], 0x0, "00001000"}) r4 = creat(&(0x7f0000000140)='./bus\x00', 0x0) io_setup(0x1, &(0x7f0000000180)=0x0) io_submit(r5, 0x45, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000000000, 0x0, 0x1, 0x0, r4, &(0x7f0000000000), 0x377140be6b5ef4c7}]) fallocate(r0, 0x3, 0x0, 0x100000fe) 05:06:16 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef010005000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:06:16 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef010006000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) [ 2947.737309][ C1] scsi_io_completion_action: 13 callbacks suppressed [ 2947.737336][ C1] sd 0:0:1:0: [sg0] tag#750 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2947.754358][ C1] sd 0:0:1:0: [sg0] tag#750 CDB: opcode=0xe5 (vendor) [ 2947.761149][ C1] sd 0:0:1:0: [sg0] tag#750 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2947.770732][ C1] sd 0:0:1:0: [sg0] tag#750 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2947.780203][ C1] sd 0:0:1:0: [sg0] tag#750 CDB[20]: ba 05:06:16 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef010007000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:06:16 executing program 0: r0 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ftruncate(0xffffffffffffffff, 0x0) lseek(r0, 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(0xffffffffffffffff, 0x40086602, &(0x7f0000000040)) perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000100)={'syztnl0\x00', &(0x7f0000000240)={'syztnl1\x00', 0x0, 0x2f, 0x1, 0x5, 0x1, 0x48, @mcast2, @ipv4={'\x00', '\xff\xff', @local}, 0x40, 0x8, 0x1, 0x2}}) r1 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r1, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f0000062c40)={0x8000000000, [], 0x0, "00001000"}) r2 = creat(&(0x7f0000000140)='./bus\x00', 0x0) io_setup(0x1, &(0x7f0000000180)=0x0) io_submit(r3, 0x45, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000000000, 0x0, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) fallocate(r0, 0x3, 0x0, 0x100000fe) [ 2947.959943][ C1] sd 0:0:1:0: [sg0] tag#717 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2947.970343][ C1] sd 0:0:1:0: [sg0] tag#717 CDB: opcode=0xe5 (vendor) [ 2947.977119][ C1] sd 0:0:1:0: [sg0] tag#717 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2947.986608][ C1] sd 0:0:1:0: [sg0] tag#717 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2947.996211][ C1] sd 0:0:1:0: [sg0] tag#717 CDB[20]: ba 05:06:16 executing program 2: r0 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ftruncate(0xffffffffffffffff, 0x0) lseek(r0, 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000040)) getpgid(0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat2(0xffffffffffffffff, &(0x7f00000001c0)='./bus\x00', 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000100)={'syztnl0\x00', &(0x7f0000000240)={'syztnl1\x00', 0x0, 0x2f, 0x1, 0x5, 0x1, 0x48, @mcast2, @ipv4={'\x00', '\xff\xff', @local}, 0x40, 0x8, 0x1, 0x2}}) r1 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r1, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5, 0x8}, 0x0, 0x0, 0x9, 0x7, 0x7fffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f0000062c40)={0x8000000000, [], 0x0, "00001000"}) r2 = creat(&(0x7f0000000140)='./bus\x00', 0x0) io_setup(0x1, &(0x7f0000000180)=0x0) io_submit(r3, 0x45, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000000000, 0x0, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) fallocate(r0, 0x3, 0x0, 0x100000fe) 05:06:16 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef010009000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:06:16 executing program 1 (fault-call:10 fault-nth:1): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f00000004c0)=ANY=[], 0x208e24b) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r2 = syz_io_uring_setup(0x70c4, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000400000/0xc00000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000000)=0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000180)=@IORING_OP_LINK_TIMEOUT={0xf, 0xa89a1c1bd660819, 0x0, 0x0, 0x0, &(0x7f0000000140)}, 0x0) r5 = dup(r2) syz_io_uring_submit(r3, r4, &(0x7f0000000040)=@IORING_OP_CONNECT={0x10, 0x0, 0x0, r5, 0x0, 0x0}, 0x1) io_uring_enter(r5, 0x6700, 0x0, 0x0, 0x0, 0x0) setresgid(0x0, 0x0, 0x0) r6 = socket$nl_xfrm(0x10, 0x3, 0x6) sendfile(r6, r1, 0x0, 0x100000002) 05:06:16 executing program 5: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f00000004c0)=ANY=[], 0x208e24b) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r2 = syz_io_uring_setup(0x70c4, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000400000/0xc00000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000000)=0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000180)=@IORING_OP_LINK_TIMEOUT={0xf, 0xa89a1c1bd660819, 0x0, 0x0, 0x0, &(0x7f0000000140)}, 0x0) r5 = dup(r2) syz_io_uring_submit(r3, r4, &(0x7f0000000040)=@IORING_OP_CONNECT={0x10, 0x0, 0x0, r5, 0x0, 0x0}, 0x1) io_uring_enter(r5, 0x6700, 0x0, 0x0, 0x0, 0x0) r6 = openat$pidfd(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) recvmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000004c80)={0x77359400}) r7 = syz_open_dev$tty1(0xc, 0x4, 0x1) r8 = syz_open_procfs(0x0, &(0x7f0000000240)='mountinfo\x00') sendfile(r7, r8, 0x0, 0x800000080004103) r9 = syz_open_dev$tty1(0xc, 0x4, 0x1) r10 = syz_open_procfs(0x0, &(0x7f0000000240)='mountinfo\x00') sendfile(r9, r10, 0x0, 0x800000080004103) sendmsg$unix(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000340)=[{&(0x7f00000002c0)="e1d0110da900c5da34f971c2484e494f23dc738088019f545fe3c05e076a3ab6e34079a5a101d94f169da180e02dd89a1b3ec0de135013fd990107cfc17fb3e7f1fef3366f8881dea4b7da7b66ddfdac9fd85e929dfdd6083a29e0c6f103c411e8d083c975df102fbbd3a85cc934dd81bb848c3ddf2a8dfff7775721", 0x7c}, {&(0x7f00000000c0)="f61c2fbadf4b83c179dea911a942f404f7d3d56694b80d80e9d309dc6cfcd207461837485e69ba", 0x27}, {&(0x7f0000000200)="08b6f448aa9e", 0x6}], 0x3, &(0x7f0000000580)=[@cred={{0x1c}}, @rights={{0x18, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @rights={{0x24, 0x1, 0x1, [r2, r6, r8, r10, r2]}}], 0x80}, 0x4008000) setresgid(0x0, 0x0, 0x0) r11 = socket$nl_xfrm(0x10, 0x3, 0x6) sendfile(r11, r1, 0x0, 0x100000002) 05:06:16 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef01000a000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) [ 2948.368776][T14052] FAULT_INJECTION: forcing a failure. [ 2948.368776][T14052] name failslab, interval 1, probability 0, space 0, times 0 [ 2948.381465][T14052] CPU: 0 PID: 14052 Comm: syz-executor.1 Tainted: G W 5.14.0-rc7-syzkaller #0 [ 2948.391624][T14052] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2948.402026][T14052] Call Trace: [ 2948.405305][T14052] dump_stack_lvl+0xb7/0x103 [ 2948.410028][T14052] dump_stack+0x11/0x1a [ 2948.414192][T14052] should_fail+0x23c/0x250 [ 2948.418619][T14052] ? kcalloc+0x32/0x40 [ 2948.422741][T14052] __should_failslab+0x81/0x90 [ 2948.427592][T14052] should_failslab+0x5/0x20 [ 2948.432110][T14052] __kmalloc+0x66/0x340 [ 2948.436395][T14052] ? kmem_cache_alloc_trace+0x20f/0x310 [ 2948.441961][ C1] sd 0:0:1:0: [sg0] tag#735 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2948.442031][T14052] ? alloc_pipe_info+0xac/0x350 [ 2948.452485][ C1] sd 0:0:1:0: [sg0] tag#735 CDB: opcode=0xe5 (vendor) [ 2948.457353][T14052] kcalloc+0x32/0x40 [ 2948.457373][T14052] alloc_pipe_info+0x1be/0x350 [ 2948.464137][ C1] sd 0:0:1:0: [sg0] tag#735 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2948.468079][T14052] splice_direct_to_actor+0x5f7/0x650 [ 2948.472847][ C1] sd 0:0:1:0: [sg0] tag#735 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2948.482268][T14052] ? avc_has_perm+0xc8/0x150 [ 2948.482287][T14052] ? do_splice_direct+0x170/0x170 [ 2948.482315][T14052] ? security_file_permission+0x87/0xa0 [ 2948.487698][ C1] sd 0:0:1:0: [sg0] tag#735 CDB[20]: ba [ 2948.497109][T14052] ? rw_verify_area+0x136/0x250 [ 2948.522635][T14052] do_splice_direct+0xf5/0x170 [ 2948.527474][T14052] do_sendfile+0x773/0xda0 [ 2948.531886][T14052] __x64_sys_sendfile64+0xf2/0x130 [ 2948.537008][T14052] do_syscall_64+0x3d/0x90 [ 2948.541607][T14052] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 2948.547522][T14052] RIP: 0033:0x4665f9 05:06:17 executing program 0: r0 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ftruncate(0xffffffffffffffff, 0x0) lseek(r0, 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(0xffffffffffffffff, 0x40086602, &(0x7f0000000040)) perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000100)={'syztnl0\x00', &(0x7f0000000240)={'syztnl1\x00', 0x0, 0x2f, 0x1, 0x5, 0x1, 0x48, @mcast2, @ipv4={'\x00', '\xff\xff', @local}, 0x40, 0x8, 0x1, 0x2}}) r1 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r1, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f0000062c40)={0x8000000000, [], 0x0, "00001000"}) r2 = creat(&(0x7f0000000140)='./bus\x00', 0x0) io_setup(0x1, &(0x7f0000000180)=0x0) io_submit(r3, 0x45, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000000000, 0x0, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) fallocate(r0, 0x3, 0x0, 0x100000fe) 05:06:17 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef01000b000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) [ 2948.551405][T14052] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 [ 2948.571034][T14052] RSP: 002b:00007fb493b07188 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 [ 2948.579489][T14052] RAX: ffffffffffffffda RBX: 000000000056c038 RCX: 00000000004665f9 [ 2948.587540][T14052] RDX: 0000000000000000 RSI: 0000000000000004 RDI: 0000000000000007 [ 2948.595510][T14052] RBP: 00007fb493b071d0 R08: 0000000000000000 R09: 0000000000000000 [ 2948.603486][T14052] R10: 0000000100000002 R11: 0000000000000246 R12: 0000000000000001 [ 2948.611453][T14052] R13: 00007ffccf4067cf R14: 00007fb493b07300 R15: 0000000000022000 05:06:17 executing program 4: r0 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ftruncate(0xffffffffffffffff, 0x0) lseek(r0, 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000040)) r1 = getpgid(0x0) perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, r1, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$RTC_WKALM_SET(r0, 0x4028700f, &(0x7f0000000000)={0x1, 0x0, {0x10, 0x3b, 0x1, 0x1a, 0x9, 0x3, 0x0, 0xcc, 0x1}}) socket$inet6_udp(0xa, 0x2, 0x0) fsmount(r0, 0x0, 0x71) r2 = openat2(0xffffffffffffffff, &(0x7f00000001c0)='./bus\x00', 0x0, 0x0) sendto$inet6(r2, &(0x7f0000000300), 0x0, 0x0, 0x0, 0x0) r3 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r3, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f0000062c40)={0x8000000000, [], 0x0, "00001000"}) r4 = creat(&(0x7f0000000140)='./bus\x00', 0x0) io_setup(0x1, &(0x7f0000000180)=0x0) io_submit(r5, 0x45, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000000000, 0x0, 0x1, 0x0, r4, &(0x7f0000000000), 0x377140be6b5ef4c7}]) fallocate(r0, 0x3, 0x0, 0x100000fe) 05:06:17 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef01000c000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) [ 2948.766573][ C0] sd 0:0:1:0: [sg0] tag#667 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2948.776873][ C0] sd 0:0:1:0: [sg0] tag#667 CDB: opcode=0xe5 (vendor) [ 2948.783769][ C0] sd 0:0:1:0: [sg0] tag#667 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2948.793247][ C0] sd 0:0:1:0: [sg0] tag#667 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2948.802724][ C0] sd 0:0:1:0: [sg0] tag#667 CDB[20]: ba 05:06:17 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef01000d000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:06:17 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef01000e000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:06:17 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef01000f000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:06:17 executing program 2: r0 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ftruncate(0xffffffffffffffff, 0x0) lseek(r0, 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000040)) getpgid(0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat2(0xffffffffffffffff, &(0x7f00000001c0)='./bus\x00', 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000100)={'syztnl0\x00', &(0x7f0000000240)={'syztnl1\x00', 0x0, 0x2f, 0x1, 0x5, 0x1, 0x48, @mcast2, @ipv4={'\x00', '\xff\xff', @local}, 0x40, 0x8, 0x1, 0x2}}) r1 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r1, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5, 0x8}, 0x0, 0x0, 0x9, 0x7, 0x7fffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f0000062c40)={0x8000000000, [], 0x0, "00001000"}) r2 = creat(&(0x7f0000000140)='./bus\x00', 0x0) io_setup(0x1, &(0x7f0000000180)=0x0) io_submit(r3, 0x45, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000000000, 0x0, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) fallocate(r0, 0x3, 0x0, 0x100000fe) 05:06:17 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef010011000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:06:17 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f00000004c0)=ANY=[], 0x208e24b) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r2 = syz_io_uring_setup(0x70c4, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000400000/0xc00000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000000)=0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000180)=@IORING_OP_LINK_TIMEOUT={0xf, 0xa89a1c1bd660819, 0x0, 0x0, 0x0, &(0x7f0000000140)}, 0x0) r5 = dup(r2) syz_io_uring_submit(r3, r4, &(0x7f0000000040)=@IORING_OP_CONNECT={0x10, 0x0, 0x0, r5, 0x0, 0x0}, 0x1) io_uring_enter(r5, 0x6700, 0x0, 0x0, 0x0, 0x0) setresgid(0x0, 0x0, 0x0) r6 = socket$nl_xfrm(0x10, 0x3, 0x6) sendfile(r6, r1, 0x0, 0x100000002) 05:06:17 executing program 5: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f00000004c0)=ANY=[], 0x208e24b) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r2 = syz_io_uring_setup(0x70c4, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000400000/0xc00000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000000)=0x0) openat$cgroup_ro(r0, &(0x7f00000000c0)='memory.stat\x00', 0x0, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000180)=@IORING_OP_LINK_TIMEOUT={0xf, 0xa89a1c1bd660819, 0x0, 0x0, 0x0, &(0x7f0000000140)}, 0x0) r5 = dup(r2) syz_io_uring_submit(r3, r4, &(0x7f0000000040)=@IORING_OP_CONNECT={0x10, 0x0, 0x0, r5, 0x0, 0x0}, 0x1) io_uring_enter(r5, 0x6700, 0x0, 0x0, 0x0, 0x0) openat$pidfd(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) recvmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000004c80)={0x77359400}) setresgid(0x0, 0x0, 0x0) r6 = socket$nl_xfrm(0x10, 0x3, 0x6) sendfile(r6, r1, 0x0, 0x100000002) 05:06:17 executing program 0: r0 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ftruncate(0xffffffffffffffff, 0x0) lseek(r0, 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(0xffffffffffffffff, 0x40086602, &(0x7f0000000040)) perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000100)={'syztnl0\x00', &(0x7f0000000240)={'syztnl1\x00', 0x0, 0x2f, 0x1, 0x5, 0x1, 0x48, @mcast2, @ipv4={'\x00', '\xff\xff', @local}, 0x40, 0x8, 0x1, 0x2}}) r1 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r1, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f0000062c40)={0x8000000000, [], 0x0, "00001000"}) r2 = creat(&(0x7f0000000140)='./bus\x00', 0x0) io_setup(0x1, &(0x7f0000000180)=0x0) io_submit(r3, 0x45, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000000000, 0x0, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) fallocate(r0, 0x3, 0x0, 0x100000fe) 05:06:17 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef010014000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:06:18 executing program 4: r0 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ftruncate(0xffffffffffffffff, 0x0) lseek(r0, 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000040)) r1 = getpgid(0x0) perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, r1, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$RTC_WKALM_SET(r0, 0x4028700f, &(0x7f0000000000)={0x1, 0x0, {0x10, 0x3b, 0x1, 0x1a, 0x9, 0x3, 0x0, 0xcc, 0x1}}) socket$inet6_udp(0xa, 0x2, 0x0) fsmount(r0, 0x0, 0x71) r2 = openat2(0xffffffffffffffff, &(0x7f00000001c0)='./bus\x00', 0x0, 0x0) sendto$inet6(r2, &(0x7f0000000300), 0x0, 0x0, 0x0, 0x0) r3 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r3, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f0000062c40)={0x8000000000, [], 0x0, "00001000"}) r4 = creat(&(0x7f0000000140)='./bus\x00', 0x0) io_setup(0x1, &(0x7f0000000180)=0x0) io_submit(r5, 0x45, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000000000, 0x0, 0x1, 0x0, r4, &(0x7f0000000000), 0x377140be6b5ef4c7}]) fallocate(r0, 0x3, 0x0, 0x100000fe) [ 2949.280066][ C0] sd 0:0:1:0: [sg0] tag#687 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2949.290368][ C0] sd 0:0:1:0: [sg0] tag#687 CDB: opcode=0xe5 (vendor) [ 2949.297150][ C0] sd 0:0:1:0: [sg0] tag#687 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2949.306653][ C0] sd 0:0:1:0: [sg0] tag#687 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2949.316157][ C0] sd 0:0:1:0: [sg0] tag#687 CDB[20]: ba 05:06:18 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef01041c000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) [ 2949.390729][ C1] sd 0:0:1:0: [sg0] tag#705 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2949.401046][ C1] sd 0:0:1:0: [sg0] tag#705 CDB: opcode=0xe5 (vendor) [ 2949.407841][ C1] sd 0:0:1:0: [sg0] tag#705 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2949.417399][ C1] sd 0:0:1:0: [sg0] tag#705 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2949.426890][ C1] sd 0:0:1:0: [sg0] tag#705 CDB[20]: ba 05:06:18 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef01002e000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:06:18 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef010033000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:06:18 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef01003f000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:06:18 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef010040000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:06:18 executing program 2: r0 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ftruncate(0xffffffffffffffff, 0x0) lseek(r0, 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000040)) getpgid(0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat2(0xffffffffffffffff, &(0x7f00000001c0)='./bus\x00', 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000100)={'syztnl0\x00', &(0x7f0000000240)={'syztnl1\x00', 0x0, 0x2f, 0x1, 0x5, 0x1, 0x48, @mcast2, @ipv4={'\x00', '\xff\xff', @local}, 0x40, 0x8, 0x1, 0x2}}) r1 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r1, 0x2285, &(0x7f0000000380)={0x0, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5, 0x8}, 0x0, 0x0, 0x9, 0x7, 0x7fffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f0000062c40)={0x8000000000, [], 0x0, "00001000"}) r2 = creat(&(0x7f0000000140)='./bus\x00', 0x0) io_setup(0x1, &(0x7f0000000180)=0x0) io_submit(r3, 0x45, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000000000, 0x0, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) fallocate(r0, 0x3, 0x0, 0x100000fe) 05:06:18 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef01004b000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:06:18 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f00000004c0)=ANY=[], 0x208e24b) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r2 = syz_io_uring_setup(0x70c4, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000400000/0xc00000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000000)=0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000180)=@IORING_OP_LINK_TIMEOUT={0xf, 0xa89a1c1bd660819, 0x0, 0x0, 0x0, &(0x7f0000000140)}, 0x0) r5 = dup(r2) syz_io_uring_submit(r3, r4, &(0x7f0000000040)=@IORING_OP_CONNECT={0x10, 0x0, 0x0, r5, 0x0, 0x0}, 0x1) io_uring_enter(r5, 0x6700, 0x0, 0x0, 0x0, 0x0) setresgid(0x0, 0x0, 0x0) r6 = socket$nl_xfrm(0x10, 0x3, 0x6) sendfile(r6, r1, 0x0, 0x7ffff000) 05:06:18 executing program 4: r0 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ftruncate(0xffffffffffffffff, 0x0) lseek(r0, 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000040)) r1 = getpgid(0x0) perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, r1, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$RTC_WKALM_SET(r0, 0x4028700f, &(0x7f0000000000)={0x1, 0x0, {0x10, 0x3b, 0x1, 0x1a, 0x9, 0x3, 0x0, 0xcc, 0x1}}) socket$inet6_udp(0xa, 0x2, 0x0) fsmount(r0, 0x0, 0x71) r2 = openat2(0xffffffffffffffff, &(0x7f00000001c0)='./bus\x00', 0x0, 0x0) sendto$inet6(r2, &(0x7f0000000300), 0x0, 0x0, 0x0, 0x0) syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5, 0x8}, 0x0, 0x0, 0x9, 0x7, 0x7fffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f0000062c40)={0x8000000000, [], 0x0, "00001000"}) r3 = creat(&(0x7f0000000140)='./bus\x00', 0x0) io_setup(0x1, &(0x7f0000000180)=0x0) io_submit(r4, 0x45, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000000000, 0x0, 0x1, 0x0, r3, &(0x7f0000000000), 0x377140be6b5ef4c7}]) fallocate(r0, 0x3, 0x0, 0x100000fe) 05:06:18 executing program 5: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r1 = syz_open_dev$tty1(0xc, 0x4, 0x1) r2 = syz_open_procfs(0x0, &(0x7f0000000240)='mountinfo\x00') sendfile(r1, r2, 0x0, 0x800000080004103) mmap(&(0x7f000067b000/0x3000)=nil, 0x3000, 0x4, 0x8010, r2, 0xf4f20000) write$binfmt_script(r0, &(0x7f00000004c0)=ANY=[], 0x208e24b) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) fsconfig$FSCONFIG_SET_FD(0xffffffffffffffff, 0x5, &(0x7f0000000200)='timerslack_ns\x00', 0x0, 0xffffffffffffffff) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r4 = syz_io_uring_setup(0x70c4, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0xffffffff}, &(0x7f00009f0000/0x1000)=nil, &(0x7f0000400000/0xc00000)=nil, &(0x7f0000000100)=0x0, &(0x7f00000002c0)=0x0) syz_io_uring_submit(r5, r6, &(0x7f0000000180)=@IORING_OP_LINK_TIMEOUT={0xf, 0xa89a1c1bd660819, 0x0, 0x0, 0x0, &(0x7f0000000140)}, 0x0) r7 = dup(r4) syz_io_uring_submit(r5, r6, &(0x7f0000000040)=@IORING_OP_CONNECT={0x10, 0x0, 0x0, r7, 0x0, 0x0}, 0x1) syz_open_procfs(0x0, &(0x7f00000000c0)='timerslack_ns\x00') io_uring_enter(r7, 0x6700, 0x0, 0x0, 0x0, 0x0) openat$pidfd(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) recvmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000004c80)={0x77359400}) setresgid(0x0, 0x0, 0x0) r8 = socket$nl_xfrm(0x10, 0x3, 0x6) sendfile(r8, r3, 0x0, 0x100000002) 05:06:18 executing program 0: r0 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ftruncate(0xffffffffffffffff, 0x0) lseek(r0, 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(0xffffffffffffffff, 0x40086602, &(0x7f0000000040)) perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000100)={'syztnl0\x00', &(0x7f0000000240)={'syztnl1\x00', 0x0, 0x2f, 0x1, 0x5, 0x1, 0x48, @mcast2, @ipv4={'\x00', '\xff\xff', @local}, 0x40, 0x8, 0x1, 0x2}}) r1 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r1, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f0000062c40)={0x8000000000, [], 0x0, "00001000"}) r2 = creat(&(0x7f0000000140)='./bus\x00', 0x0) io_setup(0x1, &(0x7f0000000180)=0x0) io_submit(r3, 0x45, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000000000, 0x0, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) fallocate(r0, 0x3, 0x0, 0x100000fe) 05:06:18 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef010064000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) [ 2950.290786][ C1] sd 0:0:1:0: [sg0] tag#731 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2950.301096][ C1] sd 0:0:1:0: [sg0] tag#731 CDB: opcode=0xe5 (vendor) [ 2950.307982][ C1] sd 0:0:1:0: [sg0] tag#731 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2950.317488][ C1] sd 0:0:1:0: [sg0] tag#731 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2950.327007][ C1] sd 0:0:1:0: [sg0] tag#731 CDB[20]: ba 05:06:19 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef010384000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:06:19 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef01fffe000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:06:19 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef011fff000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:06:19 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef010000100000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:06:19 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef010002000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:06:19 executing program 2: r0 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ftruncate(0xffffffffffffffff, 0x0) lseek(r0, 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000040)) getpgid(0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat2(0xffffffffffffffff, &(0x7f00000001c0)='./bus\x00', 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000100)={'syztnl0\x00', &(0x7f0000000240)={'syztnl1\x00', 0x0, 0x2f, 0x1, 0x5, 0x1, 0x48, @mcast2, @ipv4={'\x00', '\xff\xff', @local}, 0x40, 0x8, 0x1, 0x2}}) r1 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r1, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x0, 0x0, @scatter={0x0, 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5, 0x8}, 0x0, 0x0, 0x9, 0x7, 0x7fffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f0000062c40)={0x8000000000, [], 0x0, "00001000"}) r2 = creat(&(0x7f0000000140)='./bus\x00', 0x0) io_setup(0x1, &(0x7f0000000180)=0x0) io_submit(r3, 0x45, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000000000, 0x0, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) fallocate(r0, 0x3, 0x0, 0x100000fe) 05:06:19 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef010003000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:06:19 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f00000004c0)=ANY=[], 0x208e24b) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r2 = syz_io_uring_setup(0x70c4, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000400000/0xc00000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000000)=0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000180)=@IORING_OP_LINK_TIMEOUT={0xf, 0xa89a1c1bd660819, 0x0, 0x0, 0x0, &(0x7f0000000140)}, 0x0) r5 = dup(r2) syz_io_uring_submit(r3, r4, &(0x7f0000000040)=@IORING_OP_CONNECT={0x10, 0x0, 0x0, r5, 0x0, 0x0}, 0x1) io_uring_enter(r5, 0x6700, 0x0, 0x0, 0x0, 0x0) setresgid(0x0, 0x0, 0x0) r6 = socket$nl_xfrm(0x10, 0x3, 0x6) sendfile(r6, r1, 0x0, 0x100000003) 05:06:19 executing program 4: r0 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ftruncate(0xffffffffffffffff, 0x0) lseek(r0, 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000040)) r1 = getpgid(0x0) perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, r1, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$RTC_WKALM_SET(r0, 0x4028700f, &(0x7f0000000000)={0x1, 0x0, {0x10, 0x3b, 0x1, 0x1a, 0x9, 0x3, 0x0, 0xcc, 0x1}}) socket$inet6_udp(0xa, 0x2, 0x0) fsmount(r0, 0x0, 0x71) r2 = openat2(0xffffffffffffffff, &(0x7f00000001c0)='./bus\x00', 0x0, 0x0) sendto$inet6(r2, &(0x7f0000000300), 0x0, 0x0, 0x0, 0x0) syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5, 0x8}, 0x0, 0x0, 0x9, 0x7, 0x7fffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f0000062c40)={0x8000000000, [], 0x0, "00001000"}) r3 = creat(&(0x7f0000000140)='./bus\x00', 0x0) io_setup(0x1, &(0x7f0000000180)=0x0) io_submit(r4, 0x45, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000000000, 0x0, 0x1, 0x0, r3, &(0x7f0000000000), 0x377140be6b5ef4c7}]) fallocate(r0, 0x3, 0x0, 0x100000fe) 05:06:19 executing program 5: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f00000004c0)=ANY=[], 0x208e24b) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r2 = syz_io_uring_setup(0x70c4, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000400000/0xc00000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000000)=0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000180)=@IORING_OP_LINK_TIMEOUT={0xf, 0xa89a1c1bd660819, 0x0, 0x0, 0x0, &(0x7f0000000140)}, 0x0) r5 = dup(r2) syz_io_uring_submit(r3, r4, &(0x7f0000000040)=@IORING_OP_CONNECT={0x10, 0x0, 0x0, r5, 0x0, 0x0}, 0x1) io_uring_enter(r5, 0x6700, 0x0, 0x0, 0x0, 0x0) openat$pidfd(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) recvmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000004c80)={0x77359400}) pidfd_send_signal(r0, 0x6, &(0x7f00000002c0)={0x37, 0x7c2a8f9d, 0x9ff}, 0x0) setresgid(0x0, 0x0, 0x0) r6 = socket$nl_xfrm(0x10, 0x3, 0x6) sendfile(r6, r1, 0x0, 0x100000002) 05:06:19 executing program 0: r0 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ftruncate(0xffffffffffffffff, 0x0) lseek(r0, 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(0xffffffffffffffff, 0x40086602, &(0x7f0000000040)) perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000100)={'syztnl0\x00', &(0x7f0000000240)={'syztnl1\x00', 0x0, 0x2f, 0x1, 0x5, 0x1, 0x48, @mcast2, @ipv4={'\x00', '\xff\xff', @local}, 0x40, 0x8, 0x1, 0x2}}) r1 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r1, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f0000062c40)={0x8000000000, [], 0x0, "00001000"}) r2 = creat(&(0x7f0000000140)='./bus\x00', 0x0) io_setup(0x1, &(0x7f0000000180)=0x0) io_submit(r3, 0x45, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000000000, 0x0, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) fallocate(r0, 0x3, 0x0, 0x100000fe) 05:06:19 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef010004000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) [ 2951.288389][ C0] sd 0:0:1:0: [sg0] tag#708 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2951.299050][ C0] sd 0:0:1:0: [sg0] tag#708 CDB: opcode=0xe5 (vendor) [ 2951.305843][ C0] sd 0:0:1:0: [sg0] tag#708 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2951.315327][ C0] sd 0:0:1:0: [sg0] tag#708 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2951.324817][ C0] sd 0:0:1:0: [sg0] tag#708 CDB[20]: ba 05:06:20 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef010005000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:06:20 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef010006000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:06:20 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef010007000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:06:20 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef010008000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:06:20 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef010009000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:06:20 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef01000a000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:06:20 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f00000004c0)=ANY=[], 0x208e24b) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r2 = syz_io_uring_setup(0x70c4, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000400000/0xc00000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000000)=0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000180)=@IORING_OP_LINK_TIMEOUT={0xf, 0xa89a1c1bd660819, 0x0, 0x0, 0x0, &(0x7f0000000140)}, 0x0) r5 = dup(r2) syz_io_uring_submit(r3, r4, &(0x7f0000000040)=@IORING_OP_CONNECT={0x10, 0x0, 0x0, r5, 0x0, 0x0}, 0x1) io_uring_enter(r5, 0x6700, 0x0, 0x0, 0x0, 0x0) setresgid(0x0, 0x0, 0x0) r6 = socket$nl_xfrm(0x10, 0x3, 0x6) sendfile(r6, r1, 0x0, 0x100000004) 05:06:20 executing program 2: r0 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ftruncate(0xffffffffffffffff, 0x0) lseek(r0, 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000040)) getpgid(0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat2(0xffffffffffffffff, &(0x7f00000001c0)='./bus\x00', 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000100)={'syztnl0\x00', &(0x7f0000000240)={'syztnl1\x00', 0x0, 0x2f, 0x1, 0x5, 0x1, 0x48, @mcast2, @ipv4={'\x00', '\xff\xff', @local}, 0x40, 0x8, 0x1, 0x2}}) r1 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r1, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x0, 0x0, @scatter={0x0, 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5, 0x8}, 0x0, 0x0, 0x9, 0x7, 0x7fffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f0000062c40)={0x8000000000, [], 0x0, "00001000"}) r2 = creat(&(0x7f0000000140)='./bus\x00', 0x0) io_setup(0x1, &(0x7f0000000180)=0x0) io_submit(r3, 0x45, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000000000, 0x0, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) fallocate(r0, 0x3, 0x0, 0x100000fe) 05:06:20 executing program 4: r0 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ftruncate(0xffffffffffffffff, 0x0) lseek(r0, 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000040)) r1 = getpgid(0x0) perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, r1, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$RTC_WKALM_SET(r0, 0x4028700f, &(0x7f0000000000)={0x1, 0x0, {0x10, 0x3b, 0x1, 0x1a, 0x9, 0x3, 0x0, 0xcc, 0x1}}) socket$inet6_udp(0xa, 0x2, 0x0) fsmount(r0, 0x0, 0x71) r2 = openat2(0xffffffffffffffff, &(0x7f00000001c0)='./bus\x00', 0x0, 0x0) sendto$inet6(r2, &(0x7f0000000300), 0x0, 0x0, 0x0, 0x0) syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5, 0x8}, 0x0, 0x0, 0x9, 0x7, 0x7fffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f0000062c40)={0x8000000000, [], 0x0, "00001000"}) r3 = creat(&(0x7f0000000140)='./bus\x00', 0x0) io_setup(0x1, &(0x7f0000000180)=0x0) io_submit(r4, 0x45, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000000000, 0x0, 0x1, 0x0, r3, &(0x7f0000000000), 0x377140be6b5ef4c7}]) fallocate(r0, 0x3, 0x0, 0x100000fe) 05:06:20 executing program 5: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f00000004c0)=ANY=[], 0x208e24b) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r2 = openat(0xffffffffffffffff, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) syz_mount_image$msdos(&(0x7f0000001240), &(0x7f0000001280)='./file0\x00', 0x0, 0x0, &(0x7f0000001340), 0x0, &(0x7f0000001380)={[{@fat=@gid}]}) r3 = syz_io_uring_setup(0x70c4, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000400000/0xc00000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000000)=0x0) syz_io_uring_submit(r4, r5, &(0x7f0000000180)=@IORING_OP_LINK_TIMEOUT={0xf, 0xa89a1c1bd660819, 0x0, 0x0, 0x0, &(0x7f0000000140)}, 0x0) r6 = dup(r3) syz_io_uring_submit(r4, r5, &(0x7f0000000040)=@IORING_OP_CONNECT={0x10, 0x0, 0x0, r6, 0x0, 0x0}, 0x1) io_uring_enter(r6, 0x6700, 0x0, 0x0, 0x0, 0x0) openat$pidfd(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) recvmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000004c80)={0x77359400}) setresgid(0x0, 0x0, 0x0) r7 = socket$nl_xfrm(0x10, 0x3, 0x6) sendfile(r7, r1, 0x0, 0x100000002) 05:06:20 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef01000b000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:06:20 executing program 0: r0 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ftruncate(0xffffffffffffffff, 0x0) lseek(r0, 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(0xffffffffffffffff, 0x40086602, &(0x7f0000000040)) perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000100)={'syztnl0\x00', &(0x7f0000000240)={'syztnl1\x00', 0x0, 0x2f, 0x1, 0x5, 0x1, 0x48, @mcast2, @ipv4={'\x00', '\xff\xff', @local}, 0x40, 0x8, 0x1, 0x2}}) r1 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r1, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f0000062c40)={0x8000000000, [], 0x0, "00001000"}) r2 = creat(&(0x7f0000000140)='./bus\x00', 0x0) io_setup(0x1, &(0x7f0000000180)=0x0) io_submit(r3, 0x45, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000000000, 0x0, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) fallocate(r0, 0x3, 0x0, 0x100000fe) 05:06:21 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef01000c000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) [ 2952.302693][ C0] sd 0:0:1:0: [sg0] tag#735 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2952.313014][ C0] sd 0:0:1:0: [sg0] tag#735 CDB: opcode=0xe5 (vendor) [ 2952.319797][ C0] sd 0:0:1:0: [sg0] tag#735 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2952.329621][ C0] sd 0:0:1:0: [sg0] tag#735 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2952.339101][ C0] sd 0:0:1:0: [sg0] tag#735 CDB[20]: ba 05:06:21 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef01000d000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:06:21 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef01000e000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:06:21 executing program 5: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f00000004c0)=ANY=[], 0x208e24b) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r2 = syz_io_uring_setup(0x70c4, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000400000/0xc00000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000000)=0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000180)=@IORING_OP_LINK_TIMEOUT={0xf, 0xa89a1c1bd660819, 0x0, 0x0, 0x0, &(0x7f0000000140)}, 0x0) r5 = dup(r2) syz_io_uring_submit(r3, r4, &(0x7f0000000040)=@IORING_OP_CONNECT={0x10, 0x0, 0x0, r5, 0x0, 0x0}, 0x1) io_uring_enter(r5, 0x6700, 0x0, 0x0, 0x0, 0x0) r6 = syz_io_uring_setup(0x7bd6, &(0x7f0000000100), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000400000/0xc00000)=nil, &(0x7f0000000180), &(0x7f00000001c0)) io_uring_register$IORING_REGISTER_PERSONALITY(r6, 0x9, 0x0, 0x0) io_uring_enter(r2, 0x2178, 0x954e, 0x1, &(0x7f0000000740)={[0x6]}, 0x8) io_uring_register$IORING_UNREGISTER_PERSONALITY(r6, 0xa, 0x0, 0x0) r7 = syz_io_uring_setup(0x7bd6, &(0x7f0000000100), &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000400000/0xc00000)=nil, &(0x7f00000002c0), &(0x7f00000001c0)) r8 = io_uring_register$IORING_REGISTER_PERSONALITY(r7, 0x9, 0x0, 0x0) io_uring_register$IORING_UNREGISTER_PERSONALITY(r6, 0xa, 0x0, r8) syz_io_uring_submit(r3, r4, &(0x7f0000000700)=@IORING_OP_SENDMSG={0x9, 0x5, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000680)=[{&(0x7f00000002c0)="ea58c1864b20e1f200fccfe78ff6083fff71058b4d17dd757164bed185f19e5c6c8a08311300e52016e49143ce55bf66d4ff798ff756f2cb006ed0eadb6c3669f7ebebac58fb250a12a6595c969f87331ab4a215a2c3222b51f30bd225dfd091380e831286838a2794e84a893501075cacb11df73e110e8bcc5ade398e7f9cab44a7cd48bb0447eef5d106", 0x8b}, {&(0x7f00000000c0)="58cb403001afc65e", 0x8}, {&(0x7f0000000380)="db095732cb43ce6420157914363b695468af066e00b90718df0578998b8ff46f40b4f97fb96b6eed78f8454537385849d78a74cd3d8b5595ff02ac53439033ace4961e06ab4589db37877883963f5196de38978fe29864fbece593fd72b8cc15a8c27a37d6edbbc27ab694ae53bca36b3b086484e2fbf861561c1766f1844ff4470b6e533658f73d41054bbd46c373bc6923abe530a2c88e1f82d46656e1a6e16dce1e2db5f3dc4d090b277f8215294f8eaeee74250580bc4b04f2d5804bf74d2625917767bf2a21b1309a12a41b278be2d0ef98c150d56d", 0xd8}, {&(0x7f0000000480)="b732acb0d7f2ab4b231ba140201c8fc935301a310e5b2dd185cb4699eec1b28988c0f545dc5d6476b3542bed673079c561435d1e00d676aef82d92aa7b39adf324c462670581ab5a418245e0c3bbf5cd5e0a30bf7efc0e56e261b26a4c1b684a13dd8d2f9838c606304b1e548bb8054aa66deefb5ade84fb741468343aa2edeb7af781e5c2e9c740e220435eea8378a24526847a824db58fdd99ea90a8c878b0026ddb796ba0ce5ba87cf52f57ddc91f3b53d6510e1f04d11d30193b41a09258ebabec05cbcadab02b8735cbd2894e76b75ecfd8b173fa05b6b1b7ebcd73f1599d8a67af5e4a", 0xe6}, {&(0x7f0000000580)="6ab1f0d97dd15012b7734bf31d0eb4887fa6bf9c263c7eb2ef1a8d8b49b456e1371dbc5f756fd3e69d52c295683679a0e382754099ab871f28fb1b9fdf46093ebb353d85da6d0b84adca08ec36bafb163a8846a209451c88836eae110ca99b8dc9becab8fe4b3376afecf74f500ae15b48dff191e0b234df6c96fd1a5d359dd57f0df7111a64244e5bcc82009e0a9f0e88175e858c68cba90996c7d76336b6c7b8e2cd55501c0121b661d54e72f036409b275b3df0fc112dd41af4bb364634484807d708a00ebde83bc62451f5159c9834d28a", 0xd3}], 0x5, &(0x7f0000000940)=ANY=[@ANYBLOB="d00000000000000017010000ff0f0000f572c81916ef2bfc82e303616993c4eb31b8b71d4ce86f2ae58074ee32dba36d796684079fad592ed3eb67ae0a81cf621246f594384197076793fe8b62ebe077e401a171fac57663d6f7aff599868400acdce249d62ac84334306487632e94c0cf7f4bc02b0a35514ba94eceba2e443cf1898acc428bd0a5182f11c83162d565a9f8d3a458c0a4aaf991e2fc425cdd9e2b0978e402662260c3e9fa9c2efcfc89ff0e21aae865f99da558472ebb691c19fbb8c4a3ece444a0a8e000000000000038000000000000001001000099590000979e4d122ee359625d07024340c6831d6657f9cc31b9857bea1732bd5a1c5e9499f0ca8d2996fab3f80000000000000016010000e1cf0000b6885e4335a4318a52c7e161baa0b21fe597f59760b4940d7010bf6cab44438ad622d5b4305a62726deaad323603cbccc5331542de350a0d88d39974b9c2578776feb9f01015cf8c17e9158698d0a992051cb88593f95da5b17b2fa0d15f2020bb4fd2362b580135faa0f5a72b693e14e5808e4270a55eb572e5b0962feca125e034166f5adadefafe1b99353dc550b1099502d034515648db3236434639dd797a9afea0784bcb9fb9e5f52c1f743c127e71c999b9a9c91060153d859e506c769e5a9ed525cf289aaf4c8cde9a612bf87c811988d41adb4d7db539a347e8a0f8a1241b5b5336ba0010100000000000000600000001000000cbc9679cc7b35baef6266862a9a3f1c56e5794397d67f86bfd67b709ceff150debab014e3b21199e459770676b02b3ed46b462d54a6e465e325ce284dfb1325fc6b04288378c62a5e4796b4b14d49d3cb5509c1d45d4ac248e89555b8b59012e147b2d799b139a1fbbc4a34c0c4dfa8f819ea9e888a1345f33023bf2e40bed088a5377417060df2169955d44e1815fe7134a1052b8e445d017443a6e7087f37a0b03921c760166af98c1a0b13128ee96a3422f16ccabb129e638dfc0617a2676e0ea4f7693e3ed1659b482a2d1d34ef0155ae5b3ff62acbf8b53597fb1b390e329a2685bf840c87c9da7ccc4015e2679ed2c2cdb80f777471ca08a457e96cd2d9340569cdd507564685290d6240398852f75b2cc966458b4f624e1d17fc29faa8a1243797e1d10d8d11225ab44457ea40b3d75105563b8b7eb58c654c1cd5fbaef8af5285968d59d58fe8d9b0a5b9c4992840b5fe6cb26537071a30146c82890ada0723893b0320a3c89cf3d1114b84463b9acb8cb62f4fcd95b77c332a34291ef3532b7599961a00a7746c5c907e1a138e4b6eaaf5a0d12576c60290a1597a1c548541dda8b7db98ada9cc1e46f41e48b21d31e335f17ed47686a33b64ee1732a9d9fd4c848db52fb4558007cb14d5ca239eb847033d89441c3f2978851619061bab89b25e41342ef78f57e5fe5c9ff3d0380635a14d9fdba63f77dcd9660f6ae3f8374b6b22eba8d557d03c018956ea6df0bf656c345a283dc8fa35595cd323fd93fc32daca2de5246915870d96175cf593ade29cba9ef72323e1d28c55f07782619c28d0a9d5cffd4f8bef5e5e9bb0e2644e5dbd4d68cff3326073482686713fa20d212427a1c79d8d44ca5388d96e742daf09f8b1c3071f3939d3d2721a3ef6507e7dae4003a934ac3e2c5e6908846520a7d269ff893fcecfc2576fc67a7527b6ced771100f28bc2b875fda7524df262669af287b00b43df35281be59e555fb89a6e31ce7ed2b1ebb57680b0dd6212d4862876fca70e5436383d0c69bad7b01a7a5ce45055422a9e08d419e83874db710d707f6bb42a8729e665065360d503d01ff764c0c471bf5a1529a6bc2d0339dd554f2067db14f36d16df7ee68f7558f5559ed943d99f56067f6176a386e28c258c3e25d96b2d31acc6420b00bc8a1738b5331ef24747963ef73f7b4e3e4c33a50199ba0451b9fc891a7655c3137cfb64c3213551383fde90094a0acd0898ddc5c6b7376bf770405baa530e45e217a92bbc580daf63ed42979fd7e3bccb2de165755c4a939cec925a9e85b025a180133b7a63e5fb3c5092898807801345f92c5edb53b99d6470642ec4fe3d2537ffed659afa4b2591ec95131d473cd32a020e0c7165d126ca582e29aee71ac342cd98458bdfc1d79cb1859bfb0245ed0af3bc66042ab7f262acaf8bc812eab189febd308fe8fcfc253e0524eacbd54837ebf7d6ee53567cad0bda298dcb77872f57a0d9b11e97fbbad65a4c6d9291cb4332ae4479c6d2b2d81b62489e08b3d834e79d44c0b222381c5aa6262b2628d500fa8e989b0f47f8f001ab8ebcc5d6db45ec8bb61ab74be9bfdf0f7a8dda8fea31b95c065a19e47af3bc1c6e335fe0d8ff47711c88f463d94949b7d2b31a2c6fbab271e30ae524b79fd62081b4c79d42c34453fa280266e8ef9cc08a18946b99e1afa657205637bc873c83b991bc89e97b59f34c30ed9634b9de49387b6a36cbbc1f41c8553a85675503e029b05b6e5e76196716f44b4ad2605ea2f20c74ceab4c8820a2c2b17eba6b999e82c172feac955d6e28547b3bb7e4ee6f6700c5ba3cfe7c6124ca8170ac08691e3b4c05b1739e96a491452022d54e5ff78fa00e7b55e9422b2601281a3f0a0e0c938a79fb4ba3f34c29a05d1627f502ba6b1cb8f1ec4d1059aab5401ed663a3838c8c317988aa03caad8f00cf0b6aaf5bc0b7628103df7ecae1063a1f27fdb24c255a0cc11f5f8aaeb1a5345cbe1a49c39cd0aa0366ba8b6cfe5aaecdce077bf67e15bf1be9fad2ea261628d86bff351417c03016db8ef7e95494e207b8a1ec26db016e577e16dc13697955a770fb66cc8d049b899282581eba0468598da5fa39f38b89af19e3654bfe2163eae955989a80019418398b587fdc723edee7bef3b84077bc996f2c5fc39b06a8acbb0afe232689428544a6c1bb497c0d18a028481d33663debf13bece1fb1e16a601999e7c3c8289d9db75aca215f71647ed2d7d88a577bad1be238187b606c300b7f18faa0895cf67053e5f5a5053574f79d3a48d827d06697aea0b40e993b23d441569c86e58617ab074a1d9b901e67c7c1744d8e98b2ee9b15a80587cff9e36d9fd58ffbab7ecd705510ece287777e735d97d9261a48382374e58d02db07de7ea29ada221a43d941be3886a86365e20c86caac3d0dc960c5cc81aae030bdfcbc798b167b3b59058883873e36d835ed09a2c17d5ffede57389d9f374a7ae6841a3d75cccec0eb8f96acb544955e3451a89bf75194f489ed6db7ede53a7dfd927ce837f7ed1d4e2567a1ed3b6e4f13e6434f88eb7b4e3132b009d9a0eec371242d17e7280989e9d08a8117db43635a47dfc057ac82d97f1e750f5dcc2976142e8a74bcf6f951a45651d4643244968857d6b518f126b7a947cfd63ad88aecb8f0f3468430b8e48374267f74b2f0b6a035f45ad33a4157309d4184719331fda24bbcbdb0ed478f70784d3f385a759a41add40e80aeb8934b2387bf89d376f868e9fdc3893e8ae1a956fcf47a703856dcf534a8eac3a2e531ec53f1eae36fa8705698a77c86a7b335d9aecdb93fbb53e2b06c97ae5d7c2bf77b0b812e62489a1df1cebe4f0b4a5a9f04c2e1446f1cf567c37491ecddae1ac29a1f33db67b5f7ebcb019bfd48dda805e7a65d36732e78ae792c8bbaa5a803f2b616d57323c303a98ae609ac41cbc506ca5ad59bc551354919fe7cbb7650c224eb6ec0e5c7bd599208dd294a0fac9c1af2b73a874b935d5402aa79b030fe752b4b5927c0ade2bf21441886a74b69cadffd822bf1ef704bce42f387d857772cc33297e53d8474e211105f8e4296f269e4ce44ac5ea2f2b352111e84864b44b33c8c5a8547a3cad1da4d2ced0921281589bb876da53ed8bc7d6077280c61665b583105ada88909637aa1369b3561a928fcdcf3ae1f86838e1038281cf4fb1f6aa1c0ff46c330ffa5474040421799f8fae977c01c7e10f9c008815f668765158282c289a87e474a24c3d6660f6c0ef7f1e4044857ca83cb1bd9f841dc482a56a708dbb437f826a3ec656ae2a7a225d101197b499e03b9fc08e0b33db786fc409a1c4f67fa1ce64037b9634764498a474c41cb9814157b15f1bb4a94d48aef04268988ba951fb1b980efc0eae2619d5e4caa82ed36533eed06956493917212899b0d90075bcce0b2f16feb5adaafd1e150fd5db3afc080f7df29e0e0a73ac570718869dd9278781906d1ec95cb7b7f9ce9199e60beb79c4a4329a10235ee2fe8c15d4991c246201b91ad60a6fb68c545e9df7eb07a60a93fb9996f0c09c586b8e9b64e517531417425c9cce5e8fa3c8a8fd2eef027a138db41531b4ec0e0d02d341e613759efe51952b9f654d8a50246cee98fc70428a6ae271a088f40c30ef439de4806333b2a2c3b72729fbe52ffed8c80b7996d77b38a969cd1f280f51e41d87c150c68005c441a0aaf617cb2c156efaedf20ac6929dba80b3df53441e79509d6610f637bcb72f1bcbce6821d58870a1e3fe5f1084e2a57fa0c5c9588199140f2b168605a263296817b7e3fd33de780655875a3111e15fc0b6e581cc100a4163c5c1ea9778dea99d8071a2ab6d7518b743fa454de0bd57d097c56460c79f4b82472b6216caa4b6b973227b97147eac8cedf7593b1b66bd9d490f87f52dfe2091c7763ee0ee59b50d9e8fd5ea0c7f0adb7faeaa0182404d636d8516c244effb70c3d6447cb7c1aa59e700857e218e5b6ffa5dedc88b8a186b3212e513a0b5daeffff3d7f8d320a18c85093c4b27c37f106d1e615b9bea83c739a9f94b9625a8f4d7ffe6cae6758c1d6dd141a2afe093b504c217a88fa2c5cab5a15e8d1d853e9a228779ef3a35e9f8e713d514339e9891e2eb8c9e746e75cea0e892ebc63ff9fe5c267de27bc2a9fb2ecb40ecb691aaacc3c4f6c1a562f1349bf32f53c13d7f3cfcd5282896155df6f42d291a0984cf5d1c47024148d7f95d47cdb9519bb0deb142ec4b406979cb54df45ec7e35ab69f4b11a9096059a0d0c02ac399cbfad2e858d63b327464a7dbc53f7b98514420df56d027347ef6b4c541ba90281411497917859d5328312ad6c2cca3ccebc13819456cfc2bd415cf4446a0a5f677dada32f08168150c945a4ef76a2c97167fe53d1da0799e28ccfba387d45a694b6b55ee3f684727673de46209597399d133f23d6e3d97af9579b8bbdd25ae04ea483227ac8796016f925cd652f022baeb28974d69693ca04591ca78a80db200603763c7d11451f3e4138269cf89bcec1e99f070477f3fdf91a242c761b57db92d1d3196bfc8a45fc85e7029c2ab3be5b682f376c2f069cbbc5509511d5487148945a22356e127ebef978f3c42cafef8fd90c51c1afa2fccf220ff96c1aa89d6d184abb940a382032fa2e0325c4e6aa6d7b37b3840de795c509a50b33a2d55cc98f55a6d3b65799eb259909ccc5be5570f75acbda8bbda7b6f0dbe34531912b046d0895c8bfb9e58c61f7166767e5a273e6293a912662529db687e2eefefd98f67088901a4819e8873b42dd59c75330b313c091de92a185f4b6c041b3a5ac5a7d8c0fafe6ad285631bb01f472be57d901dcfff21dd7b641eca0129100771516cc648c7973c96d8c9e25fba92c93bc2747c98287a99c73a1bb28c5ff6045f2e665e79193de045dbde46fa6429a485cf98a7264891d2e1433d49e4bb2b73e8841dce1a6ca5af4a8f6d7f1af487d24ab5ca5e72ceb0421fab1f32d6e4793adbe9ab5ced20aaee72d847892cc0b27385a9553ffc3f77f5901f9c694ec629f18f3396baafa74b05a360f2bdb679cff60cbef664e5fb3c21ab899e2c31ef7509a7f0ff020d60c0dc6d6fe112fbc2fc38b1e0f61b0d7fd47e34f50ea276f041814a182612115aec7f5da8998e8344336e5b783ac397e7efd1dbb60d7f38796f803cad572c7aa51093868d40907642c6e7ee27b17900ea306b56fe5978eaf465e7d1dbf56af802ffb3459060b31440107a341877ecab75e547b634f186ddf3327723a51ddfd28667e2d0ee915996fe595f87e8ffaa40b6877b87e57157ffa6314f429aa9e0d95df52978e2a2cfa6cb0e1ba6a36f365557c60edbfad4ff49839c95945b25f1c23aafc4a4138f22b540a402f7c808455d6d782a1e5269e9dbe42277e13ec6627182ff4099efd7fae96898c52d74fa19be267a3b7f6f1d57c71787148d21483c0709521d59977925bb6e323ff890ee9fd7297bcb0c3a6212028284a6c288c28ab6b6c087f04824a182a94c8ffbf0efd99d59abcae8ba0923ef368e60b42811302df523455b6a78571fc545cb7583acccc9284ddc7df1ec4e4eba95effa9e7e82026d663c09bfc478ea417ae431f91a57fea12565d86f7bd931432ff053b37f7065ad2a76d63ea8b5b4a39fb7ba3ed649e8e07f81fb3039fd6db238b4152fc1b0954f2159f0eb01217736d226bce2b879e00b3b708d87bcb3e8b6d28f7d0369b80dec946ce795dd24a9dc5cd86808d7be2a4cd466fecfc61b82bb4503216e16815e8b5dbdf5fca9544"], 0x1210}, 0x0, 0x45, 0x1, {0x0, r8}}, 0x3982e80e) openat$pidfd(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) setresgid(0x0, 0x0, 0x0) r9 = socket$nl_xfrm(0x10, 0x3, 0x6) sendfile(r9, r1, 0x0, 0x100000002) 05:06:21 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef01000f000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:06:21 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef010010000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:06:21 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f00000004c0)=ANY=[], 0x208e24b) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r2 = syz_io_uring_setup(0x70c4, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000400000/0xc00000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000000)=0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000180)=@IORING_OP_LINK_TIMEOUT={0xf, 0xa89a1c1bd660819, 0x0, 0x0, 0x0, &(0x7f0000000140)}, 0x0) r5 = dup(r2) syz_io_uring_submit(r3, r4, &(0x7f0000000040)=@IORING_OP_CONNECT={0x10, 0x0, 0x0, r5, 0x0, 0x0}, 0x1) io_uring_enter(r5, 0x6700, 0x0, 0x0, 0x0, 0x0) setresgid(0x0, 0x0, 0x0) r6 = socket$nl_xfrm(0x10, 0x3, 0x6) sendfile(r6, r1, 0x0, 0x100000005) 05:06:21 executing program 2: r0 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ftruncate(0xffffffffffffffff, 0x0) lseek(r0, 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000040)) getpgid(0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat2(0xffffffffffffffff, &(0x7f00000001c0)='./bus\x00', 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000100)={'syztnl0\x00', &(0x7f0000000240)={'syztnl1\x00', 0x0, 0x2f, 0x1, 0x5, 0x1, 0x48, @mcast2, @ipv4={'\x00', '\xff\xff', @local}, 0x40, 0x8, 0x1, 0x2}}) r1 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r1, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x0, 0x0, @scatter={0x0, 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5, 0x8}, 0x0, 0x0, 0x9, 0x7, 0x7fffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f0000062c40)={0x8000000000, [], 0x0, "00001000"}) r2 = creat(&(0x7f0000000140)='./bus\x00', 0x0) io_setup(0x1, &(0x7f0000000180)=0x0) io_submit(r3, 0x45, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000000000, 0x0, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) fallocate(r0, 0x3, 0x0, 0x100000fe) 05:06:21 executing program 4: r0 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ftruncate(0xffffffffffffffff, 0x0) lseek(r0, 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000040)) r1 = getpgid(0x0) perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, r1, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$RTC_WKALM_SET(r0, 0x4028700f, &(0x7f0000000000)={0x1, 0x0, {0x10, 0x3b, 0x1, 0x1a, 0x9, 0x3, 0x0, 0xcc, 0x1}}) socket$inet6_udp(0xa, 0x2, 0x0) fsmount(r0, 0x0, 0x71) r2 = openat2(0xffffffffffffffff, &(0x7f00000001c0)='./bus\x00', 0x0, 0x0) sendto$inet6(r2, &(0x7f0000000300), 0x0, 0x0, 0x0, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5, 0x8}, 0x0, 0x0, 0x9, 0x7, 0x7fffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f0000062c40)={0x8000000000, [], 0x0, "00001000"}) r3 = creat(&(0x7f0000000140)='./bus\x00', 0x0) io_setup(0x1, &(0x7f0000000180)=0x0) io_submit(r4, 0x45, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000000000, 0x0, 0x1, 0x0, r3, &(0x7f0000000000), 0x377140be6b5ef4c7}]) fallocate(r0, 0x3, 0x0, 0x100000fe) 05:06:21 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef010011000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:06:21 executing program 0: r0 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ftruncate(0xffffffffffffffff, 0x0) lseek(r0, 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(0xffffffffffffffff, 0x40086602, &(0x7f0000000040)) perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000100)={'syztnl0\x00', &(0x7f0000000240)={'syztnl1\x00', 0x0, 0x2f, 0x1, 0x5, 0x1, 0x48, @mcast2, @ipv4={'\x00', '\xff\xff', @local}, 0x40, 0x8, 0x1, 0x2}}) r1 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r1, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f0000062c40)={0x8000000000, [], 0x0, "00001000"}) r2 = creat(&(0x7f0000000140)='./bus\x00', 0x0) io_setup(0x1, &(0x7f0000000180)=0x0) io_submit(r3, 0x45, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000000000, 0x0, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) fallocate(r0, 0x3, 0x0, 0x100000fe) 05:06:22 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef010014000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) [ 2953.312620][ C0] sd 0:0:1:0: [sg0] tag#753 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2953.322915][ C0] sd 0:0:1:0: [sg0] tag#753 CDB: opcode=0xe5 (vendor) [ 2953.329718][ C0] sd 0:0:1:0: [sg0] tag#753 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2953.339216][ C0] sd 0:0:1:0: [sg0] tag#753 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2953.348860][ C0] sd 0:0:1:0: [sg0] tag#753 CDB[20]: ba 05:06:22 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef01002e000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:06:22 executing program 5: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f00000004c0)=ANY=[], 0x208e24b) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r2 = syz_io_uring_setup(0x70c4, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000400000/0xc00000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000000)=0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000180)=@IORING_OP_LINK_TIMEOUT={0xf, 0xa89a1c1bd660819, 0x0, 0x0, 0x0, &(0x7f0000000140)}, 0x0) r5 = dup(r2) syz_io_uring_submit(r3, r4, &(0x7f0000000040)=@IORING_OP_CONNECT={0x10, 0x3, 0x0, r5, 0x0, 0x0}, 0x1) io_uring_enter(r5, 0x6700, 0x0, 0x0, 0x0, 0x0) openat$pidfd(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) recvmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000004c80)={0x77359400}) setresgid(0x0, 0x0, 0x0) r6 = socket$nl_xfrm(0x10, 0x3, 0x6) sendfile(r6, r1, 0x0, 0x100000002) 05:06:22 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef010033000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:06:22 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef01004b000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:06:22 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef010064000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:06:22 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef0100fe000000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:06:22 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f00000004c0)=ANY=[], 0x208e24b) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r2 = syz_io_uring_setup(0x70c4, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000400000/0xc00000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000000)=0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000180)=@IORING_OP_LINK_TIMEOUT={0xf, 0xa89a1c1bd660819, 0x0, 0x0, 0x0, &(0x7f0000000140)}, 0x0) r5 = dup(r2) syz_io_uring_submit(r3, r4, &(0x7f0000000040)=@IORING_OP_CONNECT={0x10, 0x0, 0x0, r5, 0x0, 0x0}, 0x1) io_uring_enter(r5, 0x6700, 0x0, 0x0, 0x0, 0x0) setresgid(0x0, 0x0, 0x0) r6 = socket$nl_xfrm(0x10, 0x3, 0x6) sendfile(r6, r1, 0x0, 0x100000006) 05:06:22 executing program 2: r0 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ftruncate(0xffffffffffffffff, 0x0) lseek(r0, 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000040)) getpgid(0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat2(0xffffffffffffffff, &(0x7f00000001c0)='./bus\x00', 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000100)={'syztnl0\x00', &(0x7f0000000240)={'syztnl1\x00', 0x0, 0x2f, 0x1, 0x5, 0x1, 0x48, @mcast2, @ipv4={'\x00', '\xff\xff', @local}, 0x40, 0x8, 0x1, 0x2}}) r1 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r1, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x0, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200), 0x0, 0x0, 0x0, 0x0, 0x0}) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5, 0x8}, 0x0, 0x0, 0x9, 0x7, 0x7fffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f0000062c40)={0x8000000000, [], 0x0, "00001000"}) r2 = creat(&(0x7f0000000140)='./bus\x00', 0x0) io_setup(0x1, &(0x7f0000000180)=0x0) io_submit(r3, 0x45, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000000000, 0x0, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) fallocate(r0, 0x3, 0x0, 0x100000fe) 05:06:23 executing program 4: r0 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ftruncate(0xffffffffffffffff, 0x0) lseek(r0, 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000040)) r1 = getpgid(0x0) perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, r1, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$RTC_WKALM_SET(r0, 0x4028700f, &(0x7f0000000000)={0x1, 0x0, {0x10, 0x3b, 0x1, 0x1a, 0x9, 0x3, 0x0, 0xcc, 0x1}}) socket$inet6_udp(0xa, 0x2, 0x0) fsmount(r0, 0x0, 0x71) r2 = openat2(0xffffffffffffffff, &(0x7f00000001c0)='./bus\x00', 0x0, 0x0) sendto$inet6(r2, &(0x7f0000000300), 0x0, 0x0, 0x0, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5, 0x8}, 0x0, 0x0, 0x9, 0x7, 0x7fffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f0000062c40)={0x8000000000, [], 0x0, "00001000"}) r3 = creat(&(0x7f0000000140)='./bus\x00', 0x0) io_setup(0x1, &(0x7f0000000180)=0x0) io_submit(r4, 0x45, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000000000, 0x0, 0x1, 0x0, r3, &(0x7f0000000000), 0x377140be6b5ef4c7}]) fallocate(r0, 0x3, 0x0, 0x100000fe) 05:06:23 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef010084030000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:06:23 executing program 0: r0 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ftruncate(0xffffffffffffffff, 0x0) lseek(r0, 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(0xffffffffffffffff, 0x40086602, &(0x7f0000000040)) perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000100)={'syztnl0\x00', &(0x7f0000000240)={'syztnl1\x00', 0x0, 0x2f, 0x1, 0x5, 0x1, 0x48, @mcast2, @ipv4={'\x00', '\xff\xff', @local}, 0x40, 0x8, 0x1, 0x2}}) r1 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r1, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f0000062c40)={0x8000000000, [], 0x0, "00001000"}) r2 = creat(&(0x7f0000000140)='./bus\x00', 0x0) io_setup(0x1, &(0x7f0000000180)=0x0) io_submit(r3, 0x45, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000000000, 0x0, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) fallocate(r0, 0x3, 0x0, 0x100000fe) 05:06:23 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef010003040000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:06:23 executing program 5: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(r0, 0xc020f509, &(0x7f00000000c0)={r0, 0x0, 0xff, 0x24}) openat$cgroup_ro(r1, &(0x7f0000000200)='freezer.state\x00', 0x0, 0x0) write$binfmt_script(r0, &(0x7f00000004c0)=ANY=[], 0x208e24b) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r3 = syz_io_uring_setup(0x70c4, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000400000/0xc00000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000000)=0x0) syz_io_uring_submit(r4, r5, &(0x7f0000000180)=@IORING_OP_LINK_TIMEOUT={0xf, 0xa89a1c1bd660819, 0x0, 0x0, 0x0, &(0x7f0000000140)}, 0x0) r6 = dup(r3) syz_io_uring_submit(r4, r5, &(0x7f0000000040)=@IORING_OP_CONNECT={0x10, 0x0, 0x0, r6, 0x0, 0x0}, 0x1) io_uring_enter(r6, 0x6700, 0x0, 0x0, 0x0, 0x0) openat$pidfd(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) recvmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000004c80)={0x77359400}) setresgid(0x0, 0x0, 0x0) r7 = socket$nl_xfrm(0x10, 0x3, 0x6) sendfile(r7, r2, 0x0, 0x100000002) [ 2954.413444][ C1] sd 0:0:1:0: [sg0] tag#764 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2954.423776][ C1] sd 0:0:1:0: [sg0] tag#764 CDB: opcode=0xe5 (vendor) [ 2954.430563][ C1] sd 0:0:1:0: [sg0] tag#764 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2954.440154][ C1] sd 0:0:1:0: [sg0] tag#764 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2954.449654][ C1] sd 0:0:1:0: [sg0] tag#764 CDB[20]: ba 05:06:23 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef01001c040000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:06:23 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef010000050000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:06:23 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef010000060000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) [ 2954.728339][T14359] ================================================================== [ 2954.736472][T14359] BUG: KCSAN: data-race in ext4_setattr / generic_permission [ 2954.743877][T14359] [ 2954.746195][T14359] write to 0xffff888106fb2184 of 4 bytes by task 14358 on cpu 1: [ 2954.753900][T14359] ext4_setattr+0x51b/0xec0 [ 2954.758405][T14359] notify_change+0x8a3/0xa80 [ 2954.763000][T14359] chown_common+0x23e/0x370 [ 2954.767498][T14359] do_fchownat+0xf4/0x190 [ 2954.771816][T14359] __x64_sys_lchown+0x46/0x50 [ 2954.776489][T14359] do_syscall_64+0x3d/0x90 [ 2954.780898][T14359] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 2954.786794][T14359] [ 2954.789104][T14359] read to 0xffff888106fb2184 of 4 bytes by task 14359 on cpu 0: [ 2954.796732][T14359] generic_permission+0x32/0x420 [ 2954.801672][T14359] inode_permission+0x6b/0x290 [ 2954.806434][T14359] link_path_walk+0x17d/0x770 [ 2954.811113][T14359] path_lookupat+0x8b/0x3d0 [ 2954.815620][T14359] filename_lookup+0x118/0x3b0 [ 2954.820382][T14359] user_path_at_empty+0x3b/0x50 [ 2954.825236][T14359] path_setxattr+0x4b/0x180 [ 2954.829745][T14359] __x64_sys_setxattr+0x69/0x80 [ 2954.834601][T14359] do_syscall_64+0x3d/0x90 [ 2954.839017][T14359] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 2954.844916][T14359] [ 2954.847228][T14359] value changed: 0x000041ed -> 0x00004028 [ 2954.852934][T14359] [ 2954.855284][T14359] Reported by Kernel Concurrency Sanitizer on: [ 2954.861424][T14359] CPU: 0 PID: 14359 Comm: syz-executor.3 Tainted: G W 5.14.0-rc7-syzkaller #0 [ 2954.871571][T14359] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 2954.881627][T14359] ================================================================== 05:06:23 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f00000004c0)=ANY=[], 0x208e24b) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r2 = syz_io_uring_setup(0x70c4, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000400000/0xc00000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000000)=0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000180)=@IORING_OP_LINK_TIMEOUT={0xf, 0xa89a1c1bd660819, 0x0, 0x0, 0x0, &(0x7f0000000140)}, 0x0) r5 = dup(r2) syz_io_uring_submit(r3, r4, &(0x7f0000000040)=@IORING_OP_CONNECT={0x10, 0x0, 0x0, r5, 0x0, 0x0}, 0x1) io_uring_enter(r5, 0x6700, 0x0, 0x0, 0x0, 0x0) setresgid(0x0, 0x0, 0x0) r6 = socket$nl_xfrm(0x10, 0x3, 0x6) sendfile(r6, r1, 0x0, 0x100000007) 05:06:23 executing program 2: r0 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ftruncate(0xffffffffffffffff, 0x0) lseek(r0, 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000040)) getpgid(0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat2(0xffffffffffffffff, &(0x7f00000001c0)='./bus\x00', 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000100)={'syztnl0\x00', &(0x7f0000000240)={'syztnl1\x00', 0x0, 0x2f, 0x1, 0x5, 0x1, 0x48, @mcast2, @ipv4={'\x00', '\xff\xff', @local}, 0x40, 0x8, 0x1, 0x2}}) r1 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r1, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x0, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200), 0x0, 0x0, 0x0, 0x0, 0x0}) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5, 0x8}, 0x0, 0x0, 0x9, 0x7, 0x7fffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f0000062c40)={0x8000000000, [], 0x0, "00001000"}) r2 = creat(&(0x7f0000000140)='./bus\x00', 0x0) io_setup(0x1, &(0x7f0000000180)=0x0) io_submit(r3, 0x45, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000000000, 0x0, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) fallocate(r0, 0x3, 0x0, 0x100000fe) 05:06:24 executing program 0: r0 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ftruncate(0xffffffffffffffff, 0x0) lseek(r0, 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(0xffffffffffffffff, 0x40086602, &(0x7f0000000040)) perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000100)={'syztnl0\x00', &(0x7f0000000240)={'syztnl1\x00', 0x0, 0x2f, 0x1, 0x5, 0x1, 0x48, @mcast2, @ipv4={'\x00', '\xff\xff', @local}, 0x40, 0x8, 0x1, 0x2}}) r1 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r1, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f0000062c40)={0x8000000000, [], 0x0, "00001000"}) r2 = creat(&(0x7f0000000140)='./bus\x00', 0x0) io_setup(0x1, &(0x7f0000000180)=0x0) io_submit(r3, 0x45, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000000000, 0x0, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) fallocate(r0, 0x3, 0x0, 0x100000fe) 05:06:24 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef010000140000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:06:24 executing program 4: r0 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ftruncate(0xffffffffffffffff, 0x0) lseek(r0, 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000040)) r1 = getpgid(0x0) perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, r1, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$RTC_WKALM_SET(r0, 0x4028700f, &(0x7f0000000000)={0x1, 0x0, {0x10, 0x3b, 0x1, 0x1a, 0x9, 0x3, 0x0, 0xcc, 0x1}}) socket$inet6_udp(0xa, 0x2, 0x0) fsmount(r0, 0x0, 0x71) r2 = openat2(0xffffffffffffffff, &(0x7f00000001c0)='./bus\x00', 0x0, 0x0) sendto$inet6(r2, &(0x7f0000000300), 0x0, 0x0, 0x0, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5, 0x8}, 0x0, 0x0, 0x9, 0x7, 0x7fffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f0000062c40)={0x8000000000, [], 0x0, "00001000"}) r3 = creat(&(0x7f0000000140)='./bus\x00', 0x0) io_setup(0x1, &(0x7f0000000180)=0x0) io_submit(r4, 0x45, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000000000, 0x0, 0x1, 0x0, r3, &(0x7f0000000000), 0x377140be6b5ef4c7}]) fallocate(r0, 0x3, 0x0, 0x100000fe) [ 2955.424072][ C1] sd 0:0:1:0: [sg0] tag#754 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2955.434393][ C1] sd 0:0:1:0: [sg0] tag#754 CDB: opcode=0xe5 (vendor) [ 2955.441180][ C1] sd 0:0:1:0: [sg0] tag#754 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2955.450795][ C1] sd 0:0:1:0: [sg0] tag#754 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2955.460278][ C1] sd 0:0:1:0: [sg0] tag#754 CDB[20]: ba 05:06:24 executing program 5: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f00000004c0)=ANY=[], 0x208e24b) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r2 = syz_io_uring_setup(0x70c4, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000400000/0xc00000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000000)=0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000180)=@IORING_OP_LINK_TIMEOUT={0xf, 0xa89a1c1bd660819, 0x0, 0x0, 0x0, &(0x7f0000000140)}, 0x0) r5 = dup(r2) syz_io_uring_setup(0x5639, &(0x7f00000002c0)={0x0, 0x9c60, 0x1, 0x0, 0x17a, 0x0, r1}, &(0x7f0000ffb000/0x3000)=nil, &(0x7f000093f000/0x1000)=nil, &(0x7f00000000c0), &(0x7f0000000200)=0x0) syz_io_uring_submit(r3, r6, &(0x7f0000000340)=@IORING_OP_READV=@use_registered_buffer={0x1, 0x4, 0x2007, @fd=r2, 0x0, 0x0, 0x0, 0xc, 0x1, {0x3}}, 0xdbf) syz_io_uring_submit(r3, r4, &(0x7f0000000040)=@IORING_OP_CONNECT={0x10, 0x0, 0x0, r5, 0x0, 0x0}, 0x1) io_uring_enter(r5, 0x6700, 0x0, 0x0, 0x0, 0x0) openat$pidfd(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) recvmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000004c80)={0x77359400}) setresgid(0x0, 0x0, 0x0) r7 = socket$nl_xfrm(0x10, 0x3, 0x6) sendfile(r7, r1, 0x0, 0x100000002) 05:06:24 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef0100ff1f0000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:06:24 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef010000200000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:06:24 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef010000810000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:06:24 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef010004820000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:06:24 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef0100009a0000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:06:24 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef010000b10000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:06:24 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f00000004c0)=ANY=[], 0x208e24b) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r2 = syz_io_uring_setup(0x70c4, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000400000/0xc00000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000000)=0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000180)=@IORING_OP_LINK_TIMEOUT={0xf, 0xa89a1c1bd660819, 0x0, 0x0, 0x0, &(0x7f0000000140)}, 0x0) r5 = dup(r2) syz_io_uring_submit(r3, r4, &(0x7f0000000040)=@IORING_OP_CONNECT={0x10, 0x0, 0x0, r5, 0x0, 0x0}, 0x1) io_uring_enter(r5, 0x6700, 0x0, 0x0, 0x0, 0x0) setresgid(0x0, 0x0, 0x0) r6 = socket$nl_xfrm(0x10, 0x3, 0x6) sendfile(r6, r1, 0x0, 0x100000008) 05:06:24 executing program 2: r0 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ftruncate(0xffffffffffffffff, 0x0) lseek(r0, 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000040)) getpgid(0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat2(0xffffffffffffffff, &(0x7f00000001c0)='./bus\x00', 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000100)={'syztnl0\x00', &(0x7f0000000240)={'syztnl1\x00', 0x0, 0x2f, 0x1, 0x5, 0x1, 0x48, @mcast2, @ipv4={'\x00', '\xff\xff', @local}, 0x40, 0x8, 0x1, 0x2}}) r1 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r1, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x0, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200), 0x0, 0x0, 0x0, 0x0, 0x0}) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5, 0x8}, 0x0, 0x0, 0x9, 0x7, 0x7fffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f0000062c40)={0x8000000000, [], 0x0, "00001000"}) r2 = creat(&(0x7f0000000140)='./bus\x00', 0x0) io_setup(0x1, &(0x7f0000000180)=0x0) io_submit(r3, 0x45, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000000000, 0x0, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) fallocate(r0, 0x3, 0x0, 0x100000fe) 05:06:25 executing program 0: r0 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ftruncate(0xffffffffffffffff, 0x0) lseek(r0, 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(0xffffffffffffffff, 0x40086602, &(0x7f0000000040)) perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000100)={'syztnl0\x00', &(0x7f0000000240)={'syztnl1\x00', 0x0, 0x2f, 0x1, 0x5, 0x1, 0x48, @mcast2, @ipv4={'\x00', '\xff\xff', @local}, 0x40, 0x8, 0x1, 0x2}}) r1 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r1, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f0000062c40)={0x8000000000, [], 0x0, "00001000"}) r2 = creat(&(0x7f0000000140)='./bus\x00', 0x0) io_setup(0x1, &(0x7f0000000180)=0x0) io_submit(r3, 0x45, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000000000, 0x0, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) fallocate(r0, 0x3, 0x0, 0x100000fe) 05:06:25 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef0100feff0000daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) [ 2956.436810][ C0] sd 0:0:1:0: [sg0] tag#748 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2956.447149][ C0] sd 0:0:1:0: [sg0] tag#748 CDB: opcode=0xe5 (vendor) [ 2956.453961][ C0] sd 0:0:1:0: [sg0] tag#748 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2956.463655][ C0] sd 0:0:1:0: [sg0] tag#748 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2956.473126][ C0] sd 0:0:1:0: [sg0] tag#748 CDB[20]: ba 05:06:25 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef0100009c0200daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:06:25 executing program 5: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f00000004c0)=ANY=[], 0x208e24b) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r2 = syz_io_uring_setup(0x70c4, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000400000/0xc00000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000000)=0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000180)=@IORING_OP_LINK_TIMEOUT={0xf, 0xa89a1c1bd660819, 0x0, 0x0, 0x0, &(0x7f0000000140)}, 0x0) r5 = dup(r2) syz_io_uring_submit(r3, r4, &(0x7f0000000040)=@IORING_OP_CONNECT={0x10, 0x0, 0x0, r5, 0x0, 0x0}, 0x1) io_uring_enter(r5, 0x6700, 0x0, 0x0, 0x0, 0x0) openat$pidfd(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) syz_io_uring_setup(0x70c4, &(0x7f00000023c0), &(0x7f0000501000/0x4000)=nil, &(0x7f0000935000/0x1000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000380)=0x0) syz_io_uring_submit(r6, r7, &(0x7f00000000c0)=@IORING_OP_REMOVE_BUFFERS={0x1f, 0x0, 0x0, 0x8}, 0x0) syz_io_uring_submit(r3, r7, &(0x7f00000000c0)=@IORING_OP_SEND={0x1a, 0x5, 0x0, r1, 0x0, &(0x7f00000002c0)="73e1dbe748d6f793f6b163090e0e34b33f6293e555798f22bb4b62d0589a24afd81b5ca52357ab4abb9ba16662398d69fbaf91aa12b3574f4bd31ea4810e11a8e568af511af4cc9e8d4ddfae8fbd1957900537887d8958b347138efbdf6593a45ab2a80b64b39c1ae2f10ad6ed21e8972f21baeb12da0ac9cc3fcc57543ce0e27ca05b19f499070c5a5e49b72f467ad8b44d2f1367517a028bcf176f66460afcb2984d1684f6db5100938d2ee1db7ca07e65b87fc9012a41", 0xb8, 0x80b1}, 0x80000000) recvmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000004c80)={0x77359400}) setresgid(0x0, 0x0, 0x0) r8 = socket$nl_xfrm(0x10, 0x3, 0x6) sendfile(r8, r1, 0x0, 0x100000002) 05:06:25 executing program 4: r0 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ftruncate(0xffffffffffffffff, 0x0) lseek(r0, 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000040)) r1 = getpgid(0x0) perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, r1, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$RTC_WKALM_SET(r0, 0x4028700f, &(0x7f0000000000)={0x1, 0x0, {0x10, 0x3b, 0x1, 0x1a, 0x9, 0x3, 0x0, 0xcc, 0x1}}) socket$inet6_udp(0xa, 0x2, 0x0) fsmount(r0, 0x0, 0x71) openat2(0xffffffffffffffff, &(0x7f00000001c0)='./bus\x00', 0x0, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5, 0x8}, 0x0, 0x0, 0x9, 0x7, 0x7fffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f0000062c40)={0x8000000000, [], 0x0, "00001000"}) r3 = creat(&(0x7f0000000140)='./bus\x00', 0x0) io_setup(0x1, &(0x7f0000000180)=0x0) io_submit(r4, 0x45, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000000000, 0x0, 0x1, 0x0, r3, &(0x7f0000000000), 0x377140be6b5ef4c7}]) fallocate(r0, 0x3, 0x0, 0x100000fe) 05:06:25 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef0100ffff0300daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) [ 2956.693192][ C1] sd 0:0:1:0: [sg0] tag#763 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2956.703519][ C1] sd 0:0:1:0: [sg0] tag#763 CDB: opcode=0xe5 (vendor) [ 2956.710295][ C1] sd 0:0:1:0: [sg0] tag#763 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2956.719888][ C1] sd 0:0:1:0: [sg0] tag#763 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2956.729468][ C1] sd 0:0:1:0: [sg0] tag#763 CDB[20]: ba 05:06:25 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef010092de1500daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:06:25 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef010093de1500daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:06:25 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef010094de1500daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:06:25 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef010095de1500daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:06:25 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f00000004c0)=ANY=[], 0x208e24b) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r2 = syz_io_uring_setup(0x70c4, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000400000/0xc00000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000000)=0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000180)=@IORING_OP_LINK_TIMEOUT={0xf, 0xa89a1c1bd660819, 0x0, 0x0, 0x0, &(0x7f0000000140)}, 0x0) r5 = dup(r2) syz_io_uring_submit(r3, r4, &(0x7f0000000040)=@IORING_OP_CONNECT={0x10, 0x0, 0x0, r5, 0x0, 0x0}, 0x1) io_uring_enter(r5, 0x6700, 0x0, 0x0, 0x0, 0x0) setresgid(0x0, 0x0, 0x0) r6 = socket$nl_xfrm(0x10, 0x3, 0x6) sendfile(r6, r1, 0x0, 0x100000009) 05:06:25 executing program 2: r0 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ftruncate(0xffffffffffffffff, 0x0) lseek(r0, 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000040)) getpgid(0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat2(0xffffffffffffffff, &(0x7f00000001c0)='./bus\x00', 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000100)={'syztnl0\x00', &(0x7f0000000240)={'syztnl1\x00', 0x0, 0x2f, 0x1, 0x5, 0x1, 0x48, @mcast2, @ipv4={'\x00', '\xff\xff', @local}, 0x40, 0x8, 0x1, 0x2}}) r1 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r1, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x11, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c92", 0x0, 0x0, 0x0, 0x0, 0x0}) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5, 0x8}, 0x0, 0x0, 0x9, 0x7, 0x7fffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f0000062c40)={0x8000000000, [], 0x0, "00001000"}) r2 = creat(&(0x7f0000000140)='./bus\x00', 0x0) io_setup(0x1, &(0x7f0000000180)=0x0) io_submit(r3, 0x45, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000000000, 0x0, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) fallocate(r0, 0x3, 0x0, 0x100000fe) 05:06:25 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef010096de1500daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:06:25 executing program 0: r0 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ftruncate(0xffffffffffffffff, 0x0) lseek(r0, 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(0xffffffffffffffff, 0x40086602, &(0x7f0000000040)) perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000100)={'syztnl0\x00', &(0x7f0000000240)={'syztnl1\x00', 0x0, 0x2f, 0x1, 0x5, 0x1, 0x48, @mcast2, @ipv4={'\x00', '\xff\xff', @local}, 0x40, 0x8, 0x1, 0x2}}) r1 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r1, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f0000062c40)={0x8000000000, [], 0x0, "00001000"}) r2 = creat(&(0x7f0000000140)='./bus\x00', 0x0) io_setup(0x1, &(0x7f0000000180)=0x0) io_submit(r3, 0x45, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000000000, 0x0, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) fallocate(r0, 0x3, 0x0, 0x100000fe) 05:06:26 executing program 4: r0 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ftruncate(0xffffffffffffffff, 0x0) lseek(r0, 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000040)) r1 = getpgid(0x0) perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, r1, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$RTC_WKALM_SET(r0, 0x4028700f, &(0x7f0000000000)={0x1, 0x0, {0x10, 0x3b, 0x1, 0x1a, 0x9, 0x3, 0x0, 0xcc, 0x1}}) socket$inet6_udp(0xa, 0x2, 0x0) fsmount(r0, 0x0, 0x71) openat2(0xffffffffffffffff, &(0x7f00000001c0)='./bus\x00', 0x0, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5, 0x8}, 0x0, 0x0, 0x9, 0x7, 0x7fffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f0000062c40)={0x8000000000, [], 0x0, "00001000"}) r3 = creat(&(0x7f0000000140)='./bus\x00', 0x0) io_setup(0x1, &(0x7f0000000180)=0x0) io_submit(r4, 0x45, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000000000, 0x0, 0x1, 0x0, r3, &(0x7f0000000000), 0x377140be6b5ef4c7}]) fallocate(r0, 0x3, 0x0, 0x100000fe) [ 2957.370222][ C1] sd 0:0:1:0: [sg0] tag#722 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2957.380571][ C1] sd 0:0:1:0: [sg0] tag#722 CDB: opcode=0xe5 (vendor) [ 2957.387373][ C1] sd 0:0:1:0: [sg0] tag#722 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2957.396930][ C1] sd 0:0:1:0: [sg0] tag#722 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2957.406579][ C1] sd 0:0:1:0: [sg0] tag#722 CDB[20]: ba [ 2957.413161][ C0] sd 0:0:1:0: [sg0] tag#723 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2957.423574][ C0] sd 0:0:1:0: [sg0] tag#723 CDB: opcode=0xe5 (vendor) [ 2957.430395][ C0] sd 0:0:1:0: [sg0] tag#723 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2957.439883][ C0] sd 0:0:1:0: [sg0] tag#723 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2957.449375][ C0] sd 0:0:1:0: [sg0] tag#723 CDB[20]: ba 05:06:26 executing program 5: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f00000004c0)=ANY=[], 0x208e24b) r1 = syz_open_procfs(0x0, &(0x7f0000000240)='mountinfo\x00') sendfile(0xffffffffffffffff, r1, 0x0, 0x800000080004103) openat(r1, &(0x7f0000000200)='./file0\x00', 0x10000, 0x54) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r3 = syz_open_dev$tty1(0xc, 0x4, 0x1) r4 = syz_open_procfs(0x0, &(0x7f0000000240)='mountinfo\x00') sendfile(r3, r4, 0x0, 0x800000080004103) ioctl$sock_SIOCSIFVLAN_GET_VLAN_INGRESS_PRIORITY_CMD(r4, 0x8983, &(0x7f00000000c0)) r5 = syz_io_uring_setup(0x70c4, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000400000/0xc00000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000000)=0x0) syz_io_uring_submit(r6, r7, &(0x7f0000000180)=@IORING_OP_LINK_TIMEOUT={0xf, 0x1, 0x0, 0x0, 0x0, &(0x7f0000000140)}, 0x0) r8 = dup(r5) syz_io_uring_submit(r6, r7, &(0x7f0000000040)=@IORING_OP_CONNECT={0x10, 0x0, 0x0, r8, 0x0, 0x0}, 0x1) io_uring_enter(r8, 0x6700, 0x0, 0x0, 0x0, 0x0) openat$pidfd(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) recvmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000004c80)={0x77359400}) setresgid(0x0, 0x0, 0x0) r9 = socket$nl_xfrm(0x10, 0x3, 0x6) sendfile(r9, r2, 0x0, 0x100000002) 05:06:26 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef010097de1500daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:06:26 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef010098de1500daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:06:26 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef010099de1500daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:06:26 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef01009ade1500daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:06:26 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef01009bde1500daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:06:26 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef01009cde1500daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:06:26 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f00000004c0)=ANY=[], 0x208e24b) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r2 = syz_io_uring_setup(0x70c4, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000400000/0xc00000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000000)=0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000180)=@IORING_OP_LINK_TIMEOUT={0xf, 0xa89a1c1bd660819, 0x0, 0x0, 0x0, &(0x7f0000000140)}, 0x0) r5 = dup(r2) syz_io_uring_submit(r3, r4, &(0x7f0000000040)=@IORING_OP_CONNECT={0x10, 0x0, 0x0, r5, 0x0, 0x0}, 0x1) io_uring_enter(r5, 0x6700, 0x0, 0x0, 0x0, 0x0) setresgid(0x0, 0x0, 0x0) r6 = socket$nl_xfrm(0x10, 0x3, 0x6) sendfile(r6, r1, 0x0, 0x10000000c) 05:06:26 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef01009dde1500daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:06:26 executing program 2: r0 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ftruncate(0xffffffffffffffff, 0x0) lseek(r0, 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000040)) getpgid(0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat2(0xffffffffffffffff, &(0x7f00000001c0)='./bus\x00', 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000100)={'syztnl0\x00', &(0x7f0000000240)={'syztnl1\x00', 0x0, 0x2f, 0x1, 0x5, 0x1, 0x48, @mcast2, @ipv4={'\x00', '\xff\xff', @local}, 0x40, 0x8, 0x1, 0x2}}) r1 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r1, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x11, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c92", 0x0, 0x0, 0x0, 0x0, 0x0}) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5, 0x8}, 0x0, 0x0, 0x9, 0x7, 0x7fffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f0000062c40)={0x8000000000, [], 0x0, "00001000"}) r2 = creat(&(0x7f0000000140)='./bus\x00', 0x0) io_setup(0x1, &(0x7f0000000180)=0x0) io_submit(r3, 0x45, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000000000, 0x0, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) fallocate(r0, 0x3, 0x0, 0x100000fe) 05:06:26 executing program 0: r0 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ftruncate(0xffffffffffffffff, 0x0) lseek(r0, 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(0xffffffffffffffff, 0x40086602, &(0x7f0000000040)) perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, 0x0) r1 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r1, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f0000062c40)={0x8000000000, [], 0x0, "00001000"}) r2 = creat(&(0x7f0000000140)='./bus\x00', 0x0) io_setup(0x1, &(0x7f0000000180)=0x0) io_submit(r3, 0x45, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000000000, 0x0, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) fallocate(r0, 0x3, 0x0, 0x100000fe) [ 2958.329284][ C1] sd 0:0:1:0: [sg0] tag#752 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2958.339620][ C1] sd 0:0:1:0: [sg0] tag#752 CDB: opcode=0xe5 (vendor) [ 2958.346393][ C1] sd 0:0:1:0: [sg0] tag#752 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2958.356061][ C1] sd 0:0:1:0: [sg0] tag#752 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2958.365642][ C1] sd 0:0:1:0: [sg0] tag#752 CDB[20]: ba 05:06:27 executing program 4: r0 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ftruncate(0xffffffffffffffff, 0x0) lseek(r0, 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000040)) r1 = getpgid(0x0) perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, r1, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$RTC_WKALM_SET(r0, 0x4028700f, &(0x7f0000000000)={0x1, 0x0, {0x10, 0x3b, 0x1, 0x1a, 0x9, 0x3, 0x0, 0xcc, 0x1}}) socket$inet6_udp(0xa, 0x2, 0x0) fsmount(r0, 0x0, 0x71) openat2(0xffffffffffffffff, &(0x7f00000001c0)='./bus\x00', 0x0, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5, 0x8}, 0x0, 0x0, 0x9, 0x7, 0x7fffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f0000062c40)={0x8000000000, [], 0x0, "00001000"}) r3 = creat(&(0x7f0000000140)='./bus\x00', 0x0) io_setup(0x1, &(0x7f0000000180)=0x0) io_submit(r4, 0x45, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000000000, 0x0, 0x1, 0x0, r3, &(0x7f0000000000), 0x377140be6b5ef4c7}]) fallocate(r0, 0x3, 0x0, 0x100000fe) [ 2958.514894][ C1] sd 0:0:1:0: [sg0] tag#760 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2958.525211][ C1] sd 0:0:1:0: [sg0] tag#760 CDB: opcode=0xe5 (vendor) [ 2958.532011][ C1] sd 0:0:1:0: [sg0] tag#760 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2958.541498][ C1] sd 0:0:1:0: [sg0] tag#760 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2958.550997][ C1] sd 0:0:1:0: [sg0] tag#760 CDB[20]: ba 05:06:27 executing program 5: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f00000004c0)=ANY=[], 0x208e24b) openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000000c0)='cpuacct.usage_user\x00', 0x0, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r2 = syz_io_uring_setup(0x70c4, &(0x7f0000000240)={0x0, 0x818c}, &(0x7f0000fff000/0x1000)=nil, &(0x7f00007a2000/0x3000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000000)=0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000180)=@IORING_OP_LINK_TIMEOUT={0xf, 0xa89a1c1bd660819, 0x0, 0x0, 0x0, &(0x7f0000000140)}, 0x0) r5 = dup(r2) syz_io_uring_submit(r3, r4, &(0x7f0000000040)=@IORING_OP_CONNECT={0x10, 0x0, 0x0, r5, 0x0, 0x0}, 0x1) io_uring_enter(r5, 0x6700, 0x0, 0x0, 0x0, 0x0) openat$pidfd(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) recvmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000004c80)={0x77359400}) setresgid(0x0, 0x0, 0x0) r6 = socket$nl_xfrm(0x10, 0x3, 0x6) sendfile(r6, r1, 0x0, 0x100000002) 05:06:27 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef01009ede1500daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:06:27 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef01009fde1500daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:06:27 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef0100a0de1500daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:06:27 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef0100a1de1500daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:06:27 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef0100a2de1500daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:06:27 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f00000004c0)=ANY=[], 0x208e24b) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r2 = syz_io_uring_setup(0x70c4, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000400000/0xc00000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000000)=0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000180)=@IORING_OP_LINK_TIMEOUT={0xf, 0xa89a1c1bd660819, 0x0, 0x0, 0x0, &(0x7f0000000140)}, 0x0) r5 = dup(r2) syz_io_uring_submit(r3, r4, &(0x7f0000000040)=@IORING_OP_CONNECT={0x10, 0x0, 0x0, r5, 0x0, 0x0}, 0x1) io_uring_enter(r5, 0x6700, 0x0, 0x0, 0x0, 0x0) setresgid(0x0, 0x0, 0x0) r6 = socket$nl_xfrm(0x10, 0x3, 0x6) sendfile(r6, r1, 0x0, 0x10000000d) 05:06:27 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef0100a3de1500daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:06:27 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef0100a4de1500daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:06:27 executing program 2: r0 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ftruncate(0xffffffffffffffff, 0x0) lseek(r0, 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000040)) getpgid(0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat2(0xffffffffffffffff, &(0x7f00000001c0)='./bus\x00', 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000100)={'syztnl0\x00', &(0x7f0000000240)={'syztnl1\x00', 0x0, 0x2f, 0x1, 0x5, 0x1, 0x48, @mcast2, @ipv4={'\x00', '\xff\xff', @local}, 0x40, 0x8, 0x1, 0x2}}) r1 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r1, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x11, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c92", 0x0, 0x0, 0x0, 0x0, 0x0}) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5, 0x8}, 0x0, 0x0, 0x9, 0x7, 0x7fffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f0000062c40)={0x8000000000, [], 0x0, "00001000"}) r2 = creat(&(0x7f0000000140)='./bus\x00', 0x0) io_setup(0x1, &(0x7f0000000180)=0x0) io_submit(r3, 0x45, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000000000, 0x0, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) fallocate(r0, 0x3, 0x0, 0x100000fe) 05:06:28 executing program 0: r0 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ftruncate(0xffffffffffffffff, 0x0) lseek(r0, 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(0xffffffffffffffff, 0x40086602, &(0x7f0000000040)) perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, 0x0) r1 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r1, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f0000062c40)={0x8000000000, [], 0x0, "00001000"}) r2 = creat(&(0x7f0000000140)='./bus\x00', 0x0) io_setup(0x1, &(0x7f0000000180)=0x0) io_submit(r3, 0x45, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000000000, 0x0, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) fallocate(r0, 0x3, 0x0, 0x100000fe) [ 2959.388437][ C1] sd 0:0:1:0: [sg0] tag#742 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2959.398753][ C1] sd 0:0:1:0: [sg0] tag#742 CDB: opcode=0xe5 (vendor) [ 2959.405566][ C1] sd 0:0:1:0: [sg0] tag#742 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2959.415052][ C1] sd 0:0:1:0: [sg0] tag#742 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2959.424538][ C1] sd 0:0:1:0: [sg0] tag#742 CDB[20]: ba 05:06:28 executing program 4: r0 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ftruncate(0xffffffffffffffff, 0x0) lseek(r0, 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000040)) r1 = getpgid(0x0) perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, r1, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$RTC_WKALM_SET(r0, 0x4028700f, &(0x7f0000000000)={0x1, 0x0, {0x10, 0x3b, 0x1, 0x1a, 0x9, 0x3, 0x0, 0xcc, 0x1}}) socket$inet6_udp(0xa, 0x2, 0x0) fsmount(r0, 0x0, 0x71) sendto$inet6(0xffffffffffffffff, &(0x7f0000000300), 0x0, 0x0, 0x0, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5, 0x8}, 0x0, 0x0, 0x9, 0x7, 0x7fffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f0000062c40)={0x8000000000, [], 0x0, "00001000"}) r3 = creat(&(0x7f0000000140)='./bus\x00', 0x0) io_setup(0x1, &(0x7f0000000180)=0x0) io_submit(r4, 0x45, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000000000, 0x0, 0x1, 0x0, r3, &(0x7f0000000000), 0x377140be6b5ef4c7}]) fallocate(r0, 0x3, 0x0, 0x100000fe) 05:06:28 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef0100a5de1500daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:06:28 executing program 5: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f00000004c0)=ANY=[], 0x208e24b) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r2 = syz_io_uring_setup(0x70c4, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000400000/0xc00000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000000)=0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000180)=@IORING_OP_LINK_TIMEOUT={0xf, 0xa89a1c1bd660819, 0x0, 0x0, 0x0, &(0x7f0000000140)}, 0x0) r5 = dup(r2) syz_io_uring_submit(r3, r4, &(0x7f0000000040)=@IORING_OP_ASYNC_CANCEL={0xe, 0x1, 0x0, 0x0, 0x0, 0x23456, 0x0, 0x0, 0x1}, 0x1) io_uring_enter(r5, 0x6700, 0x0, 0x0, 0x0, 0x0) openat$pidfd(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) recvmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000004c80)={0x77359400}) setresgid(0x0, 0x0, 0x0) r6 = socket$nl_xfrm(0x10, 0x3, 0x6) sendfile(r6, r1, 0x0, 0x100000002) 05:06:28 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef0100a6de1500daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) [ 2959.666372][ C0] sd 0:0:1:0: [sg0] tag#747 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2959.676719][ C0] sd 0:0:1:0: [sg0] tag#747 CDB: opcode=0xe5 (vendor) [ 2959.683591][ C0] sd 0:0:1:0: [sg0] tag#747 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2959.693072][ C0] sd 0:0:1:0: [sg0] tag#747 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2959.702544][ C0] sd 0:0:1:0: [sg0] tag#747 CDB[20]: ba 05:06:28 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef0100a7de1500daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:06:28 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef0100a8de1500daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:06:28 executing program 1: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f00000004c0)=ANY=[], 0x208e24b) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r2 = syz_io_uring_setup(0x70c4, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000400000/0xc00000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000000)=0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000180)=@IORING_OP_LINK_TIMEOUT={0xf, 0xa89a1c1bd660819, 0x0, 0x0, 0x0, &(0x7f0000000140)}, 0x0) r5 = dup(r2) syz_io_uring_submit(r3, r4, &(0x7f0000000040)=@IORING_OP_CONNECT={0x10, 0x0, 0x0, r5, 0x0, 0x0}, 0x1) io_uring_enter(r5, 0x6700, 0x0, 0x0, 0x0, 0x0) setresgid(0x0, 0x0, 0x0) r6 = socket$nl_xfrm(0x10, 0x3, 0x6) sendfile(r6, r1, 0x0, 0x10000000f) 05:06:28 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef0100a9de1500daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:06:28 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef0100aade1500daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:06:28 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef0100abde1500daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:06:29 executing program 2: r0 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ftruncate(0xffffffffffffffff, 0x0) lseek(r0, 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000040)) getpgid(0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat2(0xffffffffffffffff, &(0x7f00000001c0)='./bus\x00', 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000100)={'syztnl0\x00', &(0x7f0000000240)={'syztnl1\x00', 0x0, 0x2f, 0x1, 0x5, 0x1, 0x48, @mcast2, @ipv4={'\x00', '\xff\xff', @local}, 0x40, 0x8, 0x1, 0x2}}) r1 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r1, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x19, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d4", 0x0, 0x0, 0x0, 0x0, 0x0}) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5, 0x8}, 0x0, 0x0, 0x9, 0x7, 0x7fffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f0000062c40)={0x8000000000, [], 0x0, "00001000"}) r2 = creat(&(0x7f0000000140)='./bus\x00', 0x0) io_setup(0x1, &(0x7f0000000180)=0x0) io_submit(r3, 0x45, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000000000, 0x0, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) fallocate(r0, 0x3, 0x0, 0x100000fe) 05:06:29 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef0100acde1500daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:06:29 executing program 4: r0 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ftruncate(0xffffffffffffffff, 0x0) lseek(r0, 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000040)) r1 = getpgid(0x0) perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, r1, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$RTC_WKALM_SET(r0, 0x4028700f, &(0x7f0000000000)={0x1, 0x0, {0x10, 0x3b, 0x1, 0x1a, 0x9, 0x3, 0x0, 0xcc, 0x1}}) socket$inet6_udp(0xa, 0x2, 0x0) fsmount(r0, 0x0, 0x71) sendto$inet6(0xffffffffffffffff, &(0x7f0000000300), 0x0, 0x0, 0x0, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r2, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) perf_event_open(&(0x7f00000003c0)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, @perf_config_ext={0x5, 0x8}, 0x0, 0x0, 0x9, 0x7, 0x7fffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f0000062c40)={0x8000000000, [], 0x0, "00001000"}) r3 = creat(&(0x7f0000000140)='./bus\x00', 0x0) io_setup(0x1, &(0x7f0000000180)=0x0) io_submit(r4, 0x45, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000000000, 0x0, 0x1, 0x0, r3, &(0x7f0000000000), 0x377140be6b5ef4c7}]) fallocate(r0, 0x3, 0x0, 0x100000fe) 05:06:29 executing program 0: r0 = creat(&(0x7f0000000080)='./bus\x00', 0x0) ftruncate(0xffffffffffffffff, 0x0) lseek(r0, 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(0xffffffffffffffff, 0x40086602, &(0x7f0000000040)) perf_event_open(&(0x7f0000000700)={0x1, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, 0x0) r1 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r1, 0x2285, &(0x7f0000000380)={0x53, 0x0, 0x21, 0x0, @scatter={0x0, 0x0, 0x0}, &(0x7f0000000200)="e5f432732f4e096d26e2c735d135121c921bda40b8585ba8d47d34f3904cf12dba", 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BTRFS_IOC_GET_SUBVOL_ROOTREF(0xffffffffffffffff, 0xd000943d, &(0x7f0000062c40)={0x8000000000, [], 0x0, "00001000"}) r2 = creat(&(0x7f0000000140)='./bus\x00', 0x0) io_setup(0x1, &(0x7f0000000180)=0x0) io_submit(r3, 0x45, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x400000000000, 0x0, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) fallocate(r0, 0x3, 0x0, 0x100000fe) 05:06:29 executing program 3: syz_mount_image$tmpfs(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f0000002880)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/exe\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1800003, 0x12, r2, 0x0) preadv(r2, &(0x7f0000000280), 0x18, 0xd9f, 0x0) lchown(&(0x7f0000000440)='./file0\x00', r0, 0xee01) setxattr$system_posix_acl(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f0000000600)={{}, {}, [], {}, [{}], {0x10, 0x5}}, 0x2c, 0x0) llistxattr(&(0x7f0000000980)='./file0/../file0\x00', 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x800000080004103) openat$cgroup_subtree(r2, &(0x7f0000007780), 0x2, 0x0) clone3(&(0x7f0000009180)={0x40000000, &(0x7f0000007fc0), &(0x7f0000008000), 0x0, {0x6}, &(0x7f0000008080)=""/4096, 0x1000, &(0x7f0000009080)=""/138, 0x0, 0x0, {r2}}, 0x58) r3 = syz_mount_image$ext4(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./file0\x00', 0x200000, 0x7, &(0x7f0000000200)=[{&(0x7f0000010000)="200000000002000019000000900100000f000000000000000200000006000000000008000080000020000000dbf4655fdbf4655f0100ffff53ef0100adde1500daf4655f000000000000000001000000000000000b0000000004000008000000d2c200001203", 0x66, 0x400}, {&(0x7f0000010100)="00000000000000000000000082e36724c6f34caa846ed2e527703378010040", 0x1f, 0x4e0}, {0x0, 0x0, 0x640}, {&(0x7f0000010400)="02000000030000000400000019000f000300040000000000000000000f002e69", 0x20, 0x1000}, {&(0x7f0000012600)="ed41000000100000daf4655fdbf4655fdbf4655f000000000000040080", 0x1d, 0x4400}, {&(0x7f0000012800)="8081000000180000daf4655fdaf4655fdaf4655f00000000000001008000000010000800000000000af301000400000000000000000000000200000030", 0x3d, 0x4800}, {&(0x7f0000013900)="111fc0d901000000803a0900803a09000000000006", 0x15, 0x30000}], 0x0, &(0x7f00000000c0)=ANY=[]) stat(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r3, r4, 0xffffffffffffffff) getgroups(0x8, &(0x7f0000009200)=[r1, r1, r1, r1, 0xee01, r1, r1, r1]) 05:06:29 executing program 5: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r0, &(0x7f00000004c0)=ANY=[], 0x208e24b) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0xb00000000065808, 0x0) r2 = syz_io_uring_setup(0x70c4, &(0x7f0000000240), &(0x7f0000002000/0x2000)=nil, &(0x7f0000400000/0xc00000)=nil, &(0x7f0000000100)=0x0, &(0x7f0000000000)=0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000180)=@IORING_OP_LINK_TIMEOUT={0xf, 0xa89a1c1bd660819, 0x0, 0x0, 0x0, &(0x7f0000000140)}, 0x0) r5 = dup(r2) syz_io_uring_submit(r3, r4, &(0x7f0000000040)=@IORING_OP_CONNECT={0x10, 0x0, 0x0, r5, 0x0, 0x0}, 0x1) io_uring_enter(r5, 0x6700, 0x0, 0x0, 0x0, 0x0) openat$pidfd(0xffffffffffffff9c, &(0x7f0000000900), 0x0, 0x0) r6 = syz_io_uring_setup(0x3bab, &(0x7f00000002c0)={0x0, 0x300a, 0x10, 0x1, 0x16e, 0x0, r1}, &(0x7f0000ffc000/0x4000)=nil, &(0x7f000099c000/0x2000)=nil, &(0x7f00000000c0), &(0x7f0000000200)) write$binfmt_elf64(r6, &(0x7f0000000940)={{0x7f, 0x45, 0x4c, 0x46, 0x8, 0x1, 0x20, 0x8, 0x1, 0x2, 0x3e, 0x200, 0x32, 0x40, 0x1, 0xaa, 0x2, 0x38, 0x1, 0xcb8, 0x6, 0x20}, [{0x6, 0xfffffbff, 0x9, 0x7ff, 0x5f, 0x9, 0x1, 0x1000}], "6256139d59f4499296f93001ce8658e1193ace1a1fbf0acd76a3c18d0c864645123d9fadb79a110c018d332513131333d919d5e98f6802b072000daff2fa02cca2886f69d7879c0caccd161156fc29a84c735f3b80dd5e1149e52e95c93fb2ba0c44035d6e483fcead481a087a80fdee198d79aac08f8cd38b03857076db1c9b5b06d891bb34b629791ee530e9da3bed55b06293c4c00fcd59f4b26a9f852744d47e8911eef8fea570ba93f1744debcb10e4f14249b853736b34c2473b18fddc0c0f0ac5cd4e2762d03a38", ['\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00']}, 0x843) recvmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000004c80)={0x77359400}) setresgid(0x0, 0x0, 0x0) r7 = socket$nl_xfrm(0x10, 0x3, 0x6) sendfile(r7, r1, 0x0, 0x100000002) [ 2960.681952][ C1] sd 0:0:1:0: [sg0] tag#704 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s [ 2960.692263][ C1] sd 0:0:1:0: [sg0] tag#704 CDB: opcode=0xe5 (vendor) [ 2960.699517][ C1] sd 0:0:1:0: [sg0] tag#704 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c [ 2960.709023][ C1] sd 0:0:1:0: [sg0] tag#704 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d [ 2960.718531][ C1] sd 0:0:1:0: [sg0] tag#704 CDB[2